Target Audience This quick guide is intended for those who would like to develop and/or make changes to Suricata. These instructions are not suitable for a live or production installation of Suricata. Requirements Fedora 42 or Ubuntu 24.04: Inside WSL is OK. Other versions of Fedora and Ubuntu might need the package installation commands modified. Root access via sudo . Basic familiarity with…
Note: This guide has been superseded by Quick Guide to Building and Testing Suricata on Linux , which covers both Ubuntu and Fedora distributions. Target Audience This quick guide is intended for those who would like to develop and/or make changes to Suricata. These instructions are not suitable for a live or production installation of Suricata. Requirements Ubuntu 24.04 (inside WSL is OK )…
This post is out of date and references images and links that no longer exist. Do your Suricata modifications build for you but fail on the Suricata Travis-CI ? Or does your PR get rejected for not building on the private build servers? Try suricata-test-builders , an unofficial set of Docker and Vagrant build environments that perform a variety of builds across a variety of Linux distributions…
Following up on EveBox support for SQLite , I've created a screencast demo of oneshot mode. Oneshot is an interactive run of EveBox to process a single eve.json file and view it in the EveBox UI.
The latest builds of EveBox support an embedded SQLite database that allow it to be used without Elastic Search for lighter loads. The SQLite support was added to support two use cases that may be of interest to some. One Shot Mode One shot mode is the loading of a single eve.json into a temporary database and allowing the user to work with it, then cleaning up on exit. Probably most useful for…
I've been asked a few times now for "stable" APT and Yum repositories as the current ones are marked "development", in fact they contain the packages created on Travis-CI runs of the master branch. So I've added stable repos for Yum and Apt. For the short term they still contain builds out of the master branch, but uploaded by me instead of the output CI, and they will transition to only…
I've added a new tool to my idstools package to convert the packets (or the payloads) found in Suricata eve logs to a pcap file. To just grab the script, download eve2pcap.py and make it executable, or to install the complete idstools package (will install as idstools-eve2pcap ): pip install --upgrade idstools Usage is pretty simple: ./eve2pcap.py -o output.pcap…
Fedora Linux 21 and 22 have Suricata 2.0.8 in their default repositories making it very easy to get started. The following was done on Fedora 22, but should be applicable to Fedora 21 as well. Install Suricata yum install suricata Configure Interface By default, Suricata will be configured to run on eth0, if you need to change this, edit /etc/sysconfig/suricata and change eth0 to…
July 21, 2021 -- This tool is no longer maintained. Instead you should look at Suricata-Update which is the successor to this tool. https://github.com/OISF/suricata-update I didn't mean to do it, but I created yet another tool to download IDS rules, with a specific focus on Suricata. Like some other people, I've always used my own scripts for downloading rules instead…
If you got here looking for Suricata RPMs, please head over https://forum.suricata.io/t/guide-suricata-rpms-for-centos-and-fedora/752 I have created a Suricata Beta yum repository for CentOS/EL 7 to accompany the stable repo which includes the just released Suricata 2.1beta3. Head to http://codemonkey.net/suricata-rpms/ for further details on…
I recently installed some honeypot software and am logging the traffic with Suricata into Elastic Search with Logstash. I know its a bit of a risk to expose Elastic Search like this, but I thought it could make a good demo for EveBox . To check it out head over to https://demo.evebox.org/ with the username "evebox" with the same as the password. This probably won't be up for…
I've updated the Suricata RPM for EL 7 to 2.0.5 . If you have the repo configured just yum update, otherwise see this post for more information.
[2016-07-25: This information is no longer valid, header over to https://codemonkey.net/suricata-rpms/ for up to date links.] I've taken the Suricata package as found in Fedora and rebuilt it for CentOS 7. This should be similar to how the package would exist in EPEL (and hopefully it makes its way there). To get the package with yum, first install the yum repository…
While getting familiar the very popular Docker Linux container tool, I went against best practice and put Suricata, Logstash, Elastic Search and Kibana into a container that is looking promising for demonstration purposes. If you already run this stack on one machine, it might be suitable for real use as well. What you get is a very simple to run application container that abstracts all the tools…
Kibana is really good for getting a high level overview of your Suricata events, but I didn't find it very useful for reviewing individual events, and I'm not really sure if Kibana is really built around that idea, so I created EveBox, a web based event viewer for Suricata events being logged to Elastic Search in "eve" format with a focus on keyboard navigation: Yes, forgive the "yet…
I've made some changes to my simple to install and use PCAP spool web frontend Dumpy including: A rewrite in Go, mostly for entertainment purposes, but the really easy to use concurrency, and single binary installation make Go a good choice for small applications like this. Multiple spool directory support. A decoder for translating a Suricata JSON style event to a pcap filter (in additions…
After having fun with Suricata's new eve/json logging format and the Logstash/Elastic Search/Kibana combination (see this and this ), I wanted to get my Snort events into Elastic Search as well. Using my idstools python library I wrote u2json , a tool that will process a unified2 spool directory (much like barnyard) and convert the events to Suricata-style JSON. Usage is…
I recently consolidated my Python code bits for dealing with Snort and Suricata unified2 log files into a project called idstools . While I'll be adding more than just unified2 reading support, that is about it for now. While it can be installed with pip (pip install idstools), if you just want to play around with it I suggest cloning the repo (git clone…
Sometimes the best way to try out a new framework or language is to apply it to a domain you already know very well, even if it does happen to reinvent the wheel. Tornado and Twitter Bootstrap are two such frameworks I've been meaning to play with for a while now. The result is Dumpy , a web front-end to pcap spool files as created by tcpdump , daemonlogger , or netsniff-ng with a very simple…
As mentioned in my previous post on using embedded Jetty with SpringMVC , I was going to look at simplifying the application by using Thymeleaf instead of JSPs as a view technology. Well, it turns out that it is much more straightforward. First we can remove the JSPC plugin from our pom.xml. Second we can completely remove the web.xml file. Bootstrapping Jetty is much simpler now. We do not have…
As an accidental Java developer I've never been comfortable deploying applications into a container, especially when the web interface is secondary to the primary purpose of the application. Instead I prefer to programatically create and manage the web interface rather than have it manage me. Currently SpringMVC is my Java web framework of choice (due to company convention more than anything…
Note: These RPMs no longer exist. The GitHub repo remains for now: https://github.com/jasonish/nsm-rpms I've always maintained more or less up to date Snort RPMs for RHEL for personal use and have recently added Suricata. As they may be useful for others I have cleaned them up a little and made a YUM repository for EL6 i386 and x86_64. See the…
Just looked at my web stats for the first time in a long time and I see that one of the most requested resources are my libevent examples, which no longer exist here. The code however does still exist: https://github.com/jasonish/libevent-examples
Recent issues with Linux on a laptop has given me the desire to try working on a Mac again. Even though I have a pretty well supported laptop (Lenovo x61), its the little issues that have begun to bother me which include not great sleep/suspend support, wireless and audio issues and an almost never ending stream of updates. Yes, you Linux people may say it works fine, but if you've ever…
Probably the most lacking feature in most multi-screen setups is the ability to move a window from one screen to another with a keyboard shortcut. I do this to bring the window I'm currently working on into my centre monitor so its directly in front of me. There are 2 ways to go about this. The first is moving a window to a specific display and the second is to move (shift) the window to the…
Multi-monitor configurations are great but I think they leave out some usability aspects that could really make life easier for the keyboard user. When I was just using dual displays I really wanted keyboard shortcuts to do the following: * Move a window from one screen to the other. * Swap what is seen on each display. When I moved to 3 monitors my needs changed a little. * Shift a window to the…
Yes, covered everywhere and I've done it enough time I should know it off by heart now... I used to swap caps and control, but now I just make the caps an additional control and leave the original control as is... ~/.xmodmap snippet: remove Lock = Caps_Lock keysym Caps_Lock = Control_L add Control = Control_L
I plan to use this blog to post codebits that I find myself sending to people over and over again. The first example is how to use a TAILQ from sys/queue.h found on the BSDs. Many Linux distributions also have sys/queue.h but may be missing certain macros such as TAILQ_FOREACH(). At the very least I hope this enticies some newer C programmer to use queue.h rather than rolling their own…