1. 前言
- Suricata的安装包可以从 github上克隆安装,可以从Suricata官网进行下载。本文的测试以github上的版本为例。
- 本文的测试平台为 CentOS release 6.7 (Final),不同Linux平台类似。
- 由于实际需求,本文中的Suricata编译将加入PF_RING零拷贝工具。
2. Suricata Build Info 详解
[root@monster suricata]
This is Suricata version 3.0.1 RELEASE
Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 PF_RING AF_PACKET HAVE_PACKET_FANOUT HAVE_HTP_URI_NORMALIZE_HOOK HAVE_NSS TLS
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrisics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 4.4.7 20120313 (Red Hat 4.4.7-16), C version 199901
compiled with _FORTIFY_SOURCE=0
L1 cache line size (CLS)=64
thread local storage method: __thread
compiled with LibHTP v0.5.19, linked against LibHTP v0.5.19
Suricata Configuration:
AF_PACKET support: yes
PF_RING support: