Ubuntu Installation from GIT

In this document will be explained how to install and use the most recent code of Suricata on Ubuntu. Installing from GIT on other operating systems is basically the same, except that some commands are Ubuntu-specific (like sudo and apt-get). In case you are using another operating system, you should replace those commands by your operating-specific commands.

Pre-installation requirements

Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation.

sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \
make libmagic-dev libjansson-dev rustc cargo jq git-core

Add ${HOME}/.cargo/bin to your path.

export PATH=$PATH:${HOME}/.cargo/bin
cargo install --force cbindgen

Depending on the current status of your system, it may take a while to complete this process.

By default, Suricata works as an IDS. If you want to use it as a IDS and IPS program, enter:

sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev libnfnetlink0


First, it is convenient to create a directory for Suricata. Name it 'suricata' for example. Open the terminal and enter:

mkdir suricata

Followed by:

cd suricata

Next, enter the following line in the terminal:

git clone
cd suricata

Libhtp is not bundled. Get libhtp by doing:
git clone

Followed by:


To configure, please enter:


To compile, please enter:


To install Suricata, enter:

sudo make install
sudo ldconfig

To install suricata-update

git clone
cd suricata-update
python build
sudo python install
sudo suricata-update

Auto setup

You can also use the available auto setup features of Suricata:


./configure && make && sudo make install-conf

make install-conf
would do the regular "make install" and then it would automatically create/setup all the necessary directories and suricata.yaml for you.

./configure && make && make install-rules

make install-rules
would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata
./configure && make && make install-full

make install-full
would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata

Please continue with Basic Setup.

In case you have already made a map for the most recent code, downloaded the code into that map, and want to download recent code again, please enter:

cd suricata/suricata

next, enter:

git pull

After that, you start again at running autogen.