API tools faq
paste
Guest User

Untitled

a guest
May 31st, 2017
244
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
YAML 62.78 KB | None | 0 0
raw download clone embed print report
  1. %YAML 1.1
  2. ---
  3.  
  4. # Suricata configuration file. In addition to the comments describing all
  5. # options in this file, full documentation can be found at:
  6. # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml
  7.  
  8. ##
  9. ## Step 1: inform Suricata about your network
  10. ##
  11.  
  12. vars:
  13.  # more specifc is better for alert accuracy and performance
  14.   address-groups:
  15.    #HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
  16.     #HOME_NET: "[192.168.0.0/16]"
  17.     HOME_NET: "[192.168.0.0/16]"
  18.     #HOME_NET: "[172.16.0.0/12]"
  19.     #HOME_NET: "any"
  20.  
  21.     EXTERNAL_NET: "!$HOME_NET"
  22.     #EXTERNAL_NET: "any"
  23.  
  24.     HTTP_SERVERS: "$HOME_NET"
  25.     SMTP_SERVERS: "$HOME_NET"
  26.     SQL_SERVERS: "$HOME_NET"
  27.     DNS_SERVERS: "$HOME_NET"
  28.     TELNET_SERVERS: "$HOME_NET"
  29.     AIM_SERVERS: "$EXTERNAL_NET"
  30.     DNP3_SERVER: "$HOME_NET"
  31.     DNP3_CLIENT: "$HOME_NET"
  32.     MODBUS_CLIENT: "$HOME_NET"
  33.     MODBUS_SERVER: "$HOME_NET"
  34.     ENIP_CLIENT: "$HOME_NET"
  35.     ENIP_SERVER: "$HOME_NET"
  36.  
  37.   port-groups:
  38.     HTTP_PORTS: "80"
  39.     SHELLCODE_PORTS: "!80"
  40.     ORACLE_PORTS: 1521
  41.     SSH_PORTS: 22
  42.     DNP3_PORTS: 20000
  43.     MODBUS_PORTS: 502
  44.  
  45.  
  46. ##
  47. ## Step 2: select the rules to enable or disable
  48. ##
  49.  
  50. default-rule-path: /etc/suricata/rules
  51. rule-files:
  52. - smtp-files.rules
  53.  - http-files.rules
  54. # - botcc.rules
  55. # - ciarmy.rules
  56. # - compromised.rules
  57. # - drop.rules
  58. # - dshield.rules
  59. ## - emerging-activex.rules
  60. # - emerging-attack_response.rules
  61. # - emerging-chat.rules
  62. # - emerging-current_events.rules
  63. # - emerging-dns.rules
  64. # - emerging-dos.rules
  65. # - emerging-exploit.rules
  66. # - emerging-ftp.rules
  67. ## - emerging-games.rules
  68. ## - emerging-icmp_info.rules
  69. ## - emerging-icmp.rules
  70. # - emerging-imap.rules
  71. ## - emerging-inappropriate.rules
  72. # - emerging-malware.rules
  73. # - emerging-misc.rules
  74. # - emerging-mobile_malware.rules
  75. # - emerging-netbios.rules
  76. # - emerging-p2p.rules
  77. # - emerging-policy.rules
  78. # - emerging-pop3.rules
  79. # - emerging-rpc.rules
  80. # - emerging-scada.rules
  81. # - emerging-scan.rules
  82. ## - emerging-shellcode.rules
  83. # - emerging-smtp.rules
  84. # - emerging-snmp.rules
  85. # - emerging-sql.rules
  86. # - emerging-telnet.rules
  87. # - emerging-tftp.rules
  88. # - emerging-trojan.rules
  89. # - emerging-user_agents.rules
  90. # - emerging-voip.rules
  91. # - emerging-web_client.rules
  92. # - emerging-web_server.rules
  93. ## - emerging-web_specific_apps.rules
  94. # - emerging-worm.rules
  95. # - tor.rules
  96. ## - decoder-events.rules # available in suricata sources under rules dir
  97. ## - stream-events.rules  # available in suricata sources under rules dir
  98. # - http-events.rules    # available in suricata sources under rules dir
  99. # - smtp-events.rules    # available in suricata sources under rules dir
  100. ## - dns-events.rules     # available in suricata sources under rules dir
  101. # - tls-events.rules     # available in suricata sources under rules dir
  102. ## - modbus-events.rules  # available in suricata sources under rules dir
  103. ## - app-layer-events.rules  # available in suricata sources under rules dir
  104.  
  105. classification-file: /etc/suricata/classification.config
  106. reference-config-file: /etc/suricata/reference.config
  107. # threshold-file: /etc/suricata/threshold.config
  108.  
  109.  
  110. ##
  111. ## Step 3: select outputs to enable
  112. ##
  113.  
  114. # The default logging directory.  Any log or output file will be
  115. # placed here if its not specified with a full path name. This can be
  116. # overridden with the -l command line parameter.
  117. default-log-dir: /var/log/suricata/
  118.  
  119. # global stats configuration
  120. stats:
  121.   enabled: yes
  122.   # The interval field (in seconds) controls at what interval
  123.   # the loggers are invoked.
  124.   interval: 60
  125.  
  126. # Configure the type of alert (and other) logging you would like.
  127. outputs:
  128.  # a line based alerts log similar to Snort's fast.log
  129.   - fast:
  130.       enabled: yes
  131.       filename: fast.log
  132.       append: yes
  133.       #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  134.  
  135.   # Extensible Event Format (nicknamed EVE) event log in JSON format
  136.   - eve-log:
  137.       enabled: yes
  138.       #filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
  139.       filetype: syslog #regular|syslog|unix_dgram|unix_stream|redis
  140.       #filename: eve.json
  141.       filename: eve.log
  142.       #prefix: "@cee: " # prefix to prepend to each log entry
  143.       # the following are valid when type: syslog above
  144.       identity: "suricata"
  145.       facility: local5
  146.       level: Info ## possible levels: Emergency, Alert, Critical,
  147.                    ## Error, Warning, Notice, Info, Debug
  148.       #redis:
  149.       #  server: 127.0.0.1
  150.       #  port: 6379
  151.       #  mode: list ## possible values: list (default), channel
  152.       #  key: suricata ## key or channel to use (default to suricata)
  153.       # Redis pipelining set up. This will enable to only do a query every
  154.       # 'batch-size' events. This should lower the latency induced by network
  155.       # connection at the cost of some memory. There is no flushing implemented
  156.       # so this setting as to be reserved to high traffic suricata.
  157.       #  pipelining:
  158.       #    enabled: yes ## set enable to yes to enable query pipelining
  159.       #    batch-size: 10 ## number of entry to keep in buffer
  160.       types:
  161.         - alert:
  162.            # payload: yes             # enable dumping payload in Base64
  163.             # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
  164.             # payload-printable: yes   # enable dumping payload in printable (lossy) format
  165.             # packet: yes              # enable dumping of packet (without stream segments)
  166.             http: yes                # enable dumping of http fields
  167.             tls: yes                 # enable dumping of tls fields
  168.             ssh: yes                 # enable dumping of ssh fields
  169.             smtp: yes                # enable dumping of smtp fields
  170.  
  171.             # HTTP X-Forwarded-For support by adding an extra field or overwriting
  172.             # the source or destination IP address (depending on flow direction)
  173.             # with the one reported in the X-Forwarded-For HTTP header. This is
  174.             # helpful when reviewing alerts for traffic that is being reverse
  175.             # or forward proxied.
  176.             xff:
  177.               enabled: no
  178.               # Two operation modes are available, "extra-data" and "overwrite".
  179.               mode: extra-data
  180.               # Two proxy deployments are supported, "reverse" and "forward". In
  181.               # a "reverse" deployment the IP address used is the last one, in a
  182.               # "forward" deployment the first IP address is used.
  183.               deployment: reverse
  184.               # Header name where the actual IP address will be reported, if more
  185.               # than one IP address is present, the last IP address will be the
  186.               # one taken into consideration.
  187.               header: X-Forwarded-For
  188.         - http:
  189.             extended: yes     # enable this for extended logging information
  190.             # custom allows additional http fields to be included in eve-log
  191.             # the example below adds three additional fields when uncommented
  192.             #custom: [Accept-Encoding, Accept-Language, Authorization]
  193.         - dns
  194.         - tls:
  195.             extended: yes     # enable this for extended logging information
  196.         - files:
  197.             force-magic: no   # force logging magic on all logged files
  198.             force-hash: [md5]
  199.         #- drop:
  200.         #    alerts: no       # log alerts that caused drops
  201.         - smtp:
  202.             extended: yes # enable this for extended logging information
  203.             # this includes: bcc, message-id, subject, x_mailer, user-agent
  204.             # custom fields logging from the list:
  205.             #  reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
  206.             #  x-originating-ip, in-reply-to, references, importance, priority,
  207.             #  sensitivity, organization, content-md5, date
  208.             #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
  209.             # output md5 of fields: body, subject
  210.             # for the body you need to set app-layer.protocols.smtp.mime.body-md5
  211.             # to yes
  212.             #md5: [body, subject]
  213.  
  214.         - ssh
  215.         - stats:
  216.             totals: yes       # stats for all threads merged together
  217.             threads: no       # per thread stats
  218.             deltas: no        # include delta values
  219.         # bi-directional flows
  220.         - flow
  221.         # uni-directional flows
  222.         #- netflow
  223.  
  224.   # alert output for use with Barnyard2
  225.   - unified2-alert:
  226.       enabled: no
  227.       filename: unified2.alert
  228.  
  229.       # File size limit.  Can be specified in kb, mb, gb.  Just a number
  230.       # is parsed as bytes.
  231.       #limit: 32mb
  232.  
  233.       # Sensor ID field of unified2 alerts.
  234.       #sensor-id: 0
  235.  
  236.       # Include payload of packets related to alerts. Defaults to true, set to
  237.       # false if payload is not required.
  238.       #payload: yes
  239.  
  240.       # HTTP X-Forwarded-For support by adding the unified2 extra header or
  241.       # overwriting the source or destination IP address (depending on flow
  242.       # direction) with the one reported in the X-Forwarded-For HTTP header.
  243.       # This is helpful when reviewing alerts for traffic that is being reverse
  244.       # or forward proxied.
  245.       xff:
  246.         enabled: no
  247.         # Two operation modes are available, "extra-data" and "overwrite". Note
  248.         # that in the "overwrite" mode, if the reported IP address in the HTTP
  249.         # X-Forwarded-For header is of a different version of the packet
  250.         # received, it will fall-back to "extra-data" mode.
  251.         mode: extra-data
  252.         # Two proxy deployments are supported, "reverse" and "forward". In
  253.         # a "reverse" deployment the IP address used is the last one, in a
  254.         # "forward" deployment the first IP address is used.
  255.         deployment: reverse
  256.         # Header name where the actual IP address will be reported, if more
  257.         # than one IP address is present, the last IP address will be the
  258.         # one taken into consideration.
  259.         header: X-Forwarded-For
  260.  
  261.   # a line based log of HTTP requests (no alerts)
  262.   - http-log:
  263.       enabled: no
  264.       filename: http.log
  265.       append: yes
  266.       #extended: yes     # enable this for extended logging information
  267.       #custom: yes       # enabled the custom logging format (defined by customformat)
  268.       #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"
  269.       #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  270.  
  271.   # a line based log of TLS handshake parameters (no alerts)
  272.   - tls-log:
  273.       enabled: no  # Log TLS connections.
  274.       filename: tls.log # File to store TLS logs.
  275.       append: yes
  276.       #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  277.       #extended: yes # Log extended information like fingerprint
  278.  
  279.   # output module to store certificates chain to disk
  280.   - tls-store:
  281.       enabled: no
  282.       #certs-log-dir: certs # directory to store the certificates files
  283.  
  284.   # a line based log of DNS requests and/or replies (no alerts)
  285.   - dns-log:
  286.       enabled: no
  287.       filename: dns.log
  288.       append: yes
  289.       #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  290.  
  291.   # Packet log... log packets in pcap format. 3 modes of operation: "normal"
  292.   # "multi" and "sguil".
  293.   #
  294.   # In normal mode a pcap file "filename" is created in the default-log-dir,
  295.   # or are as specified by "dir".
  296.   # In multi mode, a file is created per thread. This will perform much
  297.   # better, but will create multiple files where 'normal' would create one.
  298.   # In multi mode the filename takes a few special variables:
  299.   # - %n -- thread number
  300.   # - %i -- thread id
  301.   # - %t -- timestamp (secs or secs.usecs based on 'ts-format'
  302.   # E.g. filename: pcap.%n.%t
  303.   #
  304.   # Note that it's possible to use directories, but the directories are not
  305.   # created by Suricata. E.g. filename: pcaps/%n/log.%s will log into the
  306.   # per thread directory.
  307.   #
  308.   # Also note that the limit and max-files settings are enforced per thread.
  309.   # So the size limit when using 8 threads with 1000mb files and 2000 files
  310.   # is: 8*1000*2000 ~ 16TiB.
  311.   #
  312.   # In Sguil mode "dir" indicates the base directory. In this base dir the
  313.   # pcaps are created in th directory structure Sguil expects:
  314.   #
  315.   # $sguil-base-dir/YYYY-MM-DD/$filename.<timestamp>
  316.   #
  317.   # By default all packets are logged except:
  318.   # - TCP streams beyond stream.reassembly.depth
  319.   # - encrypted streams after the key exchange
  320.   #
  321.   - pcap-log:
  322.       enabled: yes
  323.       filename: log.pcap
  324.  
  325.       # File size limit.  Can be specified in kb, mb, gb.  Just a number
  326.       # is parsed as bytes.
  327.       limit: 1000mb
  328.  
  329.       # If set to a value will enable ring buffer mode. Will keep Maximum of "max-files" of size "limit"
  330.       max-files: 2000
  331.  
  332.       mode: normal # normal, multi or sguil.
  333.       #sguil-base-dir: /nsm_data/
  334.       #ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
  335.       use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
  336.       honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stopped being logged.
  337.  
  338.   # a full alerts log containing much information for signature writers
  339.   # or for investigating suspected false positives.
  340.   - alert-debug:
  341.       enabled: no
  342.       filename: alert-debug.log
  343.       append: yes
  344.       #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  345.  
  346.   # alert output to prelude (http://www.prelude-technologies.com/) only
  347.   # available if Suricata has been compiled with --enable-prelude
  348.   - alert-prelude:
  349.       enabled: no
  350.       profile: suricata
  351.       log-packet-content: no
  352.       log-packet-header: yes
  353.  
  354.   # Stats.log contains data from various counters of the suricata engine.
  355.   - stats:
  356.       enabled: yes
  357.       filename: stats.log
  358.       totals: yes       # stats for all threads merged together
  359.       threads: no       # per thread stats
  360.       #null-values: yes  # print counters that have value 0
  361.  
  362.   # a line based alerts log similar to fast.log into syslog
  363.   - syslog:
  364.       enabled: no
  365.       # reported identity to syslog. If ommited the program name (usually
  366.       # suricata) will be used.
  367.       #identity: "suricata"
  368.       facility: local5
  369.       #level: Info ## possible levels: Emergency, Alert, Critical,
  370.                    ## Error, Warning, Notice, Info, Debug
  371.  
  372.   # a line based information for dropped packets in IPS mode
  373.   - drop:
  374.       enabled: no
  375.       filename: drop.log
  376.       append: yes
  377.       #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  378.  
  379.   # output module to store extracted files to disk
  380.   #
  381.   # The files are stored to the log-dir in a format "file.<id>" where <id> is
  382.   # an incrementing number starting at 1. For each file "file.<id>" a meta
  383.   # file "file.<id>.meta" is created.
  384.   #
  385.   # File extraction depends on a lot of things to be fully done:
  386.   # - stream reassembly depth. For optimal results, set this to 0 (unlimited)
  387.   # - http request / response body sizes. Again set to 0 for optimal results.
  388.   # - rules that contain the "filestore" keyword.
  389.   - file-store:
  390.       enabled: yes       # set to yes to enable
  391.       log-dir: files    # directory to store the files
  392.       force-magic: no   # force logging magic on all stored files
  393.       force-hash: [md5]
  394.       force-filestore: no # force storing of all files
  395.       waldo: file.waldo # waldo file to store the file_id across runs
  396.       stream-depth: 0
  397.  
  398.   # output module to log files tracked in a easily parsable json format
  399.   - file-log:
  400.       enabled: yes
  401.       filename: files-json.log
  402.       append: yes
  403.       #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
  404.  
  405.       force-magic: no   # force logging magic on all logged files
  406.       force-hash: [md5]     # force logging of md5 checksums
  407.  
  408.   # Log TCP data after stream normalization
  409.   # 2 types: file or dir. File logs into a single logfile. Dir creates
  410.   # 2 files per TCP session and stores the raw TCP data into them.
  411.   # Using 'both' will enable both file and dir modes.
  412.   #
  413.   # Note: limited by stream.depth
  414.   - tcp-data:
  415.       enabled: no
  416.       type: file
  417.       filename: tcp-data.log
  418.  
  419.   # Log HTTP body data after normalization, dechunking and unzipping.
  420.   # 2 types: file or dir. File logs into a single logfile. Dir creates
  421.   # 2 files per HTTP session and stores the normalized data into them.
  422.   # Using 'both' will enable both file and dir modes.
  423.   #
  424.   # Note: limited by the body limit settings
  425.   - http-body-data:
  426.       enabled: no
  427.       type: file
  428.       filename: http-data.log
  429.  
  430.   # Lua Output Support - execute lua script to generate alert and event
  431.   # output.
  432.   # Documented at:
  433.   # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Lua_Output
  434.   - lua:
  435.       enabled: no
  436.       #scripts-dir: /etc/suricata/lua-output/
  437.       scripts:
  438.      #   - script1.lua
  439.  
  440. # Logging configuration.  This is not about logging IDS alerts/events, but
  441. # output about what Suricata is doing, like startup messages, errors, etc.
  442. logging:
  443.  # The default log level, can be overridden in an output section.
  444.   # Note that debug level logging will only be emitted if Suricata was
  445.   # compiled with the --enable-debug configure option.
  446.   #
  447.   # This value is overriden by the SC_LOG_LEVEL env var.
  448.   default-log-level: notice
  449.  
  450.   # The default output format.  Optional parameter, should default to
  451.   # something reasonable if not provided.  Can be overriden in an
  452.   # output section.  You can leave this out to get the default.
  453.   #
  454.   # This value is overriden by the SC_LOG_FORMAT env var.
  455.   #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- "
  456.  
  457.   # A regex to filter output.  Can be overridden in an output section.
  458.   # Defaults to empty (no filter).
  459.   #
  460.   # This value is overriden by the SC_LOG_OP_FILTER env var.
  461.   default-output-filter:
  463.   # Define your logging outputs.  If none are defined, or they are all
  464.   # disabled you will get the default - console output.
  465.   outputs:
  466.   - console:
  467.       enabled: yes
  468.       # type: json
  469.   - file:
  470.       enabled: yes
  471.       level: info
  472.       filename: /var/log/suricata/suricata.log
  473.       # type: json
  474.   - syslog:
  475.       enabled: no
  476.       facility: local5
  477.       format: "[%i] <%d> -- "
  478.       # type: json
  479.  
  480.  
  481. ##
  482. ## Step 4: configure common capture settings
  483. ##
  484. ## See "Advanced Capture Options" below for more options, including NETMAP
  485. ## and PF_RING.
  486. ##
  487.  
  488. # Linux high speed capture support
  489. af-packet:
  490.   - interface: eth1
  491.     # Number of receive threads. "auto" uses the number of cores
  492.     threads: auto
  493.     # Default clusterid. AF_PACKET will load balance packets based on flow.
  494.     cluster-id: 99
  495.     # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
  496.     # This is only supported for Linux kernel > 3.1
  497.     # possible value are:
  498.     #  * cluster_round_robin: round robin load balancing
  499.     #  * cluster_flow: all packets of a given flow are send to the same socket
  500.     #  * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket
  501.     #  * cluster_qm: all packets linked by network card to a RSS queue are sent to the same
  502.     #  socket. Requires at least Linux 3.14.
  503.     #  * cluster_random: packets are sent randomly to sockets but with an equipartition.
  504.     #  Requires at least Linux 3.14.
  505.     #  * cluster_rollover: kernel rotates between sockets filling each socket before moving
  506.     #  to the next. Requires at least Linux 3.10.
  507.     # Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
  508.     # with capture card using RSS (require cpu affinity tuning and system irq tuning)
  509.     cluster-type: cluster_flow
  510.     # In some fragmentation case, the hash can not be computed. If "defrag" is set
  511.     # to yes, the kernel will do the needed defragmentation before sending the packets.
  512.     defrag: yes
  513.     # After Linux kernel 3.10 it is possible to activate the rollover option: if a socket is
  514.     # full then kernel will send the packet on the next socket with room available. This option
  515.     # can minimize packet drop and increase the treated bandwidth on single intensive flow.
  516.     #rollover: yes
  517.     # To use the ring feature of AF_PACKET, set 'use-mmap' to yes
  518.     use-mmap: yes
  519.     # Lock memory map to avoid it goes to swap. Be careful that over suscribing could lock
  520.     # your system
  521.     #mmap-locked: yes
  522.     # Use experimental tpacket_v3 capture mode, only active if use-mmap is true
  523.     tpacket-v3: yes
  524.     # Ring size will be computed with respect to max_pending_packets and number
  525.     # of threads. You can set manually the ring size in number of packets by setting
  526.     # the following value. If you are using flow cluster-type and have really network
  527.     # intensive single-flow you could want to set the ring-size independently of the number
  528.     # of threads:
  529.     ring-size: 200000
  530.     # Block size is used by tpacket_v3 only. It should set to a value high enough to contain
  531.     # a decent number of packets. Size is in bytes so please consider your MTU. It should be
  532.     # a power of 2 and it must be multiple of page size (usually 4096).
  533.     block-size: 196608
  534.     # tpacket_v3 block timeout: an open block is passed to userspace if it is not
  535.     # filled after block-timeout milliseconds.
  536.     #block-timeout: 10
  537.     # On busy system, this could help to set it to yes to recover from a packet drop
  538.     # phase. This will result in some packets (at max a ring flush) being non treated.
  539.     #use-emergency-flush: yes
  540.     # recv buffer size, increase value could improve performance
  541.     # buffer-size: 32768
  542.     # Set to yes to disable promiscuous mode
  543.     # disable-promisc: no
  544.     # Choose checksum verification mode for the interface. At the moment
  545.     # of the capture, some packets may be with an invalid checksum due to
  546.     # offloading to the network card of the checksum computation.
  547.     # Possible values are:
  548.     #  - kernel: use indication sent by kernel for each packet (default)
  549.     #  - yes: checksum validation is forced
  550.     #  - no: checksum validation is disabled
  551.     #  - auto: suricata uses a statistical approach to detect when
  552.     #  checksum off-loading is used.
  553.     # Warning: 'checksum-validation' must be set to yes to have any validation
  554.     #checksum-checks: kernel
  555.     # BPF filter to apply to this interface. The pcap filter syntax apply here.
  556.     #bpf-filter: port 80 or udp
  557.     # You can use the following variables to activate AF_PACKET tap or IPS mode.
  558.     # If copy-mode is set to ips or tap, the traffic coming to the current
  559.     # interface will be copied to the copy-iface interface. If 'tap' is set, the
  560.     # copy is complete. If 'ips' is set, the packet matching a 'drop' action
  561.     # will not be copied.
  562.     #copy-mode: ips
  563.     #copy-iface: eth1
  564.  
  565.   # Put default values here. These will be used for an interface that is not
  566.   # in the list above.
  567.   - interface: default
  568.     threads: 5
  569.     cluster-id: 98
  570.     cluster-type: cluster_flow
  571.     defrag: yes
  572.     use-mmap: yes
  573.     tpacket-v3: yes
  574.     ring-size: 200000
  575.     block-size: 196608
  576.  
  577. # Cross platform libpcap capture support
  578. pcap:
  579.   - interface: eth1
  580.     # On Linux, pcap will try to use mmaped capture and will use buffer-size
  581.     # as total of memory used by the ring. So set this to something bigger
  582.     # than 1% of your bandwidth.
  583.     #buffer-size: 16777216
  584.     #bpf-filter: "tcp and port 25"
  585.     # Choose checksum verification mode for the interface. At the moment
  586.     # of the capture, some packets may be with an invalid checksum due to
  587.     # offloading to the network card of the checksum computation.
  588.     # Possible values are:
  589.     #  - yes: checksum validation is forced
  590.     #  - no: checksum validation is disabled
  591.     #  - auto: suricata uses a statistical approach to detect when
  592.     #  checksum off-loading is used. (default)
  593.     # Warning: 'checksum-validation' must be set to yes to have any validation
  594.     #checksum-checks: auto
  595.     # With some accelerator cards using a modified libpcap (like myricom), you
  596.     # may want to have the same number of capture threads as the number of capture
  597.     # rings. In this case, set up the threads variable to N to start N threads
  598.     # listening on the same interface.
  599.     #threads: 16
  600.     # set to no to disable promiscuous mode:
  601.     #promisc: no
  602.     # set snaplen, if not set it defaults to MTU if MTU can be known
  603.     # via ioctl call and to full capture if not.
  604.     #snaplen: 1518
  605.   # Put default values here
  606.   - interface: default
  607.     #checksum-checks: auto
  608.  
  609. # Settings for reading pcap files
  610. pcap-file:
  611.  # Possible values are:
  612.   #  - yes: checksum validation is forced
  613.   #  - no: checksum validation is disabled
  614.   #  - auto: suricata uses a statistical approach to detect when
  615.   #  checksum off-loading is used. (default)
  616.   # Warning: 'checksum-validation' must be set to yes to have checksum tested
  617.   checksum-checks: auto
  618.  
  619. # See "Advanced Capture Options" below for more options, including NETMAP
  620. # and PF_RING.
  621.  
  622.  
  623. ##
  624. ## Step 5: App Layer Protocol Configuration
  625. ##
  626.  
  627. # Configure the app-layer parsers. The protocols section details each
  628. # protocol.
  629. #
  630. # The option "enabled" takes 3 values - "yes", "no", "detection-only".
  631. # "yes" enables both detection and the parser, "no" disables both, and
  632. # "detection-only" enables protocol detection only (parser disabled).
  633. app-layer:
  634.   protocols:
  635.     tls:
  636.       enabled: yes
  637.       detection-ports:
  638.         dp: 443
  639.  
  640.       #no-reassemble: yes
  641.     dcerpc:
  642.       enabled: yes
  643.     ftp:
  644.       enabled: yes
  645.     ssh:
  646.       enabled: yes
  647.     smtp:
  648.       enabled: yes
  649.       # Configure SMTP-MIME Decoder
  650.       mime:
  651.        # Decode MIME messages from SMTP transactions
  652.         # (may be resource intensive)
  653.         # This field supercedes all others because it turns the entire
  654.         # process on or off
  655.         decode-mime: yes
  656.  
  657.         # Decode MIME entity bodies (ie. base64, quoted-printable, etc.)
  658.         decode-base64: yes
  659.         decode-quoted-printable: yes
  660.  
  661.         # Maximum bytes per header data value stored in the data structure
  662.         # (default is 2000)
  663.         header-value-depth: 2000
  664.  
  665.         # Extract URLs and save in state data structure
  666.         extract-urls: yes
  667.         # Set to yes to compute the md5 of the mail body. You will then
  668.         # be able to journalize it.
  669.         body-md5: no
  670.       # Configure inspected-tracker for file_data keyword
  671.       inspected-tracker:
  672.         content-limit: 100000
  673.         content-inspect-min-size: 32768
  674.         content-inspect-window: 4096
  675.     imap:
  676.       enabled: detection-only
  677.     msn:
  678.       enabled: detection-only
  679.     smb:
  680.       enabled: yes
  681.       detection-ports:
  682.         dp: 139
  683.     # Note: Modbus probe parser is minimalist due to the poor significant field
  684.     # Only Modbus message length (greater than Modbus header length)
  685.     # And Protocol ID (equal to 0) are checked in probing parser
  686.     # It is important to enable detection port and define Modbus port
  687.     # to avoid false positive
  688.     modbus:
  689.      # How many unreplied Modbus requests are considered a flood.
  690.       # If the limit is reached, app-layer-event:modbus.flooded; will match.
  691.       #request-flood: 500
  692.  
  693.       enabled: no
  694.       detection-ports:
  695.         dp: 502
  696.       # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it
  697.       # is recommended to keep the TCP connection opened with a remote device
  698.       # and not to open and close it for each MODBUS/TCP transaction. In that
  699.       # case, it is important to set the depth of the stream reassembling as
  700.       # unlimited (stream.reassembly.depth: 0)
  701.     # smb2 detection is disabled internally inside the engine.
  702.     #smb2:
  703.     #  enabled: yes
  704.     dns:
  705.      # memcaps. Globally and per flow/state.
  706.       #global-memcap: 16mb
  707.       #state-memcap: 512kb
  708.  
  709.       # How many unreplied DNS requests are considered a flood.
  710.       # If the limit is reached, app-layer-event:dns.flooded; will match.
  711.       #request-flood: 500
  712.  
  713.       tcp:
  714.         enabled: yes
  715.         detection-ports:
  716.           dp: 53
  717.       udp:
  718.         enabled: yes
  719.         detection-ports:
  720.           dp: 53
  721.     http:
  722.       enabled: yes
  723.       # memcap: 64mb
  724.  
  725.       # default-config:           Used when no server-config matches
  726.       #   personality:            List of personalities used by default
  727.       #   request-body-limit:     Limit reassembly of request body for inspection
  728.       #                           by http_client_body & pcre /P option.
  729.       #   response-body-limit:    Limit reassembly of response body for inspection
  730.       #                           by file_data, http_server_body & pcre /Q option.
  731.       #   double-decode-path:     Double decode path section of the URI
  732.       #   double-decode-query:    Double decode query section of the URI
  733.       #   response-body-decompress-layer-limit:
  734.       #                           Limit to how many layers of compression will be
  735.       #                           decompressed. Defaults to 2.
  736.       #
  737.       # server-config:            List of server configurations to use if address matches
  738.       #   address:                List of ip addresses or networks for this block
  739.       #   personalitiy:           List of personalities used by this block
  740.       #   request-body-limit:     Limit reassembly of request body for inspection
  741.       #                           by http_client_body & pcre /P option.
  742.       #   response-body-limit:    Limit reassembly of response body for inspection
  743.       #                           by file_data, http_server_body & pcre /Q option.
  744.       #   double-decode-path:     Double decode path section of the URI
  745.       #   double-decode-query:    Double decode query section of the URI
  746.       #
  747.       #   uri-include-all:        Include all parts of the URI. By default the
  748.       #                           'scheme', username/password, hostname and port
  749.       #                           are excluded. Setting this option to true adds
  750.       #                           all of them to the normalized uri as inspected
  751.       #                           by http_uri, urilen, pcre with /U and the other
  752.       #                           keywords that inspect the normalized uri.
  753.       #                           Note that this does not affect http_raw_uri.
  754.       #                           Also, note that including all was the default in
  755.       #                           1.4 and 2.0beta1.
  756.       #
  757.       #   meta-field-limit:       Hard size limit for request and response size
  758.       #                           limits. Applies to request line and headers,
  759.       #                           response line and headers. Does not apply to
  760.       #                           request or response bodies. Default is 18k.
  761.       #                           If this limit is reached an event is raised.
  762.       #
  763.       # Currently Available Personalities:
  764.       #   Minimal, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0,
  765.       #   IIS_7_0, IIS_7_5, Apache_2
  766.       libhtp:
  767.          default-config:
  768.            personality: IDS
  769.  
  770.            # Can be specified in kb, mb, gb.  Just a number indicates
  771.            # it's in bytes.
  772.            request-body-limit: 100kb
  773.            response-body-limit: 100kb
  774.  
  775.            # inspection limits
  776.            request-body-minimal-inspect-size: 32kb
  777.            request-body-inspect-window: 4kb
  778.            response-body-minimal-inspect-size: 40kb
  779.            response-body-inspect-window: 16kb
  780.  
  781.            # response body decompression (0 disables)
  782.            response-body-decompress-layer-limit: 2
  783.  
  784.            # auto will use http-body-inline mode in IPS mode, yes or no set it statically
  785.            http-body-inline: auto
  786.  
  787.            # Take a random value for inspection sizes around the specified value.
  788.            # This lower the risk of some evasion technics but could lead
  789.            # detection change between runs. It is set to 'yes' by default.
  790.            #randomize-inspection-sizes: yes
  791.            # If randomize-inspection-sizes is active, the value of various
  792.            # inspection size will be choosen in the [1 - range%, 1 + range%]
  793.            # range
  794.            # Default value of randomize-inspection-range is 10.
  795.            #randomize-inspection-range: 10
  796.  
  797.            # decoding
  798.            double-decode-path: no
  799.            double-decode-query: no
  800.  
  801.          server-config:
  803.            #- apache:
  804.            #    address: [192.168.1.0/24, 127.0.0.0/8, "::1"]
  805.            #    personality: Apache_2
  806.            #    # Can be specified in kb, mb, gb.  Just a number indicates
  807.            #    # it's in bytes.
  808.            #    request-body-limit: 4096
  809.            #    response-body-limit: 4096
  810.            #    double-decode-path: no
  811.            #    double-decode-query: no
  812.  
  813.            #- iis7:
  814.            #    address:
  815.            #      - 192.168.0.0/24
  816.            #      - 192.168.10.0/24
  817.            #    personality: IIS_7_0
  818.            #    # Can be specified in kb, mb, gb.  Just a number indicates
  819.            #    # it's in bytes.
  820.            #    request-body-limit: 4096
  821.            #    response-body-limit: 4096
  822.            #    double-decode-path: no
  823.            #    double-decode-query: no
  824.  
  825. # Limit for the maximum number of asn1 frames to decode (default 256)
  826. asn1-max-frames: 256
  827.  
  828.  
  829. ##############################################################################
  830. ##
  831. ## Advanced settings below
  832. ##
  833. ##############################################################################
  834.  
  835. ##
  836. ## Run Options
  837. ##
  838.  
  839. # Run suricata as user and group.
  840. #run-as:
  841. #  user: suri
  842. #  group: suri
  843.  
  844. # Some logging module will use that name in event as identifier. The default
  845. # value is the hostname
  846. #sensor-name: suricata
  847.  
  848. # Default pid file.
  849. # Will use this file if no --pidfile in command options.
  850. #pid-file: /var/run/suricata.pid
  851.  
  852. # Daemon working directory
  853. # Suricata will change directory to this one if provided
  854. # Default: "/"
  855. #daemon-directory: "/"
  856.  
  857. # Suricata core dump configuration. Limits the size of the core dump file to
  858. # approximately max-dump. The actual core dump size will be a multiple of the
  859. # page size. Core dumps that would be larger than max-dump are truncated. On
  860. # Linux, the actual core dump size may be a few pages larger than max-dump.
  861. # Setting max-dump to 0 disables core dumping.
  862. # Setting max-dump to 'unlimited' will give the full core dump file.
  863. # On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size
  864. # to be 'unlimited'.
  865.  
  866. coredump:
  867.   max-dump: unlimited
  868.  
  869. # If suricata box is a router for the sniffed networks, set it to 'router'. If
  870. # it is a pure sniffing setup, set it to 'sniffer-only'.
  871. # If set to auto, the variable is internally switch to 'router' in IPS mode
  872. # and 'sniffer-only' in IDS mode.
  873. # This feature is currently only used by the reject* keywords.
  874. host-mode: sniffer-only
  875.  
  876. # Number of packets preallocated per thread. The default is 1024. A higher number
  877. # will make sure each CPU will be more easily kept busy, but may negatively
  878. # impact caching.
  879. #
  880. # If you are using the CUDA pattern matcher (mpm-algo: ac-cuda), different rules
  881. # apply. In that case try something like 60000 or more. This is because the CUDA
  882. # pattern matcher buffers and scans as many packets as possible in parallel.
  883. #max-pending-packets: 1024
  884.  
  885. # Runmode the engine should use. Please check --list-runmodes to get the available
  886. # runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
  887. # load balancing).
  888. #runmode: autofp
  889. runmode: workers
  890.  
  891. # Specifies the kind of flow load balancer used by the flow pinned autofp mode.
  892. #
  893. # Supported schedulers are:
  894. #
  895. # round-robin       - Flows assigned to threads in a round robin fashion.
  896. # active-packets    - Flows assigned to threads that have the lowest number of
  897. #                     unprocessed packets (default).
  898. # hash              - Flow alloted usihng the address hash. More of a random
  899. #                     technique. Was the default in Suricata 1.2.1 and older.
  900. #
  901. autofp-scheduler: active-packets
  902.  
  903. # Preallocated size for packet. Default is 1514 which is the classical
  904. # size for pcap on ethernet. You should adjust this value to the highest
  905. # packet size (MTU + hardware header) on your system.
  906. default-packet-size: 9000
  907.  
  908. # Unix command socket can be used to pass commands to suricata.
  909. # An external tool can then connect to get information from suricata
  910. # or trigger some modifications of the engine. Set enabled to yes
  911. # to activate the feature. You can use the filename variable to set
  912. # the file name of the socket.
  913. unix-command:
  914.   enabled: no
  915.   #filename: custom.socket
  916.  
  917. # Magic file. The extension .mgc is added to the value here.
  918. #magic-file: /usr/share/file/magic
  919. #magic-file:
  920.  
  921. legacy:
  922.   uricontent: enabled
  923.  
  924. ##
  925. ## Detection settings
  926. ##
  927.  
  928. # Set the order of alerts bassed on actions
  929. # The default order is pass, drop, reject, alert
  930. # action-order:
  931. #   - pass
  932. #   - drop
  933. #   - reject
  934. #   - alert
  935.  
  936. # IP Reputation
  937. #reputation-categories-file: /etc/suricata/iprep/categories.txt
  938. #default-reputation-path: /etc/suricata/iprep
  939. #reputation-files:
  940. # - reputation.list
  941.  
  942. # When run with the option --engine-analysis, the engine will read each of
  943. # the parameters below, and print reports for each of the enabled sections
  944. # and exit.  The reports are printed to a file in the default log dir
  945. # given by the parameter "default-log-dir", with engine reporting
  946. # subsection below printing reports in its own report file.
  947. engine-analysis:
  948.  # enables printing reports for fast-pattern for every rule.
  949.   rules-fast-pattern: yes
  950.   # enables printing reports for each rule
  951.   rules: yes
  952.  
  953. #recursion and match limits for PCRE where supported
  954. pcre:
  955.   match-limit: 3500
  956.   match-limit-recursion: 1500
  957.  
  958. ##
  959. ## Advanced Traffic Tracking and Reconstruction Settings
  960. ##
  961.  
  962. # Host specific policies for defragmentation and TCP stream
  963. # reassembly. The host OS lookup is done using a radix tree, just
  964. # like a routing table so the most specific entry matches.
  965. host-os-policy:
  966.  # Make the default policy windows.
  967.   windows: [0.0.0.0/0]
  968.   bsd: []
  969.   bsd-right: []
  970.   old-linux: []
  971.   linux: [192.168.0.0/16]
  972.   old-solaris: []
  973.   solaris: []
  974.   hpux10: []
  975.   hpux11: []
  976.   irix: []
  977.   macos: []
  978.   vista: []
  979.   windows2k3: []
  980.  
  981. # Defrag settings:
  982.  
  983. defrag:
  984.   memcap: 512mb
  985.   hash-size: 65536
  986.   trackers: 65535 # number of defragmented flows to follow
  987.   max-frags: 65535 # number of fragments to keep (higher than trackers)
  988.   prealloc: yes
  989.   timeout: 60
  990.  
  991. # Enable defrag per host settings
  992. #  host-config:
  993. #
  994. #    - dmz:
  995. #        timeout: 30
  996. #        address: [192.168.1.0/24, 127.0.0.0/8, 1.1.1.0/24, 2.2.2.0/24, "1.1.1.1", "2.2.2.2", "::1"]
  997. #
  998. #    - lan:
  999. #        timeout: 45
  1000. #        address:
  1001. #          - 192.168.0.0/24
  1002. #          - 192.168.10.0/24
  1003. #          - 172.16.14.0/24
  1004.  
  1005. # Flow settings:
  1006. # By default, the reserved memory (memcap) for flows is 32MB. This is the limit
  1007. # for flow allocation inside the engine. You can change this value to allow
  1008. # more memory usage for flows.
  1009. # The hash-size determine the size of the hash used to identify flows inside
  1010. # the engine, and by default the value is 65536.
  1011. # At the startup, the engine can preallocate a number of flows, to get a better
  1012. # performance. The number of flows preallocated is 10000 by default.
  1013. # emergency-recovery is the percentage of flows that the engine need to
  1014. # prune before unsetting the emergency state. The emergency state is activated
  1015. # when the memcap limit is reached, allowing to create new flows, but
  1016. # prunning them with the emergency timeouts (they are defined below).
  1017. # If the memcap is reached, the engine will try to prune flows
  1018. # with the default timeouts. If it doens't find a flow to prune, it will set
  1019. # the emergency bit and it will try again with more agressive timeouts.
  1020. # If that doesn't work, then it will try to kill the last time seen flows
  1021. # not in use.
  1022. # The memcap can be specified in kb, mb, gb.  Just a number indicates it's
  1023. # in bytes.
  1024.  
  1025. flow:
  1026.   memcap: 1024mb
  1027.   hash-size: 65536
  1028.   prealloc: 10000
  1029.   emergency-recovery: 30
  1030.   #managers: 1 # default to one flow manager
  1031.   #recyclers: 1 # default to one flow recycler thread
  1032.  
  1033. # This option controls the use of vlan ids in the flow (and defrag)
  1034. # hashing. Normally this should be enabled, but in some (broken)
  1035. # setups where both sides of a flow are not tagged with the same vlan
  1036. # tag, we can ignore the vlan id's in the flow hashing.
  1037. vlan:
  1038.   use-for-tracking: true
  1039.  
  1040. # Specific timeouts for flows. Here you can specify the timeouts that the
  1041. # active flows will wait to transit from the current state to another, on each
  1042. # protocol. The value of "new" determine the seconds to wait after a hanshake or
  1043. # stream startup before the engine free the data of that flow it doesn't
  1044. # change the state to established (usually if we don't receive more packets
  1045. # of that flow). The value of "established" is the amount of
  1046. # seconds that the engine will wait to free the flow if it spend that amount
  1047. # without receiving new packets or closing the connection. "closed" is the
  1048. # amount of time to wait after a flow is closed (usually zero).
  1049. #
  1050. # There's an emergency mode that will become active under attack circumstances,
  1051. # making the engine to check flow status faster. This configuration variables
  1052. # use the prefix "emergency-" and work similar as the normal ones.
  1053. # Some timeouts doesn't apply to all the protocols, like "closed", for udp and
  1054. # icmp.
  1055.  
  1056. flow-timeouts:
  1058.   default:
  1059.     new: 30
  1060.     established: 300
  1061.     closed: 0
  1062.     emergency-new: 10
  1063.     emergency-established: 100
  1064.     emergency-closed: 0
  1065.   tcp:
  1066.     new: 60
  1067.     established: 600
  1068.     closed: 60
  1069.     emergency-new: 5
  1070.     emergency-established: 100
  1071.     emergency-closed: 10
  1072.   udp:
  1073.     new: 30
  1074.     established: 300
  1075.     emergency-new: 10
  1076.     emergency-established: 100
  1077.   icmp:
  1078.     new: 30
  1079.     established: 300
  1080.     emergency-new: 10
  1081.     emergency-established: 100
  1082.  
  1083. # Stream engine settings. Here the TCP stream tracking and reassembly
  1084. # engine is configured.
  1085. #
  1086. # stream:
  1087. #   memcap: 32mb                # Can be specified in kb, mb, gb.  Just a
  1088. #                               # number indicates it's in bytes.
  1089. #   checksum-validation: yes    # To validate the checksum of received
  1090. #                               # packet. If csum validation is specified as
  1091. #                               # "yes", then packet with invalid csum will not
  1092. #                               # be processed by the engine stream/app layer.
  1093. #                               # Warning: locally generated trafic can be
  1094. #                               # generated without checksum due to hardware offload
  1095. #                               # of checksum. You can control the handling of checksum
  1096. #                               # on a per-interface basis via the 'checksum-checks'
  1097. #                               # option
  1098. #   prealloc-sessions: 2k       # 2k sessions prealloc'd per stream thread
  1099. #   midstream: false            # don't allow midstream session pickups
  1100. #   async-oneside: false        # don't enable async stream handling
  1101. #   inline: no                  # stream inline mode
  1102. #   max-synack-queued: 5        # Max different SYN/ACKs to queue
  1103. #
  1104. #   reassembly:
  1105. #     memcap: 64mb              # Can be specified in kb, mb, gb.  Just a number
  1106. #                               # indicates it's in bytes.
  1107. #     depth: 1mb                # Can be specified in kb, mb, gb.  Just a number
  1108. #                               # indicates it's in bytes.
  1109. #     toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
  1110. #                               # this size.  Can be specified in kb, mb,
  1111. #                               # gb.  Just a number indicates it's in bytes.
  1112. #                               # The max acceptable size is 4024 bytes.
  1113. #     toclient-chunk-size: 2560 # inspect raw stream in chunks of at least
  1114. #                               # this size.  Can be specified in kb, mb,
  1115. #                               # gb.  Just a number indicates it's in bytes.
  1116. #                               # The max acceptable size is 4024 bytes.
  1117. #     randomize-chunk-size: yes # Take a random value for chunk size around the specified value.
  1118. #                               # This lower the risk of some evasion technics but could lead
  1119. #                               # detection change between runs. It is set to 'yes' by default.
  1120. #     randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is
  1121. #                               # a random value between (1 - randomize-chunk-range/100)*toserver-chunk-size
  1122. #                               # and (1 + randomize-chunk-range/100)*toserver-chunk-size and the same
  1123. #                               # calculation for toclient-chunk-size.
  1124. #                               # Default value of randomize-chunk-range is 10.
  1125. #
  1126. #     raw: yes                  # 'Raw' reassembly enabled or disabled.
  1127. #                               # raw is for content inspection by detection
  1128. #                               # engine.
  1129. #
  1130. #     chunk-prealloc: 250       # Number of preallocated stream chunks. These
  1131. #                               # are used during stream inspection (raw).
  1132. #     segments:                 # Settings for reassembly segment pool.
  1133. #       - size: 4               # Size of the (data)segment for a pool
  1134. #         prealloc: 256         # Number of segments to prealloc and keep
  1135. #                               # in the pool.
  1136. #     zero-copy-size: 128       # This option sets in bytes the value at
  1137. #                               # which segment data is passed to the app
  1138. #                               # layer API directly. Data sizes equal to
  1139. #                               # and higher than the value set are passed
  1140. #                               # on directly.
  1141. #
  1142. stream:
  1143.   memcap: 6gb
  1144.   prealloc-sessions: 100000
  1145.   checksum-validation: no      # reject wrong csums
  1146.   inline: no                  # auto will use inline mode in IPS mode, yes or no set it statically
  1147.   bypass: yes
  1148.   reassembly:
  1149.     memcap: 12gb
  1150.     depth: 1mb                  # reassemble 1mb into a stream
  1151.     toserver-chunk-size: 2560
  1152.     toclient-chunk-size: 2560
  1153.     randomize-chunk-size: yes
  1154.     #randomize-chunk-range: 10
  1155.     #raw: yes
  1156.     #chunk-prealloc: 250
  1157.     #segments:
  1158.     #  - size: 4
  1159.     #    prealloc: 256
  1160.     #  - size: 16
  1161.     #    prealloc: 512
  1162.     #  - size: 112
  1163.     #    prealloc: 512
  1164.     #  - size: 248
  1165.     #    prealloc: 512
  1166.     #  - size: 512
  1167.     #    prealloc: 512
  1168.     #  - size: 768
  1169.     #    prealloc: 1024
  1170.     #  - size: 1448
  1171.     #    prealloc: 1024
  1172.     #  - size: 65535
  1173.     #    prealloc: 128
  1174.     #zero-copy-size: 128
  1175.  
  1176. # Host table:
  1177. #
  1178. # Host table is used by tagging and per host thresholding subsystems.
  1179. #
  1180. host:
  1181.   hash-size: 4096
  1182.   prealloc: 1000
  1183.   memcap: 32mb
  1184.  
  1185. # IP Pair table:
  1186. #
  1187. # Used by xbits 'ippair' tracking.
  1188. #
  1189. #ippair:
  1190. #  hash-size: 4096
  1191. #  prealloc: 1000
  1192. #  memcap: 32mb
  1193.  
  1194.  
  1195. ##
  1196. ## Performance tuning and profiling
  1197. ##
  1198.  
  1199. # The detection engine builds internal groups of signatures. The engine
  1200. # allow us to specify the profile to use for them, to manage memory on an
  1201. # efficient way keeping a good performance. For the profile keyword you
  1202. # can use the words "low", "medium", "high" or "custom". If you use custom
  1203. # make sure to define the values at "- custom-values" as your convenience.
  1204. # Usually you would prefer medium/high/low.
  1205. #
  1206. # "sgh mpm-context", indicates how the staging should allot mpm contexts for
  1207. # the signature groups.  "single" indicates the use of a single context for
  1208. # all the signature group heads.  "full" indicates a mpm-context for each
  1209. # group head.  "auto" lets the engine decide the distribution of contexts
  1210. # based on the information the engine gathers on the patterns from each
  1211. # group head.
  1212. #
  1213. # The option inspection-recursion-limit is used to limit the recursive calls
  1214. # in the content inspection code.  For certain payload-sig combinations, we
  1215. # might end up taking too much time in the content inspection code.
  1216. # If the argument specified is 0, the engine uses an internally defined
  1217. # default limit.  On not specifying a value, we use no limits on the recursion.
  1218. detect:
  1219.   profile: medium
  1220.   custom-values:
  1221.     toclient-groups: 3
  1222.     toserver-groups: 25
  1223.   sgh-mpm-context: auto
  1224.   inspection-recursion-limit: 3000
  1225.   # If set to yes, the loading of signatures will be made after the capture
  1226.   # is started. This will limit the downtime in IPS mode.
  1227.   #delayed-detect: yes
  1228.  
  1229.   # the grouping values above control how many groups are created per
  1230.   # direction. Port whitelisting forces that port to get it's own group.
  1231.   # Very common ports will benefit, as well as ports with many expensive
  1232.   # rules.
  1233.   grouping:
  1234.    #tcp-whitelist: 53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080
  1235.     #udp-whitelist: 53, 135, 5060
  1236.  
  1237.   profiling:
  1238.    # Log the rules that made it past the prefilter stage, per packet
  1239.     # default is off. The threshold setting determines how many rules
  1240.     # must have made it past pre-filter for that rule to trigger the
  1241.     # logging.
  1242.     #inspect-logging-threshold: 200
  1243.     grouping:
  1244.       dump-to-disk: false
  1245.       include-rules: false      # very verbose
  1246.       include-mpm-stats: false
  1247.  
  1248. # Select the multi pattern algorithm you want to run for scan/search the
  1249. # in the engine.
  1250. #
  1251. # The supported algorithms are:
  1252. # "ac"      - Aho-Corasick, default implementation
  1253. # "ac-bs"   - Aho-Corasick, reduced memory implementation
  1254. # "ac-cuda" - Aho-Corasick, CUDA implementation
  1255. # "ac-ks"   - Aho-Corasick, "Ken Steele" variant
  1256. # "hs"      - Hyperscan, available when built with Hyperscan support
  1257. #
  1258. # The default mpm-algo value of "auto" will use "hs" if Hyperscan is
  1259. # available, "ac" otherwise.
  1260. #
  1261. # The mpm you choose also decides the distribution of mpm contexts for
  1262. # signature groups, specified by the conf - "detect.sgh-mpm-context".
  1263. # Selecting "ac" as the mpm would require "detect.sgh-mpm-context"
  1264. # to be set to "single", because of ac's memory requirements, unless the
  1265. # ruleset is small enough to fit in one's memory, in which case one can
  1266. # use "full" with "ac".  Rest of the mpms can be run in "full" mode.
  1267. #
  1268. # There is also a CUDA pattern matcher (only available if Suricata was
  1269. # compiled with --enable-cuda: b2g_cuda. Make sure to update your
  1270. # max-pending-packets setting above as well if you use b2g_cuda.
  1271.  
  1272. mpm-algo: auto
  1273.  
  1274. # Select the matching algorithm you want to use for single-pattern searches.
  1275. #
  1276. # Supported algorithms are "bm" (Boyer-Moore) and "hs" (Hyperscan, only
  1277. # available if Suricata has been built with Hyperscan support).
  1278. #
  1279. # The default of "auto" will use "hs" if available, otherwise "bm".
  1280.  
  1281. spm-algo: auto
  1282.  
  1283. # Suricata is multi-threaded. Here the threading can be influenced.
  1284. threading:
  1285.   set-cpu-affinity: no
  1286.   # Tune cpu affinity of threads. Each family of threads can be bound
  1287.   # on specific CPUs.
  1288.   #
  1289.   # These 2 apply to the all runmodes:
  1290.   # management-cpu-set is used for flow timeout handling, counters
  1291.   # worker-cpu-set is used for 'worker' threads
  1292.   #
  1293.   # Additionally, for autofp these apply:
  1294.   # receive-cpu-set is used for capture threads
  1295.   # verdict-cpu-set is used for IPS verdict threads
  1296.   #
  1297.   cpu-affinity:
  1298.     - management-cpu-set:
  1299.         cpu: [ 0 ]  # include only these cpus in affinity settings
  1300.     - receive-cpu-set:
  1301.         cpu: [ "1-4" ]  # include only these cpus in affinity settings
  1302.     - worker-cpu-set:
  1303.         cpu: [ "5-23" ]
  1304.         mode: "exclusive"
  1305.         # Use explicitely 3 threads and don't compute number by using
  1306.         # detect-thread-ratio variable:
  1307.         # threads: 3
  1308.         prio:
  1309.           low: [ 0 ]
  1310.           medium: [ "1-2" ]
  1311.           high: [ 3 ]
  1312.           default: "medium"
  1313.     #- verdict-cpu-set:
  1314.     #    cpu: [ 0 ]
  1315.     #    prio:
  1316.     #      default: "high"
  1317.   #
  1318.   # By default Suricata creates one "detect" thread per available CPU/CPU core.
  1319.   # This setting allows controlling this behaviour. A ratio setting of 2 will
  1320.   # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this
  1321.   # will result in 4 detect threads. If values below 1 are used, less threads
  1322.   # are created. So on a dual core CPU a setting of 0.5 results in 1 detect
  1323.   # thread being created. Regardless of the setting at a minimum 1 detect
  1324.   # thread will always be created.
  1325.   #
  1326.   detect-thread-ratio: 1.0
  1327.  
  1328. # Profiling settings. Only effective if Suricata has been built with the
  1329. # the --enable-profiling configure flag.
  1330. #
  1331. profiling:
  1332.  # Run profiling for every xth packet. The default is 1, which means we
  1333.   # profile every packet. If set to 1000, one packet is profiled for every
  1334.   # 1000 received.
  1335.   #sample-rate: 1000
  1336.  
  1337.   # rule profiling
  1338.   rules:
  1340.     # Profiling can be disabled here, but it will still have a
  1341.     # performance impact if compiled in.
  1342.     enabled: yes
  1343.     filename: rule_perf.log
  1344.     append: yes
  1345.  
  1346.     # Sort options: ticks, avgticks, checks, matches, maxticks
  1347.     sort: avgticks
  1348.  
  1349.     # Limit the number of items printed at exit (ignored for json).
  1350.     limit: 100
  1351.  
  1352.     # output to json
  1353.     json: yes
  1354.  
  1355.   # per keyword profiling
  1356.   keywords:
  1357.     enabled: yes
  1358.     filename: keyword_perf.log
  1359.     append: yes
  1360.  
  1361.   # per rulegroup profiling
  1362.   rulegroups:
  1363.     enabled: yes
  1364.     filename: rule_group_perf.log
  1365.     append: yes
  1366.  
  1367.   # packet profiling
  1368.   packets:
  1370.     # Profiling can be disabled here, but it will still have a
  1371.     # performance impact if compiled in.
  1372.     enabled: yes
  1373.     filename: packet_stats.log
  1374.     append: yes
  1375.  
  1376.     # per packet csv output
  1377.     csv:
  1379.       # Output can be disabled here, but it will still have a
  1380.       # performance impact if compiled in.
  1381.       enabled: no
  1382.       filename: packet_stats.csv
  1383.  
  1384.   # profiling of locking. Only available when Suricata was built with
  1385.   # --enable-profiling-locks.
  1386.   locks:
  1387.     enabled: no
  1388.     filename: lock_stats.log
  1389.     append: yes
  1390.  
  1391.   pcap-log:
  1392.     enabled: no
  1393.     filename: pcaplog_stats.log
  1394.     append: yes
  1395.  
  1396. ##
  1397. ## Netfilter integration
  1398. ##
  1399.  
  1400. # When running in NFQ inline mode, it is possible to use a simulated
  1401. # non-terminal NFQUEUE verdict.
  1402. # This permit to do send all needed packet to suricata via this a rule:
  1403. #        iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE
  1404. # And below, you can have your standard filtering ruleset. To activate
  1405. # this mode, you need to set mode to 'repeat'
  1406. # If you want packet to be sent to another queue after an ACCEPT decision
  1407. # set mode to 'route' and set next-queue value.
  1408. # On linux >= 3.1, you can set batchcount to a value > 1 to improve performance
  1409. # by processing several packets before sending a verdict (worker runmode only).
  1410. # On linux >= 3.6, you can set the fail-open option to yes to have the kernel
  1411. # accept the packet if suricata is not able to keep pace.
  1412. nfq:
  1413. #  mode: accept
  1414. #  repeat-mark: 1
  1415. #  repeat-mask: 1
  1416. #  route-queue: 2
  1417. #  batchcount: 20
  1418. #  fail-open: yes
  1419.  
  1420. #nflog support
  1421. nflog:
  1422.    # netlink multicast group
  1423.     # (the same as the iptables --nflog-group param)
  1424.     # Group 0 is used by the kernel, so you can't use it
  1425.   - group: 2
  1426.     # netlink buffer size
  1427.     buffer-size: 18432
  1428.     # put default value here
  1429.   - group: default
  1430.     # set number of packet to queue inside kernel
  1431.     qthreshold: 1
  1432.     # set the delay before flushing packet in the queue inside kernel
  1433.     qtimeout: 100
  1434.     # netlink max buffer size
  1435.     max-size: 20000
  1436.  
  1437. ##
  1438. ## Advanced Capture Options
  1439. ##
  1440.  
  1441. # Netmap support
  1442. #
  1443. # Netmap operates with NIC directly in driver, so you need FreeBSD wich have
  1444. # built-in netmap support or compile and install netmap module and appropriate
  1445. # NIC driver on your Linux system.
  1446. # To reach maximum throughput disable all receive-, segmentation-,
  1447. # checksum- offloadings on NIC.
  1448. # Disabling Tx checksum offloading is *required* for connecting OS endpoint
  1449. # with NIC endpoint.
  1450. # You can find more information at https://github.com/luigirizzo/netmap
  1451. #
  1452. netmap:
  1453.   # To specify OS endpoint add plus sign at the end (e.g. "eth0+")
  1454.  - interface: eth1
  1455.    # Number of receive threads. "auto" uses number of RSS queues on interface.
  1456.    #threads: auto
  1457.    # You can use the following variables to activate netmap tap or IPS mode.
  1458.    # If copy-mode is set to ips or tap, the traffic coming to the current
  1459.    # interface will be copied to the copy-iface interface. If 'tap' is set, the
  1460.    # copy is complete. If 'ips' is set, the packet matching a 'drop' action
  1461.    # will not be copied.
  1462.    # To specify the OS as the copy-iface (so the OS can route packets, or forward
  1463.    # to a service running on the same machine) add a plus sign at the end
  1464.    # (e.g. "copy-iface: eth0+"). Don't forget to set up a symmetrical eth0+ -> eth0
  1465.    # for return packets. Hardware checksumming must be *off* on the interface if
  1466.    # using an OS endpoint (e.g. 'ifconfig eth0 -rxcsum -txcsum -rxcsum6 -txcsum6' for FreeBSD
  1467.    # or 'ethtool -K eth0 tx off rx off' for Linux).
  1468.    #copy-mode: tap
  1469.    #copy-iface: eth3
  1470.    # Set to yes to disable promiscuous mode
  1471.    # disable-promisc: no
  1472.    # Choose checksum verification mode for the interface. At the moment
  1473.    # of the capture, some packets may be with an invalid checksum due to
  1474.    # offloading to the network card of the checksum computation.
  1475.    # Possible values are:
  1476.    #  - yes: checksum validation is forced
  1477.    #  - no: checksum validation is disabled
  1478.    #  - auto: suricata uses a statistical approach to detect when
  1479.    #  checksum off-loading is used.
  1480.    # Warning: 'checksum-validation' must be set to yes to have any validation
  1481.    #checksum-checks: auto
  1482.    # BPF filter to apply to this interface. The pcap filter syntax apply here.
  1483.    #bpf-filter: port 80 or udp
  1484.  #- interface: eth3
  1485.    #threads: auto
  1486.    #copy-mode: tap
  1487.    #copy-iface: eth2
  1488.    # Put default values here
  1489.  - interface: default
  1490.  
  1491. # PF_RING configuration. for use with native PF_RING support
  1492. # for more info see http://www.ntop.org/products/pf_ring/
  1493. #pfring:
  1494. #  - interface: eth0
  1495. #    # Number of receive threads (>1 will enable experimental flow pinned
  1496. #    # runmode)
  1497. #    threads: 1
  1498. #
  1499. #    # Default clusterid.  PF_RING will load balance packets based on flow.
  1500. #    # All threads/processes that will participate need to have the same
  1501. #    # clusterid.
  1502. #    cluster-id: 99
  1503. #
  1504. #    # Default PF_RING cluster type. PF_RING can load balance per flow.
  1505. #    # Possible values are cluster_flow or cluster_round_robin.
  1506. #    cluster-type: cluster_flow
  1507. #    # bpf filter for this interface
  1508. #    #bpf-filter: tcp
  1509. #    # Choose checksum verification mode for the interface. At the moment
  1510. #    # of the capture, some packets may be with an invalid checksum due to
  1511. #    # offloading to the network card of the checksum computation.
  1512. #    # Possible values are:
  1513. #    #  - rxonly: only compute checksum for packets received by network card.
  1514. #    #  - yes: checksum validation is forced
  1515. #    #  - no: checksum validation is disabled
  1516. #    #  - auto: suricata uses a statistical approach to detect when
  1517. #    #  checksum off-loading is used. (default)
  1518. #    # Warning: 'checksum-validation' must be set to yes to have any validation
  1519. #    #checksum-checks: auto
  1520. #  # Second interface
  1521. #  #- interface: eth1
  1522. #  #  threads: 3
  1523. #  #  cluster-id: 93
  1524. #  #  cluster-type: cluster_flow
  1525. #  # Put default values here
  1526. #  - interface: default
  1527. #    #threads: 2
  1528.  
  1529. # For FreeBSD ipfw(8) divert(4) support.
  1530. # Please make sure you have ipfw_load="YES" and ipdivert_load="YES"
  1531. # in /etc/loader.conf or kldload'ing the appropriate kernel modules.
  1532. # Additionally, you need to have an ipfw rule for the engine to see
  1533. # the packets from ipfw.  For Example:
  1534. #
  1535. #   ipfw add 100 divert 8000 ip from any to any
  1536. #
  1537. # The 8000 above should be the same number you passed on the command
  1538. # line, i.e. -d 8000
  1539. #
  1540. ipfw:
  1542.   # Reinject packets at the specified ipfw rule number.  This config
  1543.   # option is the ipfw rule number AT WHICH rule processing continues
  1544.   # in the ipfw processing system after the engine has finished
  1545.   # inspecting the packet for acceptance.  If no rule number is specified,
  1546.   # accepted packets are reinjected at the divert rule which they entered
  1547.   # and IPFW rule processing continues.  No check is done to verify
  1548.   # this will rule makes sense so care must be taken to avoid loops in ipfw.
  1549.   #
  1550.   ## The following example tells the engine to reinject packets
  1551.   # back into the ipfw firewall AT rule number 5500:
  1552.   #
  1553.   # ipfw-reinjection-rule-number: 5500
  1554.  
  1555.  
  1556. napatech:
  1557.    # The Host Buffer Allowance for all streams
  1558.     # (-1 = OFF, 1 - 100 = percentage of the host buffer that can be held back)
  1559.     hba: -1
  1560.  
  1561.     # use_all_streams set to "yes" will query the Napatech service for all configured
  1562.     # streams and listen on all of them. When set to "no" the streams config array
  1563.     # will be used.
  1564.     use-all-streams: yes
  1565.  
  1566.     # The streams to listen on
  1567.     streams: [1, 2, 3]
  1568.  
  1569. # Tilera mpipe configuration. for use on Tilera TILE-Gx.
  1570. mpipe:
  1572.   # Load balancing modes: "static", "dynamic", "sticky", or "round-robin".
  1573.   load-balance: dynamic
  1574.  
  1575.   # Number of Packets in each ingress packet queue. Must be 128, 512, 2028 or 65536
  1576.   iqueue-packets: 2048
  1577.  
  1578.   # List of interfaces we will listen on.
  1579.   inputs:
  1580.   - interface: xgbe2
  1581.   - interface: xgbe3
  1582.   - interface: xgbe4
  1583.  
  1584.  
  1585.   # Relative weight of memory for packets of each mPipe buffer size.
  1586.   stack:
  1587.     size128: 0
  1588.     size256: 9
  1589.     size512: 0
  1590.     size1024: 0
  1591.     size1664: 7
  1592.     size4096: 0
  1593.     size10386: 0
  1594.     size16384: 0
  1595.  
  1596. ##
  1597. ## Hardware accelaration
  1598. ##
  1599.  
  1600. # Cuda configuration.
  1601. cuda:
  1602.  # The "mpm" profile.  On not specifying any of these parameters, the engine's
  1603.   # internal default values are used, which are same as the ones specified in
  1604.   # in the default conf file.
  1605.   mpm:
  1606.    # The minimum length required to buffer data to the gpu.
  1607.     # Anything below this is MPM'ed on the CPU.
  1608.     # Can be specified in kb, mb, gb.  Just a number indicates it's in bytes.
  1609.     # A value of 0 indicates there's no limit.
  1610.     data-buffer-size-min-limit: 0
  1611.     # The maximum length for data that we would buffer to the gpu.
  1612.     # Anything over this is MPM'ed on the CPU.
  1613.     # Can be specified in kb, mb, gb.  Just a number indicates it's in bytes.
  1614.     data-buffer-size-max-limit: 1500
  1615.     # The ring buffer size used by the CudaBuffer API to buffer data.
  1616.     cudabuffer-buffer-size: 500mb
  1617.     # The max chunk size that can be sent to the gpu in a single go.
  1618.     gpu-transfer-size: 50mb
  1619.     # The timeout limit for batching of packets in microseconds.
  1620.     batching-timeout: 2000
  1621.     # The device to use for the mpm.  Currently we don't support load balancing
  1622.     # on multiple gpus.  In case you have multiple devices on your system, you
  1623.     # can specify the device to use, using this conf.  By default we hold 0, to
  1624.     # specify the first device cuda sees.  To find out device-id associated with
  1625.     # the card(s) on the system run "suricata --list-cuda-cards".
  1626.     device-id: 0
  1627.     # No of Cuda streams used for asynchronous processing. All values > 0 are valid.
  1628.     # For this option you need a device with Compute Capability > 1.0.
  1629.     cuda-streams: 2
  1630.  
  1631. ##
  1632. ## Include other configs
  1633. ##
  1634.  
  1635. # Includes.  Files included here will be handled as if they were
  1636. # inlined in this configuration file.
  1637. #include: include1.yaml
  1638. #include: include2.yaml
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!