Comments on: Compiling Suricata 0.9.0 in Ubuntu Lucid 10.04 in IPS (inline) mode

By: jackwssp

jackwssp — Tue, 22 Jun 2010 18:45:26 +0000

# /usr/bin/suricata -c /etc/suricata/suricata.yaml -D -q 0
[6660] 22/6/2010 — 18:44:16 – (suricata.c:354) (main) — This is Suricata version 0.9.1
[6660] 22/6/2010 — 18:44:16 – (util-cpu.c:167) (UtilCpuPrintSummary) — CPUs Summary:
[6660] 22/6/2010 — 18:44:16 – (util-cpu.c:169) (UtilCpuPrintSummary) — CPUs online: 2
[6660] 22/6/2010 — 18:44:16 – (util-cpu.c:171) (UtilCpuPrintSummary) — CPUs configured 2

By: Victor Julien

Victor Julien — Mon, 21 Jun 2010 07:18:21 +0000

Does Suricata report an error? Start without the -D option to see what it reports.

By: jackwssp

jackwssp — Sat, 19 Jun 2010 09:53:25 +0000

Hey, bro, where is my comment?

By: jackwssp

jackwssp — Fri, 18 Jun 2010 19:09:37 +0000

Suricata 0.9.2rc3, compiled like this:

CFLAGS=”-O3 -march=i486 -mtune=i686″ \
./configure –prefix=/usr –enable-unified-native-timeval –enable-nfqueue –build=i486-Slackware-linux “$@”
make
make install DESTDIR=$TMP

try to configure iptables by this way:

iptables -t mangle -A PREROUTING -j NFQUEUE –queue-num 0
iptables -t mangle -A FORWARD -j NFQUEUE –queue-num 0
iptables -t mangle -A OUTPUT -j NFQUEUE –queue-num 0

do not work

By: jackwssp

jackwssp — Fri, 18 Jun 2010 18:44:05 +0000

Look, i try this,

/usr/bin/suricata -c /etc/suricata/suricata.yaml -D -q 0

with this

iptables -t raw -A PREROUTING -j NFQUEUE –queue-num 0
iptables -t raw -A OUTPUT -j NFQUEUE –queue-num 0

and it wantnt work, but snort works well.

For example, this rule doesnt work:
local.rules:
drop tcp any any any any (msg:”DROP ALL”; content:”google.com”; sid:3000010;)