Take a backup of your current configuration files:
cp -a /etc /root/etc.080515
Edita Suricata config to make it log to /var/log/suricata/suricata (without .log)
In the fast section, change "enabled" to "yes"
- fast:
append: yes
enabled: yes
filename: suricata
Stop some services like:
/etc/init.d/monit stop
/etc/init.d/suricata stop
Start Suricata with the following options:
/usr/bin/suricata -c /etc/suricata.yaml --pidfile /var/run/suricata.pid -v --af-packet=eth3
or
/usr/bin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid -v --pfring=eth3
Inject some pcap files triggering whatever rule you are interested on:
tcpreplay -t -i eth0 -l 500 myCapture.pcap
Create a dummy rule to see if basic icmp traffic is detected:
alert ip any any -> any any (msg:"ICMP detected"; sid:2; rev:1;)
http://www.linux.org/threads/suricata-the-snort-replacer-part-2-configure-test.4348/
http://www.linux.org/threads/suricata-the-snort-replacer-part-3-rules.4363/
To get the libpcap version:
tcpdump -h
If you find dropped packets, you can resize the capture buffer. Pass tcpdump the -B option with a KiB size.
tcpdump -B 4096
Other things you can check are kernel, driver and firmware versions:
uname -a
lspci -v
lsmod
ethtool eth3
modinfo ixgbe
Driver settings:
ethtool -i eth3
Network statistics:
ethtool -S eth3
Identify interface by switching on the led light:
ethtool -p eth3
Test interface:
ethtool -t eth3
Autonegotiation:
ethtool -a eth0
For dropped packets in ifconfig, you can check the negotiation with:
ethtool -s eth0 mdix [auto|on|off]
Produce an alert event
[[code]]
wget curlmyip.net
[[Ucode]]
https://home.regit.org/2012/07/suricata-to-10gbps-and-beyond/
http://christophe.vandeplas.com/2013/11/suricata-capturekerneldrops-caused-by.html
