FreeBSD 8, 9, 10 & 11¶
Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation.
Make sure you enter all commands as root/super-user, otherwise it will not work.
For FreeBSD 8:
pkg_add -r autoconf262 automake19 gcc45 libyaml pcre libtool \ libnet11 libpcap gmake
For FreeBSD 9.0:
pkg_add -r autoconf268 automake111 gcc libyaml pcre libtool \ libnet11 libpcap gmake
For FreeBSD 10.0:
pkg install pkgconf-0.9.5 libyaml-0.1.6 pcre-8.34_1 libnet-1.1.6_1,1
For FreeBSD 11:
pkg install libtool autoconf automake pkgconf pcre libyaml libnet
If you are building from git and wish to generate PDF documentation, you will also require:pkg install py27-sphinx tex-dvipsk tex-formats
Depending on the current status of your system, it may take a while to complete this process.
HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library installation.
If you would like to build suricata on FreeBSD with IPS capabilities with IPFW via --enable-ipfw, enter the following to enable ipfw and divert socket support before starting the engine with -d:
Edit /etc/rc.conf and add or modify the following lines:
Edit /boot/loader.conf and add or modify the following lines:
ipfw_load="YES" ipfw_nat_load="YES" ipdivert_load="YES" dummynet_load="YES" libalias_load="YES"
To download and build Suricata, enter the following:
wget http://www.openinfosecfoundation.org/download/suricata-3.1.tar.gz tar -xvzf suricata-3.1.tar.gz cd suricata-3.1
If you are building from Git sources, enter all the following commands until the end of this file:
If you are not building from Git sources, do not enter the above mentioned commands. Continue entering the following:
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var make make install zerocopy bpf mkdir /var/log/suricata/
FreeBSD 8 has support for zerocopy bpf in libpcap. To test this functionality, issue the following command and then start/restart the engine:
You can also use the available auto setup features of Suricata.
To install Suricata and automatically create/setup all the necessary directories and suricata.yaml, enter:
./configure && make && make install-conf
If you would like to install Suricata and automatically download and set up the latest ruleset from Emerging Threats available for Suricata, enter:
./configure && make && make install-rules
To combine everything mentioned above (install-conf and install-rules) - and have a ready to run (configured and set up) Suricata:
./configure && make && make install-full
Please continue with the Basic Setup.