mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
35 lines
1.1 KiB
Markdown
35 lines
1.1 KiB
Markdown
1 year ago
|
# Napatech Plugin Capture Plugin
|
||
|
|
|
||
|
|
## Building
|
||
|
|
|
||
|
|
To build this plugin, configure Suricata with the `--enable-napatech` and
|
||
|
|
optionally the `--with-napatech-includes` and
|
||
|
|
`--with-napatech-libraries` command line options.
|
||
|
|
|
||
|
|
## Running
|
||
|
|
```
|
||
|
|
/usr/local/suricata/bin/suricata \
|
||
|
|
--set plugins.0=/usr/local/lib/suricata/napatech.so \
|
||
|
|
--capture-plugin=napatech
|
||
|
|
```
|
||
|
|
|
||
|
|
### --set plugins.0=/usr/local/lib/suricata/napatech.so
|
||
|
|
|
||
|
|
This command line option tells Suricata about this plugin. This could also
|
||
|
|
be done in `suricata.yaml` with the following section:
|
||
|
|
```
|
||
|
|
plugins:
|
||
|
|
- /usr/local/lib/suricata/napatech.so
|
||
|
|
```
|
||
|
|
|
||
|
|
### --capture-plugin=napatech
|
||
|
|
|
||
|
|
This is the option that tells Suricata to use a plugin for capture, much like
|
||
|
|
`--pcap` tells Suricata to use libpcap or `--af-packet` tells Suricata to use
|
||
|
|
AF_PACKET. Here we are telling it to look for a loaded plugin of the name
|
||
|
|
`napatech` to provide the capture method.
|
||
|
|
|
||
|
|
There is another command line option `--capture-plugin-args` to pass arbitrary
|
||
|
|
data on the command line to a capture plugin, but this plugin does not yet handle
|
||
|
|
data provided through this command line parameter.
|