FreeBSD 8, 9, 10 & 11¶

Pre-installation requirements¶

Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation.
Make sure you enter all commands as root/super-user, otherwise it will not work.

For FreeBSD 8:

pkg_add -r autoconf262 automake19 gcc45 libyaml pcre libtool \
libnet11 libpcap gmake

For FreeBSD 9.0:

pkg_add -r autoconf268 automake111 gcc libyaml pcre libtool \
libnet11 libpcap gmake

For FreeBSD 10.0:

pkg install pkgconf-0.9.5 libyaml-0.1.6 pcre-8.34_1 libnet-1.1.6_1,1

For FreeBSD 11:

pkg install libtool autoconf automake pkgconf pcre libyaml libnet

If you are building from git and wish to generate PDF documentation, you will also require:

pkg install py27-sphinx tex-dvipsk tex-formats

Depending on the current status of your system, it may take a while to complete this process.

HTP

HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library installation.

IPS

If you would like to build suricata on FreeBSD with IPS capabilities with IPFW via --enable-ipfw, enter the following to enable ipfw and divert socket support before starting the engine with -d:

Edit /etc/rc.conf and add or modify the following lines:

firewall_enable="YES" 
firewall_type="open" 

Edit /boot/loader.conf and add or modify the following lines:

ipfw_load="YES" 
ipfw_nat_load="YES" 
ipdivert_load="YES" 
dummynet_load="YES" 
libalias_load="YES" 

Suricata¶

To download and build Suricata, enter the following:

wget http://www.openinfosecfoundation.org/download/suricata-3.1.tar.gz
tar -xvzf suricata-3.1.tar.gz
cd suricata-3.1

If you are building from Git sources, enter all the following commands until the end of this file:

bash autogen.sh

If you are not building from Git sources, do not enter the above mentioned commands. Continue entering the following:

./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make
make install
zerocopy bpf
mkdir /var/log/suricata/

FreeBSD 8 has support for zerocopy bpf in libpcap. To test this functionality, issue the following command and then start/restart the engine:

sysctl net.bpf.zerocopy_enable=1

Auto setup¶

You can also use the available auto setup features of Suricata.

To install Suricata and automatically create/setup all the necessary directories and suricata.yaml, enter:

./configure && make && make install-conf

If you would like to install Suricata and automatically download and set up the latest ruleset from Emerging Threats available for Suricata, enter:

./configure && make && make install-rules

To combine everything mentioned above (install-conf and install-rules) - and have a ready to run (configured and set up) Suricata:

./configure && make && make install-full

Please continue with the Basic Setup.