CentOS7 安装 suricata

安装依赖
$ sudo yum install wget libpcap-devel libnet-devel pcre-devel gcc-c++ automake autoconf libtool make libyaml-devel zlib-devel file-devel jansson-devel nss-devel

下载安装包
开始下载的最新版本发现没有对应的最新规则，4.0有
下载https://www.openinfosecfoundation.org/download/suricata-4.0.0.tar.gz
tar -xvf suricata-4.0.4.tar.gz

编译安装
./configure --sysconfdir=/etc --localstatedir=/var
$ make
$ make install
$ make install-conf
$ make install-rules(mac下make install-full)

配置文件
路径在/etc/suricata/suricata.yaml

启用Suricata功能
$ sudo ethtool -K eth0 gro off lro off
$ sudo /usr/local/bin/suricata --list-runmodes
$ sudo /usr/local/bin/suricata -c /etc/suricata/suricata.yaml -i eth0 --init-errors-fatal
$ tail -f /var/log/suricata/fast.log

规则用途和说明：
https://doc.emergingthreats.net/bin/view/Main/EmergingFAQ