Suricata+PF_RING安装详解

1. 前言

1. Suricata的安装包可以从 github上克隆安装，可以从Suricata官网进行下载。本文的测试以github上的版本为例。
2. 本文的测试平台为 CentOS release 6.7 (Final),不同Linux平台类似。
3. 由于实际需求，本文中的Suricata编译将加入PF_RING零拷贝工具。

2. Suricata Build Info 详解

[root@monster suricata]# suricata --build-info
This is Suricata version 3.0.1 RELEASE
Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 PF_RING AF_PACKET HAVE_PACKET_FANOUT HAVE_HTP_URI_NORMALIZE_HOOK HAVE_NSS TLS 
SIMD support: SSE_4_2 SSE_4_1 SSE_3 
Atomic intrisics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 4.4.7 20120313 (Red Hat 4.4.7-16), C version 199901
compiled with _FORTIFY_SOURCE=0
L1 cache line size (CLS)=64
thread local storage method: __thread
compiled with LibHTP v0.5.19, linked against LibHTP v0.5.19

Suricata Configuration:
  AF_PACKET support:                       yes
  PF_RING support: