API tools faq
paste
Guest User

Untitled

a guest
Jul 21st, 2023
48
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 72.55 KB | None | 0 0
raw download clone embed print report
  1. %YAML 1.1
  2. ---
  3.  
  4. # Suricata configuration file. In addition to the comments describing all
  5. # options in this file, full documentation can be found at:
  6. # https://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html
  7.  
  8. ##
  9. ## Step 1: Inform Suricata about your network
  10. ##
  11.  
  12. vars:
  13. # more specific is better for alert accuracy and performance
  14. address-groups:
  15. HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
  16. #HOME_NET: "[192.168.0.0/16]"
  17. #HOME_NET: "[10.0.0.0/8]"
  18. #HOME_NET: "[172.16.0.0/12]"
  19. #HOME_NET: "any"
  20.  
  21. EXTERNAL_NET: "!$HOME_NET"
  22. #EXTERNAL_NET: "any"
  23.  
  24. HTTP_SERVERS: "$HOME_NET"
  25. SMTP_SERVERS: "$HOME_NET"
  26. SQL_SERVERS: "$HOME_NET"
  27. DNS_SERVERS: "$HOME_NET"
  28. TELNET_SERVERS: "$HOME_NET"
  29. AIM_SERVERS: "$EXTERNAL_NET"
  30. DC_SERVERS: "$HOME_NET"
  31. DNP3_SERVER: "$HOME_NET"
  32. DNP3_CLIENT: "$HOME_NET"
  33. MODBUS_CLIENT: "$HOME_NET"
  34. MODBUS_SERVER: "$HOME_NET"
  35. ENIP_CLIENT: "$HOME_NET"
  36. ENIP_SERVER: "$HOME_NET"
  37.  
  38. port-groups:
  39. HTTP_PORTS: "80"
  40. SHELLCODE_PORTS: "!80"
  41. ORACLE_PORTS: 1521
  42. SSH_PORTS: 22
  43. DNP3_PORTS: 20000
  44. MODBUS_PORTS: 502
  45. FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
  46. FTP_PORTS: 21
  47. GENEVE_PORTS: 6081
  48. VXLAN_PORTS: 4789
  49. TEREDO_PORTS: 3544
  50.  
  51. ##
  52. ## Step 2: Select outputs to enable
  53. ##
  54.  
  55. # The default logging directory. Any log or output file will be
  56. # placed here if it's not specified with a full path name. This can be
  57. # overridden with the -l command line parameter.
  58. default-log-dir: /var/log/suricata/
  59.  
  60. # Global stats configuration
  61. stats:
  62. enabled: yes
  63. # The interval field (in seconds) controls the interval at
  64. # which stats are updated in the log.
  65. interval: 8
  66. # Add decode events to stats.
  67. #decoder-events: true
  68. # Decoder event prefix in stats. Has been 'decoder' before, but that leads
  69. # to missing events in the eve.stats records. See issue #2225.
  70. #decoder-events-prefix: "decoder.event"
  71. # Add stream events as stats.
  72. #stream-events: false
  73.  
  74. # Configure the type of alert (and other) logging you would like.
  75. outputs:
  76. # a line based alerts log similar to Snort's fast.log
  77. - fast:
  78. enabled: yes
  79. filename: fast.log
  80. append: yes
  81. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  82.  
  83. # Extensible Event Format (nicknamed EVE) event log in JSON format
  84. - eve-log:
  85. enabled: yes
  86. filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
  87. filename: eve.json
  88. # Enable for multi-threaded eve.json output; output files are amended with
  89. # with an identifier, e.g., eve.9.json
  90. #threaded: false
  91. #prefix: "@cee: " # prefix to prepend to each log entry
  92. # the following are valid when type: syslog above
  93. #identity: "suricata"
  94. #facility: local5
  95. #level: Info ## possible levels: Emergency, Alert, Critical,
  96. ## Error, Warning, Notice, Info, Debug
  97. #ethernet: no # log ethernet header in events when available
  98. #redis:
  99. # server: 127.0.0.1
  100. # port: 6379
  101. # async: true ## if redis replies are read asynchronously
  102. # mode: list ## possible values: list|lpush (default), rpush, channel|publish
  103. # ## lpush and rpush are using a Redis list. "list" is an alias for lpush
  104. # ## publish is using a Redis channel. "channel" is an alias for publish
  105. # key: suricata ## key or channel to use (default to suricata)
  106. # Redis pipelining set up. This will enable to only do a query every
  107. # 'batch-size' events. This should lower the latency induced by network
  108. # connection at the cost of some memory. There is no flushing implemented
  109. # so this setting should be reserved to high traffic Suricata deployments.
  110. # pipelining:
  111. # enabled: yes ## set enable to yes to enable query pipelining
  112. # batch-size: 10 ## number of entries to keep in buffer
  113.  
  114. # Include top level metadata. Default yes.
  115. #metadata: no
  116.  
  117. # include the name of the input pcap file in pcap file processing mode
  118. pcap-file: false
  119.  
  120. # Community Flow ID
  121. # Adds a 'community_id' field to EVE records. These are meant to give
  122. # records a predictable flow ID that can be used to match records to
  123. # output of other tools such as Zeek (Bro).
  124. #
  125. # Takes a 'seed' that needs to be same across sensors and tools
  126. # to make the id less predictable.
  127.  
  128. # enable/disable the community id feature.
  129. community-id: false
  130. # Seed value for the ID output. Valid values are 0-65535.
  131. community-id-seed: 0
  132.  
  133. # HTTP X-Forwarded-For support by adding an extra field or overwriting
  134. # the source or destination IP address (depending on flow direction)
  135. # with the one reported in the X-Forwarded-For HTTP header. This is
  136. # helpful when reviewing alerts for traffic that is being reverse
  137. # or forward proxied.
  138. xff:
  139. enabled: no
  140. # Two operation modes are available: "extra-data" and "overwrite".
  141. mode: extra-data
  142. # Two proxy deployments are supported: "reverse" and "forward". In
  143. # a "reverse" deployment the IP address used is the last one, in a
  144. # "forward" deployment the first IP address is used.
  145. deployment: reverse
  146. # Header name where the actual IP address will be reported. If more
  147. # than one IP address is present, the last IP address will be the
  148. # one taken into consideration.
  149. header: X-Forwarded-For
  150.  
  151. types:
  152. - alert:
  153. # payload: yes # enable dumping payload in Base64
  154. # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
  155. # payload-printable: yes # enable dumping payload in printable (lossy) format
  156. # packet: yes # enable dumping of packet (without stream segments)
  157. # metadata: no # enable inclusion of app layer metadata with alert. Default yes
  158. # http-body: yes # Requires metadata; enable dumping of HTTP body in Base64
  159. # http-body-printable: yes # Requires metadata; enable dumping of HTTP body in printable format
  160.  
  161. # Enable the logging of tagged packets for rules using the
  162. # "tag" keyword.
  163. tagged-packets: yes
  164. - anomaly:
  165. # Anomaly log records describe unexpected conditions such
  166. # as truncated packets, packets with invalid IP/UDP/TCP
  167. # length values, and other events that render the packet
  168. # invalid for further processing or describe unexpected
  169. # behavior on an established stream. Networks which
  170. # experience high occurrences of anomalies may experience
  171. # packet processing degradation.
  172. #
  173. # Anomalies are reported for the following:
  174. # 1. Decode: Values and conditions that are detected while
  175. # decoding individual packets. This includes invalid or
  176. # unexpected values for low-level protocol lengths as well
  177. # as stream related events (TCP 3-way handshake issues,
  178. # unexpected sequence number, etc).
  179. # 2. Stream: This includes stream related events (TCP
  180. # 3-way handshake issues, unexpected sequence number,
  181. # etc).
  182. # 3. Application layer: These denote application layer
  183. # specific conditions that are unexpected, invalid or are
  184. # unexpected given the application monitoring state.
  185. #
  186. # By default, anomaly logging is enabled. When anomaly
  187. # logging is enabled, applayer anomaly reporting is
  188. # also enabled.
  189. enabled: yes
  190. #
  191. # Choose one or more types of anomaly logging and whether to enable
  192. # logging of the packet header for packet anomalies.
  193. types:
  194. # decode: no
  195. # stream: no
  196. # applayer: yes
  197. #packethdr: no
  198. - http:
  199. extended: yes # enable this for extended logging information
  200. # custom allows additional HTTP fields to be included in eve-log.
  201. # the example below adds three additional fields when uncommented
  202. #custom: [Accept-Encoding, Accept-Language, Authorization]
  203. # set this value to one and only one from {both, request, response}
  204. # to dump all HTTP headers for every HTTP request and/or response
  205. # dump-all-headers: none
  206. - dns:
  207. # This configuration uses the new DNS logging format,
  208. # the old configuration is still available:
  209. # https://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#dns-v1-format
  210.  
  211. # As of Suricata 5.0, version 2 of the eve dns output
  212. # format is the default.
  213. #version: 2
  214.  
  215. # Enable/disable this logger. Default: enabled.
  216. #enabled: yes
  217.  
  218. # Control logging of requests and responses:
  219. # - requests: enable logging of DNS queries
  220. # - responses: enable logging of DNS answers
  221. # By default both requests and responses are logged.
  222. #requests: no
  223. #responses: no
  224.  
  225. # Format of answer logging:
  226. # - detailed: array item per answer
  227. # - grouped: answers aggregated by type
  228. # Default: all
  229. #formats: [detailed, grouped]
  230.  
  231. # DNS record types to log, based on the query type.
  232. # Default: all.
  233. #types: [a, aaaa, cname, mx, ns, ptr, txt]
  234. - tls:
  235. extended: yes # enable this for extended logging information
  236. # output TLS transaction where the session is resumed using a
  237. # session id
  238. #session-resumption: no
  239. # custom controls which TLS fields that are included in eve-log
  240. #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s]
  241. - files:
  242. force-magic: no # force logging magic on all logged files
  243. # force logging of checksums, available hash functions are md5,
  244. # sha1 and sha256
  245. #force-hash: [md5]
  246. #- drop:
  247. # alerts: yes # log alerts that caused drops
  248. # flows: all # start or all: 'start' logs only a single drop
  249. # # per flow direction. All logs each dropped pkt.
  250. - smtp:
  251. #extended: yes # enable this for extended logging information
  252. # this includes: bcc, message-id, subject, x_mailer, user-agent
  253. # custom fields logging from the list:
  254. # reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
  255. # x-originating-ip, in-reply-to, references, importance, priority,
  256. # sensitivity, organization, content-md5, date
  257. #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
  258. # output md5 of fields: body, subject
  259. # for the body you need to set app-layer.protocols.smtp.mime.body-md5
  260. # to yes
  261. #md5: [body, subject]
  262.  
  263. #- dnp3
  264. - ftp
  265. - rdp
  266. - nfs
  267. - smb
  268. - tftp
  269. - ikev2
  270. - dcerpc
  271. - krb5
  272. - snmp
  273. - rfb
  274. - sip
  275. - dhcp:
  276. enabled: yes
  277. # When extended mode is on, all DHCP messages are logged
  278. # with full detail. When extended mode is off (the
  279. # default), just enough information to map a MAC address
  280. # to an IP address is logged.
  281. extended: no
  282. - ssh
  283. - mqtt:
  284. # passwords: yes # enable output of passwords
  285. # HTTP2 logging. HTTP2 support is currently experimental and
  286. # disabled by default. To enable, uncomment the following line
  287. # and be sure to enable http2 in the app-layer section.
  288. #- http2
  289. - stats:
  290. totals: yes # stats for all threads merged together
  291. threads: no # per thread stats
  292. deltas: no # include delta values
  293. # bi-directional flows
  294. - flow
  295. # uni-directional flows
  296. #- netflow
  297.  
  298. # Metadata event type. Triggered whenever a pktvar is saved
  299. # and will include the pktvars, flowvars, flowbits and
  300. # flowints.
  301. #- metadata
  302.  
  303. # a line based log of HTTP requests (no alerts)
  304. - http-log:
  305. enabled: no
  306. filename: http.log
  307. append: yes
  308. #extended: yes # enable this for extended logging information
  309. #custom: yes # enable the custom logging format (defined by customformat)
  310. #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"
  311. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  312.  
  313. # a line based log of TLS handshake parameters (no alerts)
  314. - tls-log:
  315. enabled: no # Log TLS connections.
  316. filename: tls.log # File to store TLS logs.
  317. append: yes
  318. #extended: yes # Log extended information like fingerprint
  319. #custom: yes # enabled the custom logging format (defined by customformat)
  320. #customformat: "%{%D-%H:%M:%S}t.%z %a:%p -> %A:%P %v %n %d %D"
  321. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  322. # output TLS transaction where the session is resumed using a
  323. # session id
  324. #session-resumption: no
  325.  
  326. # output module to store certificates chain to disk
  327. - tls-store:
  328. enabled: no
  329. #certs-log-dir: certs # directory to store the certificates files
  330.  
  331. # Packet log... log packets in pcap format. 3 modes of operation: "normal"
  332. # "multi" and "sguil".
  333. #
  334. # In normal mode a pcap file "filename" is created in the default-log-dir,
  335. # or as specified by "dir".
  336. # In multi mode, a file is created per thread. This will perform much
  337. # better, but will create multiple files where 'normal' would create one.
  338. # In multi mode the filename takes a few special variables:
  339. # - %n -- thread number
  340. # - %i -- thread id
  341. # - %t -- timestamp (secs or secs.usecs based on 'ts-format'
  342. # E.g. filename: pcap.%n.%t
  343. #
  344. # Note that it's possible to use directories, but the directories are not
  345. # created by Suricata. E.g. filename: pcaps/%n/log.%s will log into the
  346. # per thread directory.
  347. #
  348. # Also note that the limit and max-files settings are enforced per thread.
  349. # So the size limit when using 8 threads with 1000mb files and 2000 files
  350. # is: 8*1000*2000 ~ 16TiB.
  351. #
  352. # In Sguil mode "dir" indicates the base directory. In this base dir the
  353. # pcaps are created in the directory structure Sguil expects:
  354. #
  355. # $sguil-base-dir/YYYY-MM-DD/$filename.<timestamp>
  356. #
  357. # By default all packets are logged except:
  358. # - TCP streams beyond stream.reassembly.depth
  359. # - encrypted streams after the key exchange
  360. #
  361. - pcap-log:
  362. enabled: no
  363. filename: log.pcap
  364.  
  365. # File size limit. Can be specified in kb, mb, gb. Just a number
  366. # is parsed as bytes.
  367. limit: 1000mb
  368.  
  369. # If set to a value, ring buffer mode is enabled. Will keep maximum of
  370. # "max-files" of size "limit"
  371. max-files: 2000
  372.  
  373. # Compression algorithm for pcap files. Possible values: none, lz4.
  374. # Enabling compression is incompatible with the sguil mode. Note also
  375. # that on Windows, enabling compression will *increase* disk I/O.
  376. compression: none
  377.  
  378. # Further options for lz4 compression. The compression level can be set
  379. # to a value between 0 and 16, where higher values result in higher
  380. # compression.
  381. #lz4-checksum: no
  382. #lz4-level: 0
  383.  
  384. mode: normal # normal, multi or sguil.
  385.  
  386. # Directory to place pcap files. If not provided the default log
  387. # directory will be used. Required for "sguil" mode.
  388. #dir: /nsm_data/
  389.  
  390. #ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
  391. use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
  392. honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stop being logged.
  393.  
  394. # a full alert log containing much information for signature writers
  395. # or for investigating suspected false positives.
  396. - alert-debug:
  397. enabled: no
  398. filename: alert-debug.log
  399. append: yes
  400. #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  401.  
  402. # alert output to prelude (https://www.prelude-siem.org/) only
  403. # available if Suricata has been compiled with --enable-prelude
  404. - alert-prelude:
  405. enabled: no
  406. profile: suricata
  407. log-packet-content: no
  408. log-packet-header: yes
  409.  
  410. # Stats.log contains data from various counters of the Suricata engine.
  411. - stats:
  412. enabled: yes
  413. filename: stats.log
  414. append: yes # append to file (yes) or overwrite it (no)
  415. totals: yes # stats for all threads merged together
  416. threads: no # per thread stats
  417. #null-values: yes # print counters that have value 0. Default: no
  418.  
  419. # a line based alerts log similar to fast.log into syslog
  420. - syslog:
  421. enabled: no
  422. # reported identity to syslog. If omitted the program name (usually
  423. # suricata) will be used.
  424. #identity: "suricata"
  425. facility: local5
  426. #level: Info ## possible levels: Emergency, Alert, Critical,
  427. ## Error, Warning, Notice, Info, Debug
  428.  
  429. # Output module for storing files on disk. Files are stored in
  430. # directory names consisting of the first 2 characters of the
  431. # SHA256 of the file. Each file is given its SHA256 as a filename.
  432. #
  433. # When a duplicate file is found, the timestamps on the existing file
  434. # are updated.
  435. #
  436. # Unlike the older filestore, metadata is not written by default
  437. # as each file should already have a "fileinfo" record in the
  438. # eve-log. If write-fileinfo is set to yes, then each file will have
  439. # one more associated .json files that consist of the fileinfo
  440. # record. A fileinfo file will be written for each occurrence of the
  441. # file seen using a filename suffix to ensure uniqueness.
  442. #
  443. # To prune the filestore directory see the "suricatactl filestore
  444. # prune" command which can delete files over a certain age.
  445. - file-store:
  446. version: 2
  447. enabled: no
  448.  
  449. # Set the directory for the filestore. Relative pathnames
  450. # are contained within the "default-log-dir".
  451. #dir: filestore
  452.  
  453. # Write out a fileinfo record for each occurrence of a file.
  454. # Disabled by default as each occurrence is already logged
  455. # as a fileinfo record to the main eve-log.
  456. #write-fileinfo: yes
  457.  
  458. # Force storing of all files. Default: no.
  459. #force-filestore: yes
  460.  
  461. # Override the global stream-depth for sessions in which we want
  462. # to perform file extraction. Set to 0 for unlimited; otherwise,
  463. # must be greater than the global stream-depth value to be used.
  464. #stream-depth: 0
  465.  
  466. # Uncomment the following variable to define how many files can
  467. # remain open for filestore by Suricata. Default value is 0 which
  468. # means files get closed after each write to the file.
  469. #max-open-files: 1000
  470.  
  471. # Force logging of checksums: available hash functions are md5,
  472. # sha1 and sha256. Note that SHA256 is automatically forced by
  473. # the use of this output module as it uses the SHA256 as the
  474. # file naming scheme.
  475. #force-hash: [sha1, md5]
  476. # NOTE: X-Forwarded configuration is ignored if write-fileinfo is disabled
  477. # HTTP X-Forwarded-For support by adding an extra field or overwriting
  478. # the source or destination IP address (depending on flow direction)
  479. # with the one reported in the X-Forwarded-For HTTP header. This is
  480. # helpful when reviewing alerts for traffic that is being reverse
  481. # or forward proxied.
  482. xff:
  483. enabled: no
  484. # Two operation modes are available, "extra-data" and "overwrite".
  485. mode: extra-data
  486. # Two proxy deployments are supported, "reverse" and "forward". In
  487. # a "reverse" deployment the IP address used is the last one, in a
  488. # "forward" deployment the first IP address is used.
  489. deployment: reverse
  490. # Header name where the actual IP address will be reported. If more
  491. # than one IP address is present, the last IP address will be the
  492. # one taken into consideration.
  493. header: X-Forwarded-For
  494.  
  495. # Log TCP data after stream normalization
  496. # Two types: file or dir:
  497. # - file logs into a single logfile.
  498. # - dir creates 2 files per TCP session and stores the raw TCP
  499. # data into them.
  500. # Use 'both' to enable both file and dir modes.
  501. #
  502. # Note: limited by "stream.reassembly.depth"
  503. - tcp-data:
  504. enabled: no
  505. type: file
  506. filename: tcp-data.log
  507.  
  508. # Log HTTP body data after normalization, de-chunking and unzipping.
  509. # Two types: file or dir.
  510. # - file logs into a single logfile.
  511. # - dir creates 2 files per HTTP session and stores the
  512. # normalized data into them.
  513. # Use 'both' to enable both file and dir modes.
  514. #
  515. # Note: limited by the body limit settings
  516. - http-body-data:
  517. enabled: no
  518. type: file
  519. filename: http-data.log
  520.  
  521. # Lua Output Support - execute lua script to generate alert and event
  522. # output.
  523. # Documented at:
  524. # https://suricata.readthedocs.io/en/latest/output/lua-output.html
  525. - lua:
  526. enabled: no
  527. #scripts-dir: /etc/suricata/lua-output/
  528. scripts:
  529. # - script1.lua
  530.  
  531. # Logging configuration. This is not about logging IDS alerts/events, but
  532. # output about what Suricata is doing, like startup messages, errors, etc.
  533. logging:
  534. # The default log level: can be overridden in an output section.
  535. # Note that debug level logging will only be emitted if Suricata was
  536. # compiled with the --enable-debug configure option.
  537. #
  538. # This value is overridden by the SC_LOG_LEVEL env var.
  539. default-log-level: notice
  540.  
  541. # The default output format. Optional parameter, should default to
  542. # something reasonable if not provided. Can be overridden in an
  543. # output section. You can leave this out to get the default.
  544. #
  545. # This value is overridden by the SC_LOG_FORMAT env var.
  546. #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- "
  547.  
  548. # A regex to filter output. Can be overridden in an output section.
  549. # Defaults to empty (no filter).
  550. #
  551. # This value is overridden by the SC_LOG_OP_FILTER env var.
  552. default-output-filter:
  553.  
  554. # Define your logging outputs. If none are defined, or they are all
  555. # disabled you will get the default: console output.
  556. outputs:
  557. - console:
  558. enabled: yes
  559. # type: json
  560. - file:
  561. enabled: yes
  562. level: info
  563. filename: suricata.log
  564. # type: json
  565. - syslog:
  566. enabled: no
  567. facility: local5
  568. format: "[%i] <%d> -- "
  569. # type: json
  570.  
  571.  
  572. ##
  573. ## Step 3: Configure common capture settings
  574. ##
  575. ## See "Advanced Capture Options" below for more options, including Netmap
  576. ## and PF_RING.
  577. ##
  578.  
  579. # Linux high speed capture support
  580. af-packet:
  581. - interface: vmbr0
  582. # Number of receive threads. "auto" uses the number of cores
  583. #threads: auto
  584. # Default clusterid. AF_PACKET will load balance packets based on flow.
  585. cluster-id: 99
  586. # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
  587. # This is only supported for Linux kernel > 3.1
  588. # possible value are:
  589. # * cluster_flow: all packets of a given flow are sent to the same socket
  590. # * cluster_cpu: all packets treated in kernel by a CPU are sent to the same socket
  591. # * cluster_qm: all packets linked by network card to a RSS queue are sent to the same
  592. # socket. Requires at least Linux 3.14.
  593. # * cluster_ebpf: eBPF file load balancing. See doc/userguide/capture-hardware/ebpf-xdp.rst for
  594. # more info.
  595. # Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
  596. # with capture card using RSS (requires cpu affinity tuning and system IRQ tuning)
  597. cluster-type: cluster_flow
  598. # In some fragmentation cases, the hash can not be computed. If "defrag" is set
  599. # to yes, the kernel will do the needed defragmentation before sending the packets.
  600. defrag: yes
  601. # To use the ring feature of AF_PACKET, set 'use-mmap' to yes
  602. #use-mmap: yes
  603. # Lock memory map to avoid it being swapped. Be careful that over
  604. # subscribing could lock your system
  605. #mmap-locked: yes
  606. # Use tpacket_v3 capture mode, only active if use-mmap is true
  607. # Don't use it in IPS or TAP mode as it causes severe latency
  608. #tpacket-v3: yes
  609. # Ring size will be computed with respect to "max-pending-packets" and number
  610. # of threads. You can set manually the ring size in number of packets by setting
  611. # the following value. If you are using flow "cluster-type" and have really network
  612. # intensive single-flow you may want to set the "ring-size" independently of the number
  613. # of threads:
  614. #ring-size: 2048
  615. # Block size is used by tpacket_v3 only. It should set to a value high enough to contain
  616. # a decent number of packets. Size is in bytes so please consider your MTU. It should be
  617. # a power of 2 and it must be multiple of page size (usually 4096).
  618. #block-size: 32768
  619. # tpacket_v3 block timeout: an open block is passed to userspace if it is not
  620. # filled after block-timeout milliseconds.
  621. #block-timeout: 10
  622. # On busy systems, set it to yes to help recover from a packet drop
  623. # phase. This will result in some packets (at max a ring flush) not being inspected.
  624. #use-emergency-flush: yes
  625. # recv buffer size, increased value could improve performance
  626. # buffer-size: 32768
  627. # Set to yes to disable promiscuous mode
  628. # disable-promisc: no
  629. # Choose checksum verification mode for the interface. At the moment
  630. # of the capture, some packets may have an invalid checksum due to
  631. # the checksum computation being offloaded to the network card.
  632. # Possible values are:
  633. # - kernel: use indication sent by kernel for each packet (default)
  634. # - yes: checksum validation is forced
  635. # - no: checksum validation is disabled
  636. # - auto: Suricata uses a statistical approach to detect when
  637. # checksum off-loading is used.
  638. # Warning: 'capture.checksum-validation' must be set to yes to have any validation
  639. #checksum-checks: kernel
  640. # BPF filter to apply to this interface. The pcap filter syntax applies here.
  641. #bpf-filter: port 80 or udp
  642. # You can use the following variables to activate AF_PACKET tap or IPS mode.
  643. # If copy-mode is set to ips or tap, the traffic coming to the current
  644. # interface will be copied to the copy-iface interface. If 'tap' is set, the
  645. # copy is complete. If 'ips' is set, the packet matching a 'drop' action
  646. # will not be copied.
  647. #copy-mode: ips
  648. #copy-iface: eth1
  649. # For eBPF and XDP setup including bypass, filter and load balancing, please
  650. # see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.
  651.  
  652. # Put default values here. These will be used for an interface that is not
  653. # in the list above.
  654. - interface: default
  655. #threads: auto
  656. #use-mmap: no
  657. #tpacket-v3: yes
  658.  
  659. # Cross platform libpcap capture support
  660. pcap:
  661. - interface: eth0
  662. # On Linux, pcap will try to use mmap'ed capture and will use "buffer-size"
  663. # as total memory used by the ring. So set this to something bigger
  664. # than 1% of your bandwidth.
  665. #buffer-size: 16777216
  666. #bpf-filter: "tcp and port 25"
  667. # Choose checksum verification mode for the interface. At the moment
  668. # of the capture, some packets may have an invalid checksum due to
  669. # the checksum computation being offloaded to the network card.
  670. # Possible values are:
  671. # - yes: checksum validation is forced
  672. # - no: checksum validation is disabled
  673. # - auto: Suricata uses a statistical approach to detect when
  674. # checksum off-loading is used. (default)
  675. # Warning: 'capture.checksum-validation' must be set to yes to have any validation
  676. #checksum-checks: auto
  677. # With some accelerator cards using a modified libpcap (like Myricom), you
  678. # may want to have the same number of capture threads as the number of capture
  679. # rings. In this case, set up the threads variable to N to start N threads
  680. # listening on the same interface.
  681. #threads: 16
  682. # set to no to disable promiscuous mode:
  683. #promisc: no
  684. # set snaplen, if not set it defaults to MTU if MTU can be known
  685. # via ioctl call and to full capture if not.
  686. #snaplen: 1518
  687. # Put default values here
  688. - interface: default
  689. #checksum-checks: auto
  690.  
  691. # Settings for reading pcap files
  692. pcap-file:
  693. # Possible values are:
  694. # - yes: checksum validation is forced
  695. # - no: checksum validation is disabled
  696. # - auto: Suricata uses a statistical approach to detect when
  697. # checksum off-loading is used. (default)
  698. # Warning: 'checksum-validation' must be set to yes to have checksum tested
  699. checksum-checks: auto
  700.  
  701. # See "Advanced Capture Options" below for more options, including Netmap
  702. # and PF_RING.
  703.  
  704.  
  705. ##
  706. ## Step 4: App Layer Protocol configuration
  707. ##
  708.  
  709. # Configure the app-layer parsers. The protocol's section details each
  710. # protocol.
  711. #
  712. # The option "enabled" takes 3 values - "yes", "no", "detection-only".
  713. # "yes" enables both detection and the parser, "no" disables both, and
  714. # "detection-only" enables protocol detection only (parser disabled).
  715. app-layer:
  716. protocols:
  717. rfb:
  718. enabled: yes
  719. detection-ports:
  720. dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
  721. # MQTT, disabled by default.
  722. mqtt:
  723. # enabled: no
  724. # max-msg-length: 1mb
  725. krb5:
  726. enabled: yes
  727. snmp:
  728. enabled: yes
  729. ikev2:
  730. enabled: yes
  731. tls:
  732. enabled: yes
  733. detection-ports:
  734. dp: 443
  735.  
  736. # Generate JA3 fingerprint from client hello. If not specified it
  737. # will be disabled by default, but enabled if rules require it.
  738. #ja3-fingerprints: auto
  739.  
  740. # What to do when the encrypted communications start:
  741. # - default: keep tracking TLS session, check for protocol anomalies,
  742. # inspect tls_* keywords. Disables inspection of unmodified
  743. # 'content' signatures.
  744. # - bypass: stop processing this flow as much as possible. No further
  745. # TLS parsing and inspection. Offload flow bypass to kernel
  746. # or hardware if possible.
  747. # - full: keep tracking and inspection as normal. Unmodified content
  748. # keyword signatures are inspected as well.
  749. #
  750. # For best performance, select 'bypass'.
  751. #
  752. #encryption-handling: default
  753.  
  754. dcerpc:
  755. enabled: yes
  756. ftp:
  757. enabled: yes
  758. # memcap: 64mb
  759. rdp:
  760. #enabled: yes
  761. ssh:
  762. enabled: yes
  763. #hassh: yes
  764. # HTTP2: Experimental HTTP 2 support. Disabled by default.
  765. http2:
  766. enabled: no
  767. smtp:
  768. enabled: yes
  769. raw-extraction: no
  770. # Configure SMTP-MIME Decoder
  771. mime:
  772. # Decode MIME messages from SMTP transactions
  773. # (may be resource intensive)
  774. # This field supersedes all others because it turns the entire
  775. # process on or off
  776. decode-mime: yes
  777.  
  778. # Decode MIME entity bodies (ie. Base64, quoted-printable, etc.)
  779. decode-base64: yes
  780. decode-quoted-printable: yes
  781.  
  782. # Maximum bytes per header data value stored in the data structure
  783. # (default is 2000)
  784. header-value-depth: 2000
  785.  
  786. # Extract URLs and save in state data structure
  787. extract-urls: yes
  788. # Set to yes to compute the md5 of the mail body. You will then
  789. # be able to journalize it.
  790. body-md5: no
  791. # Configure inspected-tracker for file_data keyword
  792. inspected-tracker:
  793. content-limit: 100000
  794. content-inspect-min-size: 32768
  795. content-inspect-window: 4096
  796. imap:
  797. enabled: detection-only
  798. smb:
  799. enabled: yes
  800. detection-ports:
  801. dp: 139, 445
  802.  
  803. # Stream reassembly size for SMB streams. By default track it completely.
  804. #stream-depth: 0
  805.  
  806. nfs:
  807. enabled: yes
  808. tftp:
  809. enabled: yes
  810. dns:
  811. tcp:
  812. enabled: yes
  813. detection-ports:
  814. dp: 53
  815. udp:
  816. enabled: yes
  817. detection-ports:
  818. dp: 53
  819. http:
  820. enabled: yes
  821. # memcap: Maximum memory capacity for HTTP
  822. # Default is unlimited, values can be 64mb, e.g.
  823.  
  824. # default-config: Used when no server-config matches
  825. # personality: List of personalities used by default
  826. # request-body-limit: Limit reassembly of request body for inspection
  827. # by http_client_body & pcre /P option.
  828. # response-body-limit: Limit reassembly of response body for inspection
  829. # by file_data, http_server_body & pcre /Q option.
  830. #
  831. # For advanced options, see the user guide
  832.  
  833.  
  834. # server-config: List of server configurations to use if address matches
  835. # address: List of IP addresses or networks for this block
  836. # personality: List of personalities used by this block
  837. #
  838. # Then, all the fields from default-config can be overloaded
  839. #
  840. # Currently Available Personalities:
  841. # Minimal, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0,
  842. # IIS_7_0, IIS_7_5, Apache_2
  843. libhtp:
  844. default-config:
  845. personality: IDS
  846.  
  847. # Can be specified in kb, mb, gb. Just a number indicates
  848. # it's in bytes.
  849. request-body-limit: 100kb
  850. response-body-limit: 100kb
  851.  
  852. # inspection limits
  853. request-body-minimal-inspect-size: 32kb
  854. request-body-inspect-window: 4kb
  855. response-body-minimal-inspect-size: 40kb
  856. response-body-inspect-window: 16kb
  857.  
  858. # response body decompression (0 disables)
  859. response-body-decompress-layer-limit: 2
  860.  
  861. # auto will use http-body-inline mode in IPS mode, yes or no set it statically
  862. http-body-inline: auto
  863.  
  864. # Decompress SWF files.
  865. # Two types: 'deflate', 'lzma', 'both' will decompress deflate and lzma
  866. # compress-depth:
  867. # Specifies the maximum amount of data to decompress,
  868. # set 0 for unlimited.
  869. # decompress-depth:
  870. # Specifies the maximum amount of decompressed data to obtain,
  871. # set 0 for unlimited.
  872. swf-decompression:
  873. enabled: yes
  874. type: both
  875. compress-depth: 0
  876. decompress-depth: 0
  877.  
  878. # Use a random value for inspection sizes around the specified value.
  879. # This lowers the risk of some evasion techniques but could lead
  880. # to detection change between runs. It is set to 'yes' by default.
  881. #randomize-inspection-sizes: yes
  882. # If "randomize-inspection-sizes" is active, the value of various
  883. # inspection size will be chosen from the [1 - range%, 1 + range%]
  884. # range
  885. # Default value of "randomize-inspection-range" is 10.
  886. #randomize-inspection-range: 10
  887.  
  888. # decoding
  889. double-decode-path: no
  890. double-decode-query: no
  891.  
  892. # Can enable LZMA decompression
  893. #lzma-enabled: false
  894. # Memory limit usage for LZMA decompression dictionary
  895. # Data is decompressed until dictionary reaches this size
  896. #lzma-memlimit: 1mb
  897. # Maximum decompressed size with a compression ratio
  898. # above 2048 (only LZMA can reach this ratio, deflate cannot)
  899. #compression-bomb-limit: 1mb
  900.  
  901. server-config:
  902.  
  903. #- apache:
  904. # address: [192.168.1.0/24, 127.0.0.0/8, "::1"]
  905. # personality: Apache_2
  906. # # Can be specified in kb, mb, gb. Just a number indicates
  907. # # it's in bytes.
  908. # request-body-limit: 4096
  909. # response-body-limit: 4096
  910. # double-decode-path: no
  911. # double-decode-query: no
  912.  
  913. #- iis7:
  914. # address:
  915. # - 192.168.0.0/24
  916. # - 192.168.10.0/24
  917. # personality: IIS_7_0
  918. # # Can be specified in kb, mb, gb. Just a number indicates
  919. # # it's in bytes.
  920. # request-body-limit: 4096
  921. # response-body-limit: 4096
  922. # double-decode-path: no
  923. # double-decode-query: no
  924.  
  925. # Note: Modbus probe parser is minimalist due to the limited usage in the field.
  926. # Only Modbus message length (greater than Modbus header length)
  927. # and protocol ID (equal to 0) are checked in probing parser
  928. # It is important to enable detection port and define Modbus port
  929. # to avoid false positives
  930. modbus:
  931. # How many unanswered Modbus requests are considered a flood.
  932. # If the limit is reached, the app-layer-event:modbus.flooded; will match.
  933. #request-flood: 500
  934.  
  935. enabled: no
  936. detection-ports:
  937. dp: 502
  938. # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it
  939. # is recommended to keep the TCP connection opened with a remote device
  940. # and not to open and close it for each MODBUS/TCP transaction. In that
  941. # case, it is important to set the depth of the stream reassembling as
  942. # unlimited (stream.reassembly.depth: 0)
  943.  
  944. # Stream reassembly size for modbus. By default track it completely.
  945. stream-depth: 0
  946.  
  947. # DNP3
  948. dnp3:
  949. enabled: no
  950. detection-ports:
  951. dp: 20000
  952.  
  953. # SCADA EtherNet/IP and CIP protocol support
  954. enip:
  955. enabled: no
  956. detection-ports:
  957. dp: 44818
  958. sp: 44818
  959.  
  960. ntp:
  961. enabled: yes
  962.  
  963. dhcp:
  964. enabled: yes
  965.  
  966. sip:
  967. #enabled: no
  968.  
  969. # Limit for the maximum number of asn1 frames to decode (default 256)
  970. asn1-max-frames: 256
  971.  
  972. # Datasets default settings
  973. # datasets:
  974. # # Default fallback memcap and hashsize values for datasets in case these
  975. # # were not explicitly defined.
  976. # defaults:
  977. # memcap: 100mb
  978. # hashsize: 2048
  979.  
  980. ##############################################################################
  981. ##
  982. ## Advanced settings below
  983. ##
  984. ##############################################################################
  985.  
  986. ##
  987. ## Run Options
  988. ##
  989.  
  990. # Run Suricata with a specific user-id and group-id:
  991. #run-as:
  992. # user: suri
  993. # group: suri
  994.  
  995. # Some logging modules will use that name in event as identifier. The default
  996. # value is the hostname
  997. #sensor-name: suricata
  998.  
  999. # Default location of the pid file. The pid file is only used in
  1000. # daemon mode (start Suricata with -D). If not running in daemon mode
  1001. # the --pidfile command line option must be used to create a pid file.
  1002. #pid-file: /var/run/suricata.pid
  1003.  
  1004. # Daemon working directory
  1005. # Suricata will change directory to this one if provided
  1006. # Default: "/"
  1007. #daemon-directory: "/"
  1008.  
  1009. # Umask.
  1010. # Suricata will use this umask if it is provided. By default it will use the
  1011. # umask passed on by the shell.
  1012. #umask: 022
  1013.  
  1014. # Suricata core dump configuration. Limits the size of the core dump file to
  1015. # approximately max-dump. The actual core dump size will be a multiple of the
  1016. # page size. Core dumps that would be larger than max-dump are truncated. On
  1017. # Linux, the actual core dump size may be a few pages larger than max-dump.
  1018. # Setting max-dump to 0 disables core dumping.
  1019. # Setting max-dump to 'unlimited' will give the full core dump file.
  1020. # On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size
  1021. # to be 'unlimited'.
  1022.  
  1023. coredump:
  1024. max-dump: unlimited
  1025.  
  1026. # If the Suricata box is a router for the sniffed networks, set it to 'router'. If
  1027. # it is a pure sniffing setup, set it to 'sniffer-only'.
  1028. # If set to auto, the variable is internally switched to 'router' in IPS mode
  1029. # and 'sniffer-only' in IDS mode.
  1030. # This feature is currently only used by the reject* keywords.
  1031. host-mode: auto
  1032.  
  1033. # Number of packets preallocated per thread. The default is 1024. A higher number
  1034. # will make sure each CPU will be more easily kept busy, but may negatively
  1035. # impact caching.
  1036. #max-pending-packets: 1024
  1037.  
  1038. # Runmode the engine should use. Please check --list-runmodes to get the available
  1039. # runmodes for each packet acquisition method. Default depends on selected capture
  1040. # method. 'workers' generally gives best performance.
  1041. #runmode: autofp
  1042.  
  1043. # Specifies the kind of flow load balancer used by the flow pinned autofp mode.
  1044. #
  1045. # Supported schedulers are:
  1046. #
  1047. # hash - Flow assigned to threads using the 5-7 tuple hash.
  1048. # ippair - Flow assigned to threads using addresses only.
  1049. #
  1050. #autofp-scheduler: hash
  1051.  
  1052. # Preallocated size for each packet. Default is 1514 which is the classical
  1053. # size for pcap on Ethernet. You should adjust this value to the highest
  1054. # packet size (MTU + hardware header) on your system.
  1055. #default-packet-size: 1514
  1056.  
  1057. # Unix command socket that can be used to pass commands to Suricata.
  1058. # An external tool can then connect to get information from Suricata
  1059. # or trigger some modifications of the engine. Set enabled to yes
  1060. # to activate the feature. In auto mode, the feature will only be
  1061. # activated in live capture mode. You can use the filename variable to set
  1062. # the file name of the socket.
  1063. unix-command:
  1064. enabled: yes
  1065. filename: /var/run/suricata-command.socket
  1066.  
  1067. # Magic file. The extension .mgc is added to the value here.
  1068. #magic-file: /usr/share/file/magic
  1069. #magic-file:
  1070.  
  1071. # GeoIP2 database file. Specify path and filename of GeoIP2 database
  1072. # if using rules with "geoip" rule option.
  1073. #geoip-database: /usr/local/share/GeoLite2/GeoLite2-Country.mmdb
  1074.  
  1075. legacy:
  1076. uricontent: enabled
  1077.  
  1078. ##
  1079. ## Detection settings
  1080. ##
  1081.  
  1082. # Set the order of alerts based on actions
  1083. # The default order is pass, drop, reject, alert
  1084. # action-order:
  1085. # - pass
  1086. # - drop
  1087. # - reject
  1088. # - alert
  1089.  
  1090. # IP Reputation
  1091. #reputation-categories-file: /etc/suricata/iprep/categories.txt
  1092. #default-reputation-path: /etc/suricata/iprep
  1093. #reputation-files:
  1094. # - reputation.list
  1095.  
  1096. # When run with the option --engine-analysis, the engine will read each of
  1097. # the parameters below, and print reports for each of the enabled sections
  1098. # and exit. The reports are printed to a file in the default log dir
  1099. # given by the parameter "default-log-dir", with engine reporting
  1100. # subsection below printing reports in its own report file.
  1101. engine-analysis:
  1102. # enables printing reports for fast-pattern for every rule.
  1103. rules-fast-pattern: yes
  1104. # enables printing reports for each rule
  1105. rules: yes
  1106.  
  1107. #recursion and match limits for PCRE where supported
  1108. pcre:
  1109. match-limit: 3500
  1110. match-limit-recursion: 1500
  1111.  
  1112. ##
  1113. ## Advanced Traffic Tracking and Reconstruction Settings
  1114. ##
  1115.  
  1116. # Host specific policies for defragmentation and TCP stream
  1117. # reassembly. The host OS lookup is done using a radix tree, just
  1118. # like a routing table so the most specific entry matches.
  1119. host-os-policy:
  1120. # Make the default policy windows.
  1121. windows: [0.0.0.0/0]
  1122. bsd: []
  1123. bsd-right: []
  1124. old-linux: []
  1125. linux: []
  1126. old-solaris: []
  1127. solaris: []
  1128. hpux10: []
  1129. hpux11: []
  1130. irix: []
  1131. macos: []
  1132. vista: []
  1133. windows2k3: []
  1134.  
  1135. # Defrag settings:
  1136.  
  1137. defrag:
  1138. memcap: 32mb
  1139. hash-size: 65536
  1140. trackers: 65535 # number of defragmented flows to follow
  1141. max-frags: 65535 # number of fragments to keep (higher than trackers)
  1142. prealloc: yes
  1143. timeout: 60
  1144.  
  1145. # Enable defrag per host settings
  1146. # host-config:
  1147. #
  1148. # - dmz:
  1149. # timeout: 30
  1150. # address: [192.168.1.0/24, 127.0.0.0/8, 1.1.1.0/24, 2.2.2.0/24, "1.1.1.1", "2.2.2.2", "::1"]
  1151. #
  1152. # - lan:
  1153. # timeout: 45
  1154. # address:
  1155. # - 192.168.0.0/24
  1156. # - 192.168.10.0/24
  1157. # - 172.16.14.0/24
  1158.  
  1159. # Flow settings:
  1160. # By default, the reserved memory (memcap) for flows is 32MB. This is the limit
  1161. # for flow allocation inside the engine. You can change this value to allow
  1162. # more memory usage for flows.
  1163. # The hash-size determines the size of the hash used to identify flows inside
  1164. # the engine, and by default the value is 65536.
  1165. # At startup, the engine can preallocate a number of flows, to get better
  1166. # performance. The number of flows preallocated is 10000 by default.
  1167. # emergency-recovery is the percentage of flows that the engine needs to
  1168. # prune before clearing the emergency state. The emergency state is activated
  1169. # when the memcap limit is reached, allowing new flows to be created, but
  1170. # pruning them with the emergency timeouts (they are defined below).
  1171. # If the memcap is reached, the engine will try to prune flows
  1172. # with the default timeouts. If it doesn't find a flow to prune, it will set
  1173. # the emergency bit and it will try again with more aggressive timeouts.
  1174. # If that doesn't work, then it will try to kill the oldest flows using
  1175. # last time seen flows.
  1176. # The memcap can be specified in kb, mb, gb. Just a number indicates it's
  1177. # in bytes.
  1178.  
  1179. flow:
  1180. memcap: 128mb
  1181. hash-size: 65536
  1182. prealloc: 10000
  1183. emergency-recovery: 30
  1184. #managers: 1 # default to one flow manager
  1185. #recyclers: 1 # default to one flow recycler thread
  1186.  
  1187. # This option controls the use of VLAN ids in the flow (and defrag)
  1188. # hashing. Normally this should be enabled, but in some (broken)
  1189. # setups where both sides of a flow are not tagged with the same VLAN
  1190. # tag, we can ignore the VLAN id's in the flow hashing.
  1191. vlan:
  1192. use-for-tracking: true
  1193.  
  1194. # Specific timeouts for flows. Here you can specify the timeouts that the
  1195. # active flows will wait to transit from the current state to another, on each
  1196. # protocol. The value of "new" determines the seconds to wait after a handshake or
  1197. # stream startup before the engine frees the data of that flow it doesn't
  1198. # change the state to established (usually if we don't receive more packets
  1199. # of that flow). The value of "established" is the amount of
  1200. # seconds that the engine will wait to free the flow if that time elapses
  1201. # without receiving new packets or closing the connection. "closed" is the
  1202. # amount of time to wait after a flow is closed (usually zero). "bypassed"
  1203. # timeout controls locally bypassed flows. For these flows we don't do any other
  1204. # tracking. If no packets have been seen after this timeout, the flow is discarded.
  1205. #
  1206. # There's an emergency mode that will become active under attack circumstances,
  1207. # making the engine to check flow status faster. This configuration variables
  1208. # use the prefix "emergency-" and work similar as the normal ones.
  1209. # Some timeouts doesn't apply to all the protocols, like "closed", for udp and
  1210. # icmp.
  1211.  
  1212. flow-timeouts:
  1213.  
  1214. default:
  1215. new: 30
  1216. established: 300
  1217. closed: 0
  1218. bypassed: 100
  1219. emergency-new: 10
  1220. emergency-established: 100
  1221. emergency-closed: 0
  1222. emergency-bypassed: 50
  1223. tcp:
  1224. new: 60
  1225. established: 600
  1226. closed: 60
  1227. bypassed: 100
  1228. emergency-new: 5
  1229. emergency-established: 100
  1230. emergency-closed: 10
  1231. emergency-bypassed: 50
  1232. udp:
  1233. new: 30
  1234. established: 300
  1235. bypassed: 100
  1236. emergency-new: 10
  1237. emergency-established: 100
  1238. emergency-bypassed: 50
  1239. icmp:
  1240. new: 30
  1241. established: 300
  1242. bypassed: 100
  1243. emergency-new: 10
  1244. emergency-established: 100
  1245. emergency-bypassed: 50
  1246.  
  1247. # Stream engine settings. Here the TCP stream tracking and reassembly
  1248. # engine is configured.
  1249. #
  1250. # stream:
  1251. # memcap: 32mb # Can be specified in kb, mb, gb. Just a
  1252. # # number indicates it's in bytes.
  1253. # checksum-validation: yes # To validate the checksum of received
  1254. # # packet. If csum validation is specified as
  1255. # # "yes", then packets with invalid csum values will not
  1256. # # be processed by the engine stream/app layer.
  1257. # # Warning: locally generated traffic can be
  1258. # # generated without checksum due to hardware offload
  1259. # # of checksum. You can control the handling of checksum
  1260. # # on a per-interface basis via the 'checksum-checks'
  1261. # # option
  1262. # prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread
  1263. # midstream: false # don't allow midstream session pickups
  1264. # async-oneside: false # don't enable async stream handling
  1265. # inline: no # stream inline mode
  1266. # drop-invalid: yes # in inline mode, drop packets that are invalid with regards to streaming engine
  1267. # max-synack-queued: 5 # Max different SYN/ACKs to queue
  1268. # bypass: no # Bypass packets when stream.reassembly.depth is reached.
  1269. # # Warning: first side to reach this triggers
  1270. # # the bypass.
  1271. #
  1272. # reassembly:
  1273. # memcap: 64mb # Can be specified in kb, mb, gb. Just a number
  1274. # # indicates it's in bytes.
  1275. # depth: 1mb # Can be specified in kb, mb, gb. Just a number
  1276. # # indicates it's in bytes.
  1277. # toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
  1278. # # this size. Can be specified in kb, mb,
  1279. # # gb. Just a number indicates it's in bytes.
  1280. # toclient-chunk-size: 2560 # inspect raw stream in chunks of at least
  1281. # # this size. Can be specified in kb, mb,
  1282. # # gb. Just a number indicates it's in bytes.
  1283. # randomize-chunk-size: yes # Take a random value for chunk size around the specified value.
  1284. # # This lowers the risk of some evasion techniques but could lead
  1285. # # to detection change between runs. It is set to 'yes' by default.
  1286. # randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is
  1287. # # a random value between (1 - randomize-chunk-range/100)*toserver-chunk-size
  1288. # # and (1 + randomize-chunk-range/100)*toserver-chunk-size and the same
  1289. # # calculation for toclient-chunk-size.
  1290. # # Default value of randomize-chunk-range is 10.
  1291. #
  1292. # raw: yes # 'Raw' reassembly enabled or disabled.
  1293. # # raw is for content inspection by detection
  1294. # # engine.
  1295. #
  1296. # segment-prealloc: 2048 # number of segments preallocated per thread
  1297. #
  1298. # check-overlap-different-data: true|false
  1299. # # check if a segment contains different data
  1300. # # than what we've already seen for that
  1301. # # position in the stream.
  1302. # # This is enabled automatically if inline mode
  1303. # # is used or when stream-event:reassembly_overlap_different_data;
  1304. # # is used in a rule.
  1305. #
  1306. stream:
  1307. memcap: 64mb
  1308. checksum-validation: yes # reject incorrect csums
  1309. inline: auto # auto will use inline mode in IPS mode, yes or no set it statically
  1310. reassembly:
  1311. memcap: 256mb
  1312. depth: 1mb # reassemble 1mb into a stream
  1313. toserver-chunk-size: 2560
  1314. toclient-chunk-size: 2560
  1315. randomize-chunk-size: yes
  1316. #randomize-chunk-range: 10
  1317. #raw: yes
  1318. #segment-prealloc: 2048
  1319. #check-overlap-different-data: true
  1320.  
  1321. # Host table:
  1322. #
  1323. # Host table is used by the tagging and per host thresholding subsystems.
  1324. #
  1325. host:
  1326. hash-size: 4096
  1327. prealloc: 1000
  1328. memcap: 32mb
  1329.  
  1330. # IP Pair table:
  1331. #
  1332. # Used by xbits 'ippair' tracking.
  1333. #
  1334. #ippair:
  1335. # hash-size: 4096
  1336. # prealloc: 1000
  1337. # memcap: 32mb
  1338.  
  1339. # Decoder settings
  1340.  
  1341. decoder:
  1342. # Teredo decoder is known to not be completely accurate
  1343. # as it will sometimes detect non-teredo as teredo.
  1344. teredo:
  1345. enabled: true
  1346. # ports to look for Teredo. Max 4 ports. If no ports are given, or
  1347. # the value is set to 'any', Teredo detection runs on _all_ UDP packets.
  1348. ports: $TEREDO_PORTS # syntax: '[3544, 1234]' or '3533' or 'any'.
  1349.  
  1350. # VXLAN decoder is assigned to up to 4 UDP ports. By default only the
  1351. # IANA assigned port 4789 is enabled.
  1352. vxlan:
  1353. enabled: true
  1354. ports: $VXLAN_PORTS # syntax: '[8472, 4789]' or '4789'.
  1355.  
  1356. # Geneve decoder is assigned to up to 4 UDP ports. By default only the
  1357. # IANA assigned port 6081 is enabled.
  1358. geneve:
  1359. enabled: true
  1360. ports: $GENEVE_PORTS # syntax: '[6081, 1234]' or '6081'.
  1361.  
  1362. ##
  1363. ## Performance tuning and profiling
  1364. ##
  1365.  
  1366. # The detection engine builds internal groups of signatures. The engine
  1367. # allows us to specify the profile to use for them, to manage memory in an
  1368. # efficient way keeping good performance. For the profile keyword you
  1369. # can use the words "low", "medium", "high" or "custom". If you use custom,
  1370. # make sure to define the values in the "custom-values" section.
  1371. # Usually you would prefer medium/high/low.
  1372. #
  1373. # "sgh mpm-context", indicates how the staging should allot mpm contexts for
  1374. # the signature groups. "single" indicates the use of a single context for
  1375. # all the signature group heads. "full" indicates a mpm-context for each
  1376. # group head. "auto" lets the engine decide the distribution of contexts
  1377. # based on the information the engine gathers on the patterns from each
  1378. # group head.
  1379. #
  1380. # The option inspection-recursion-limit is used to limit the recursive calls
  1381. # in the content inspection code. For certain payload-sig combinations, we
  1382. # might end up taking too much time in the content inspection code.
  1383. # If the argument specified is 0, the engine uses an internally defined
  1384. # default limit. When a value is not specified, there are no limits on the recursion.
  1385. detect:
  1386. profile: medium
  1387. custom-values:
  1388. toclient-groups: 3
  1389. toserver-groups: 25
  1390. sgh-mpm-context: auto
  1391. inspection-recursion-limit: 3000
  1392. # If set to yes, the loading of signatures will be made after the capture
  1393. # is started. This will limit the downtime in IPS mode.
  1394. #delayed-detect: yes
  1395.  
  1396. prefilter:
  1397. # default prefiltering setting. "mpm" only creates MPM/fast_pattern
  1398. # engines. "auto" also sets up prefilter engines for other keywords.
  1399. # Use --list-keywords=all to see which keywords support prefiltering.
  1400. default: mpm
  1401.  
  1402. # the grouping values above control how many groups are created per
  1403. # direction. Port whitelisting forces that port to get its own group.
  1404. # Very common ports will benefit, as well as ports with many expensive
  1405. # rules.
  1406. grouping:
  1407. #tcp-whitelist: 53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080
  1408. #udp-whitelist: 53, 135, 5060
  1409.  
  1410. profiling:
  1411. # Log the rules that made it past the prefilter stage, per packet
  1412. # default is off. The threshold setting determines how many rules
  1413. # must have made it past pre-filter for that rule to trigger the
  1414. # logging.
  1415. #inspect-logging-threshold: 200
  1416. grouping:
  1417. dump-to-disk: false
  1418. include-rules: false # very verbose
  1419. include-mpm-stats: false
  1420.  
  1421. # Select the multi pattern algorithm you want to run for scan/search the
  1422. # in the engine.
  1423. #
  1424. # The supported algorithms are:
  1425. # "ac" - Aho-Corasick, default implementation
  1426. # "ac-bs" - Aho-Corasick, reduced memory implementation
  1427. # "ac-ks" - Aho-Corasick, "Ken Steele" variant
  1428. # "hs" - Hyperscan, available when built with Hyperscan support
  1429. #
  1430. # The default mpm-algo value of "auto" will use "hs" if Hyperscan is
  1431. # available, "ac" otherwise.
  1432. #
  1433. # The mpm you choose also decides the distribution of mpm contexts for
  1434. # signature groups, specified by the conf - "detect.sgh-mpm-context".
  1435. # Selecting "ac" as the mpm would require "detect.sgh-mpm-context"
  1436. # to be set to "single", because of ac's memory requirements, unless the
  1437. # ruleset is small enough to fit in memory, in which case one can
  1438. # use "full" with "ac". The rest of the mpms can be run in "full" mode.
  1439.  
  1440. mpm-algo: auto
  1441.  
  1442. # Select the matching algorithm you want to use for single-pattern searches.
  1443. #
  1444. # Supported algorithms are "bm" (Boyer-Moore) and "hs" (Hyperscan, only
  1445. # available if Suricata has been built with Hyperscan support).
  1446. #
  1447. # The default of "auto" will use "hs" if available, otherwise "bm".
  1448.  
  1449. spm-algo: auto
  1450.  
  1451. # Suricata is multi-threaded. Here the threading can be influenced.
  1452. threading:
  1453. set-cpu-affinity: no
  1454. # Tune cpu affinity of threads. Each family of threads can be bound
  1455. # to specific CPUs.
  1456. #
  1457. # These 2 apply to the all runmodes:
  1458. # management-cpu-set is used for flow timeout handling, counters
  1459. # worker-cpu-set is used for 'worker' threads
  1460. #
  1461. # Additionally, for autofp these apply:
  1462. # receive-cpu-set is used for capture threads
  1463. # verdict-cpu-set is used for IPS verdict threads
  1464. #
  1465. cpu-affinity:
  1466. - management-cpu-set:
  1467. cpu: [ 0 ] # include only these CPUs in affinity settings
  1468. - receive-cpu-set:
  1469. cpu: [ 0 ] # include only these CPUs in affinity settings
  1470. - worker-cpu-set:
  1471. cpu: [ "all" ]
  1472. mode: "exclusive"
  1473. # Use explicitly 3 threads and don't compute number by using
  1474. # detect-thread-ratio variable:
  1475. # threads: 3
  1476. prio:
  1477. low: [ 0 ]
  1478. medium: [ "1-2" ]
  1479. high: [ 3 ]
  1480. default: "medium"
  1481. #- verdict-cpu-set:
  1482. # cpu: [ 0 ]
  1483. # prio:
  1484. # default: "high"
  1485. #
  1486. # By default Suricata creates one "detect" thread per available CPU/CPU core.
  1487. # This setting allows controlling this behaviour. A ratio setting of 2 will
  1488. # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this
  1489. # will result in 4 detect threads. If values below 1 are used, less threads
  1490. # are created. So on a dual core CPU a setting of 0.5 results in 1 detect
  1491. # thread being created. Regardless of the setting at a minimum 1 detect
  1492. # thread will always be created.
  1493. #
  1494. detect-thread-ratio: 1.0
  1495.  
  1496. # Luajit has a strange memory requirement, its 'states' need to be in the
  1497. # first 2G of the process' memory.
  1498. #
  1499. # 'luajit.states' is used to control how many states are preallocated.
  1500. # State use: per detect script: 1 per detect thread. Per output script: 1 per
  1501. # script.
  1502. luajit:
  1503. states: 128
  1504.  
  1505. # Profiling settings. Only effective if Suricata has been built with
  1506. # the --enable-profiling configure flag.
  1507. #
  1508. profiling:
  1509. # Run profiling for every X-th packet. The default is 1, which means we
  1510. # profile every packet. If set to 1000, one packet is profiled for every
  1511. # 1000 received.
  1512. #sample-rate: 1000
  1513.  
  1514. # rule profiling
  1515. rules:
  1516.  
  1517. # Profiling can be disabled here, but it will still have a
  1518. # performance impact if compiled in.
  1519. enabled: yes
  1520. filename: rule_perf.log
  1521. append: yes
  1522.  
  1523. # Sort options: ticks, avgticks, checks, matches, maxticks
  1524. # If commented out all the sort options will be used.
  1525. #sort: avgticks
  1526.  
  1527. # Limit the number of sids for which stats are shown at exit (per sort).
  1528. limit: 10
  1529.  
  1530. # output to json
  1531. json: yes
  1532.  
  1533. # per keyword profiling
  1534. keywords:
  1535. enabled: yes
  1536. filename: keyword_perf.log
  1537. append: yes
  1538.  
  1539. prefilter:
  1540. enabled: yes
  1541. filename: prefilter_perf.log
  1542. append: yes
  1543.  
  1544. # per rulegroup profiling
  1545. rulegroups:
  1546. enabled: yes
  1547. filename: rule_group_perf.log
  1548. append: yes
  1549.  
  1550. # packet profiling
  1551. packets:
  1552.  
  1553. # Profiling can be disabled here, but it will still have a
  1554. # performance impact if compiled in.
  1555. enabled: yes
  1556. filename: packet_stats.log
  1557. append: yes
  1558.  
  1559. # per packet csv output
  1560. csv:
  1561.  
  1562. # Output can be disabled here, but it will still have a
  1563. # performance impact if compiled in.
  1564. enabled: no
  1565. filename: packet_stats.csv
  1566.  
  1567. # profiling of locking. Only available when Suricata was built with
  1568. # --enable-profiling-locks.
  1569. locks:
  1570. enabled: no
  1571. filename: lock_stats.log
  1572. append: yes
  1573.  
  1574. pcap-log:
  1575. enabled: no
  1576. filename: pcaplog_stats.log
  1577. append: yes
  1578.  
  1579. ##
  1580. ## Netfilter integration
  1581. ##
  1582.  
  1583. # When running in NFQ inline mode, it is possible to use a simulated
  1584. # non-terminal NFQUEUE verdict.
  1585. # This permits sending all needed packet to Suricata via this rule:
  1586. # iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE
  1587. # And below, you can have your standard filtering ruleset. To activate
  1588. # this mode, you need to set mode to 'repeat'
  1589. # If you want a packet to be sent to another queue after an ACCEPT decision
  1590. # set the mode to 'route' and set next-queue value.
  1591. # On Linux >= 3.1, you can set batchcount to a value > 1 to improve performance
  1592. # by processing several packets before sending a verdict (worker runmode only).
  1593. # On Linux >= 3.6, you can set the fail-open option to yes to have the kernel
  1594. # accept the packet if Suricata is not able to keep pace.
  1595. # bypass mark and mask can be used to implement NFQ bypass. If bypass mark is
  1596. # set then the NFQ bypass is activated. Suricata will set the bypass mark/mask
  1597. # on packet of a flow that need to be bypassed. The Nefilter ruleset has to
  1598. # directly accept all packets of a flow once a packet has been marked.
  1599. nfq:
  1600. # mode: accept
  1601. # repeat-mark: 1
  1602. # repeat-mask: 1
  1603. # bypass-mark: 1
  1604. # bypass-mask: 1
  1605. # route-queue: 2
  1606. # batchcount: 20
  1607. # fail-open: yes
  1608.  
  1609. #nflog support
  1610. nflog:
  1611. # netlink multicast group
  1612. # (the same as the iptables --nflog-group param)
  1613. # Group 0 is used by the kernel, so you can't use it
  1614. - group: 2
  1615. # netlink buffer size
  1616. buffer-size: 18432
  1617. # put default value here
  1618. - group: default
  1619. # set number of packets to queue inside kernel
  1620. qthreshold: 1
  1621. # set the delay before flushing packet in the kernel's queue
  1622. qtimeout: 100
  1623. # netlink max buffer size
  1624. max-size: 20000
  1625.  
  1626. ##
  1627. ## Advanced Capture Options
  1628. ##
  1629.  
  1630. # General settings affecting packet capture
  1631. capture:
  1632. # disable NIC offloading. It's restored when Suricata exits.
  1633. # Enabled by default.
  1634. #disable-offloading: false
  1635. #
  1636. # disable checksum validation. Same as setting '-k none' on the
  1637. # commandline.
  1638. #checksum-validation: none
  1639.  
  1640. # Netmap support
  1641. #
  1642. # Netmap operates with NIC directly in driver, so you need FreeBSD 11+ which has
  1643. # built-in Netmap support or compile and install the Netmap module and appropriate
  1644. # NIC driver for your Linux system.
  1645. # To reach maximum throughput disable all receive-, segmentation-,
  1646. # checksum- offloading on your NIC (using ethtool or similar).
  1647. # Disabling TX checksum offloading is *required* for connecting OS endpoint
  1648. # with NIC endpoint.
  1649. # You can find more information at https://github.com/luigirizzo/netmap
  1650. #
  1651. netmap:
  1652. # To specify OS endpoint add plus sign at the end (e.g. "eth0+")
  1653. - interface: eth2
  1654. # Number of capture threads. "auto" uses number of RSS queues on interface.
  1655. # Warning: unless the RSS hashing is symmetrical, this will lead to
  1656. # accuracy issues.
  1657. #threads: auto
  1658. # You can use the following variables to activate netmap tap or IPS mode.
  1659. # If copy-mode is set to ips or tap, the traffic coming to the current
  1660. # interface will be copied to the copy-iface interface. If 'tap' is set, the
  1661. # copy is complete. If 'ips' is set, the packet matching a 'drop' action
  1662. # will not be copied.
  1663. # To specify the OS as the copy-iface (so the OS can route packets, or forward
  1664. # to a service running on the same machine) add a plus sign at the end
  1665. # (e.g. "copy-iface: eth0+"). Don't forget to set up a symmetrical eth0+ -> eth0
  1666. # for return packets. Hardware checksumming must be *off* on the interface if
  1667. # using an OS endpoint (e.g. 'ifconfig eth0 -rxcsum -txcsum -rxcsum6 -txcsum6' for FreeBSD
  1668. # or 'ethtool -K eth0 tx off rx off' for Linux).
  1669. #copy-mode: tap
  1670. #copy-iface: eth3
  1671. # Set to yes to disable promiscuous mode
  1672. # disable-promisc: no
  1673. # Choose checksum verification mode for the interface. At the moment
  1674. # of the capture, some packets may have an invalid checksum due to
  1675. # the checksum computation being offloaded to the network card.
  1676. # Possible values are:
  1677. # - yes: checksum validation is forced
  1678. # - no: checksum validation is disabled
  1679. # - auto: Suricata uses a statistical approach to detect when
  1680. # checksum off-loading is used.
  1681. # Warning: 'checksum-validation' must be set to yes to have any validation
  1682. #checksum-checks: auto
  1683. # BPF filter to apply to this interface. The pcap filter syntax apply here.
  1684. #bpf-filter: port 80 or udp
  1685. #- interface: eth3
  1686. #threads: auto
  1687. #copy-mode: tap
  1688. #copy-iface: eth2
  1689. # Put default values here
  1690. - interface: default
  1691.  
  1692. # PF_RING configuration: for use with native PF_RING support
  1693. # for more info see http://www.ntop.org/products/pf_ring/
  1694. pfring:
  1695. - interface: eth0
  1696. # Number of receive threads. If set to 'auto' Suricata will first try
  1697. # to use CPU (core) count and otherwise RSS queue count.
  1698. threads: auto
  1699.  
  1700. # Default clusterid. PF_RING will load balance packets based on flow.
  1701. # All threads/processes that will participate need to have the same
  1702. # clusterid.
  1703. cluster-id: 99
  1704.  
  1705. # Default PF_RING cluster type. PF_RING can load balance per flow.
  1706. # Possible values are cluster_flow or cluster_round_robin.
  1707. cluster-type: cluster_flow
  1708.  
  1709. # bpf filter for this interface
  1710. #bpf-filter: tcp
  1711.  
  1712. # If bypass is set then the PF_RING hw bypass is activated, when supported
  1713. # by the network interface. Suricata will instruct the interface to bypass
  1714. # all future packets for a flow that need to be bypassed.
  1715. #bypass: yes
  1716.  
  1717. # Choose checksum verification mode for the interface. At the moment
  1718. # of the capture, some packets may have an invalid checksum due to
  1719. # the checksum computation being offloaded to the network card.
  1720. # Possible values are:
  1721. # - rxonly: only compute checksum for packets received by network card.
  1722. # - yes: checksum validation is forced
  1723. # - no: checksum validation is disabled
  1724. # - auto: Suricata uses a statistical approach to detect when
  1725. # checksum off-loading is used. (default)
  1726. # Warning: 'checksum-validation' must be set to yes to have any validation
  1727. #checksum-checks: auto
  1728. # Second interface
  1729. #- interface: eth1
  1730. # threads: 3
  1731. # cluster-id: 93
  1732. # cluster-type: cluster_flow
  1733. # Put default values here
  1734. - interface: default
  1735. #threads: 2
  1736.  
  1737. # For FreeBSD ipfw(8) divert(4) support.
  1738. # Please make sure you have ipfw_load="YES" and ipdivert_load="YES"
  1739. # in /etc/loader.conf or kldload'ing the appropriate kernel modules.
  1740. # Additionally, you need to have an ipfw rule for the engine to see
  1741. # the packets from ipfw. For Example:
  1742. #
  1743. # ipfw add 100 divert 8000 ip from any to any
  1744. #
  1745. # N.B. This example uses "8000" -- this number must mach the values
  1746. # you passed on the command line, i.e., -d 8000
  1747. #
  1748. ipfw:
  1749.  
  1750. # Reinject packets at the specified ipfw rule number. This config
  1751. # option is the ipfw rule number AT WHICH rule processing continues
  1752. # in the ipfw processing system after the engine has finished
  1753. # inspecting the packet for acceptance. If no rule number is specified,
  1754. # accepted packets are reinjected at the divert rule which they entered
  1755. # and IPFW rule processing continues. No check is done to verify
  1756. # this will rule makes sense so care must be taken to avoid loops in ipfw.
  1757. #
  1758. ## The following example tells the engine to reinject packets
  1759. # back into the ipfw firewall AT rule number 5500:
  1760. #
  1761. # ipfw-reinjection-rule-number: 5500
  1762.  
  1763.  
  1764. napatech:
  1765. # When use_all_streams is set to "yes" the initialization code will query
  1766. # the Napatech service for all configured streams and listen on all of them.
  1767. # When set to "no" the streams config array will be used.
  1768. #
  1769. # This option necessitates running the appropriate NTPL commands to create
  1770. # the desired streams prior to running Suricata.
  1771. #use-all-streams: no
  1772.  
  1773. # The streams to listen on when auto-config is disabled or when and threading
  1774. # cpu-affinity is disabled. This can be either:
  1775. # an individual stream (e.g. streams: [0])
  1776. # or
  1777. # a range of streams (e.g. streams: ["0-3"])
  1778. #
  1779. streams: ["0-3"]
  1780.  
  1781. # Stream stats can be enabled to provide fine grain packet and byte counters
  1782. # for each thread/stream that is configured.
  1783. #
  1784. enable-stream-stats: no
  1785.  
  1786. # When auto-config is enabled the streams will be created and assigned
  1787. # automatically to the NUMA node where the thread resides. If cpu-affinity
  1788. # is enabled in the threading section. Then the streams will be created
  1789. # according to the number of worker threads specified in the worker-cpu-set.
  1790. # Otherwise, the streams array is used to define the streams.
  1791. #
  1792. # This option is intended primarily to support legacy configurations.
  1793. #
  1794. # This option cannot be used simultaneously with either "use-all-streams"
  1795. # or "hardware-bypass".
  1796. #
  1797. auto-config: yes
  1798.  
  1799. # Enable hardware level flow bypass.
  1800. #
  1801. hardware-bypass: yes
  1802.  
  1803. # Enable inline operation. When enabled traffic arriving on a given port is
  1804. # automatically forwarded out its peer port after analysis by Suricata.
  1805. #
  1806. inline: no
  1807.  
  1808. # Ports indicates which Napatech ports are to be used in auto-config mode.
  1809. # these are the port IDs of the ports that will be merged prior to the
  1810. # traffic being distributed to the streams.
  1811. #
  1812. # When hardware-bypass is enabled the ports must be configured as a segment.
  1813. # specify the port(s) on which upstream and downstream traffic will arrive.
  1814. # This information is necessary for the hardware to properly process flows.
  1815. #
  1816. # When using a tap configuration one of the ports will receive inbound traffic
  1817. # for the network and the other will receive outbound traffic. The two ports on a
  1818. # given segment must reside on the same network adapter.
  1819. #
  1820. # When using a SPAN-port configuration the upstream and downstream traffic
  1821. # arrives on a single port. This is configured by setting the two sides of the
  1822. # segment to reference the same port. (e.g. 0-0 to configure a SPAN port on
  1823. # port 0).
  1824. #
  1825. # port segments are specified in the form:
  1826. # ports: [0-1,2-3,4-5,6-6,7-7]
  1827. #
  1828. # For legacy systems when hardware-bypass is disabled this can be specified in any
  1829. # of the following ways:
  1830. #
  1831. # a list of individual ports (e.g. ports: [0,1,2,3])
  1832. #
  1833. # a range of ports (e.g. ports: [0-3])
  1834. #
  1835. # "all" to indicate that all ports are to be merged together
  1836. # (e.g. ports: [all])
  1837. #
  1838. # This parameter has no effect if auto-config is disabled.
  1839. #
  1840. ports: [0-1,2-3]
  1841.  
  1842. # When auto-config is enabled the hashmode specifies the algorithm for
  1843. # determining to which stream a given packet is to be delivered.
  1844. # This can be any valid Napatech NTPL hashmode command.
  1845. #
  1846. # The most common hashmode commands are: hash2tuple, hash2tuplesorted,
  1847. # hash5tuple, hash5tuplesorted and roundrobin.
  1848. #
  1849. # See Napatech NTPL documentation other hashmodes and details on their use.
  1850. #
  1851. # This parameter has no effect if auto-config is disabled.
  1852. #
  1853. hashmode: hash5tuplesorted
  1854.  
  1855. ##
  1856. ## Configure Suricata to load Suricata-Update managed rules.
  1857. ##
  1858.  
  1859. default-rule-path: /etc/suricata/rules
  1860.  
  1861. rule-files:
  1862. - hfm-srl.rules
  1863.  
  1864. ##
  1865. ## Auxiliary configuration files.
  1866. ##
  1867.  
  1868. classification-file: /etc/suricata/classification.config
  1869. reference-config-file: /etc/suricata/reference.config
  1870. # threshold-file: /etc/suricata/threshold.config
  1871.  
  1872. ##
  1873. ## Include other configs
  1874. ##
  1875.  
  1876. # Includes: Files included here will be handled as if they were in-lined
  1877. # in this configuration file. Files with relative pathnames will be
  1878. # searched for in the same directory as this configuration file. You may
  1879. # use absolute pathnames too.
  1880. # You can specify more than 2 configuration files, if needed.
  1881. #include: include1.yaml
  1882. #include: include2.yaml
  1883. # BEGIN ANSIBLE MANAGED BLOCK (Suricata host-bitmap)
  1884. host-bitmap:
  1885. enabled: yes
  1886. file: /var/lib/suricata/hostbits
  1887. # END ANSIBLE MANAGED BLOCK (Suricata host-bitmap)
  1888.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!