Mac OS X 10.11 El Capitan with Homebrew.

This installation guide should be valid for the following:
  • Suricata 3.2.1 on 10.12 (Sierra) w/Homebrew
  • Suricata 3.0 on 10.11 w/Homebrew
  • Suricata 2.0.11 on 10.11 w/Homebrew
  • Suricata 3.0 on 10.10 w/Homebrew
  • Suricata 2.0.11 on 10.10 w/Homebrew

Pre-Installation Requirements

  • XCode and Homebrew are installed and working. Head over to for more information on installing Homebrew.
  • Install dependencies:
    brew install pkg-config libmagic libyaml nss nspr jansson libnet lua pcre
  • Download and Extract Suricata
    curl -O
    tar zxvf suricata-3.1.tar.gz
    cd suricata-3.1

Building Suricata


CC=llvm-gcc ./configure --sysconfdir=/etc --localstatedir=/var \
  --with-libpcre-includes=/usr/local/include --with-libpcre-libraries=/usr/local/lib \
  --with-libnss-includes=/usr/local/opt/nss/include/nss --with-libnss-libraries=/usr/local/opt/nss/lib \
  --with-libnspr-includes=/usr/local/opt/nspr/include/nspr --with-libnspr-libraries=/usr/local/opt/nspr/lib \
  --enable-ipfw --enable-lua

Make and install:


sudo make install

To install the default configuration files:

make install-conf

To install with an initial set of ET Open rule files:

make install-full

Required Configuration Fixup

Versions 3.0 and earlier require a modification to the suricata.yaml before running Suricata. The following line in the configuration file must be commented out or removed:

magic-file: /usr/share/file/magic

Please continue with the Basic Setup.