mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
149 lines
3.9 KiB
ReStructuredText
149 lines
3.9 KiB
ReStructuredText
Command Line Options
|
|
====================
|
|
|
|
.. toctree::
|
|
|
|
Suricata's command line options:
|
|
|
|
.. option:: -h
|
|
|
|
Display a brief usage overview.
|
|
|
|
.. option:: -V
|
|
|
|
Displays the version of Suricata.
|
|
|
|
.. option:: -c <path>
|
|
|
|
Select suricata.yaml configuration file.
|
|
|
|
.. option:: -i <interface>
|
|
|
|
After the -i option you can enter the interface card you would like
|
|
to use to sniff packets from. This option will try to use the best
|
|
capture method available.
|
|
|
|
.. option:: -v
|
|
|
|
The -v option enables more verbosity of Suricata's output. Supply
|
|
multiple times for more verbosity.
|
|
|
|
.. option:: -r <filename.pcap>
|
|
|
|
After the -r option you can enter the path to the pcap-file in
|
|
which packets are recorded. That way you can inspect the packets in
|
|
that file in the pcap/offline mode.
|
|
|
|
.. option:: -s <filename.rules>
|
|
|
|
With the -s option you can set a file with signatures, which will
|
|
be loaded together with the rules set in the yaml.
|
|
|
|
.. option:: -S <filename.rules>
|
|
|
|
With the -S option you can set a file with signatures, which will
|
|
be loaded exclusively, regardless of the rules set in the yaml.
|
|
|
|
.. option:: -l <directory>
|
|
|
|
With the -l option you can set the default log directory. If you
|
|
already have the default-log-dir set in yaml, it will not be used
|
|
by Suricata if you use the -l option. It will use the log dir that
|
|
is set with the -l option. If you do not set a directory with
|
|
the -l option, Suricata will use the directory that is set in yaml.
|
|
|
|
.. option:: -D
|
|
|
|
Normally if you run Suricata on your console, it keeps your console
|
|
occupied. You can not use it for other purposes, and when you close
|
|
the window, Suricata stops running. If you run Suricata as deamon
|
|
(using the -D option), it runs at the background and you will be
|
|
able to use the console for other tasks without disturbing the
|
|
engine running.
|
|
|
|
.. option:: --runmode <runmode>
|
|
|
|
With the --runmode option you can set the runmode that you would
|
|
like to use. This command line option can override the yaml
|
|
runmode option.
|
|
|
|
Runmodes are: workers, autofp and single.
|
|
|
|
For more information about runmodes see: :doc:`performance/runmodes`
|
|
|
|
.. option:: --build-info
|
|
|
|
Gives an overview of the configure and build options that were
|
|
supplied to Suricata's build process at compile time.
|
|
|
|
Capture Options
|
|
~~~~~~~~~~~~~~~
|
|
|
|
.. option:: --af-packet
|
|
.. option:: --af-packet=<device>
|
|
|
|
Enable capture of packet using AF_PACKET on Linux. If no device is
|
|
supplied, the list of devices from the af-packet section in the
|
|
yaml is used.
|
|
|
|
.. option:: --netmap
|
|
.. option:: --netmap=<device>
|
|
|
|
Enable capture of packet using NETMAP on FreeBSD or Linux. If no
|
|
device is supplied, the list of devices from the netmap section
|
|
in the yaml is used.
|
|
|
|
Advanced Options
|
|
~~~~~~~~~~~~~~~~
|
|
|
|
.. option:: --dump-config
|
|
|
|
Displays a list of key value pairs with Suricata's configuration.
|
|
|
|
.. option:: --set <key>=<value>
|
|
|
|
Override any configuration option.
|
|
|
|
.. option:: --list-app-layer-protos
|
|
|
|
List supported app layer protocols.
|
|
|
|
.. option:: --list-keywords[=all|csv|<kword>]
|
|
|
|
List keywords implemented by the engine
|
|
|
|
.. option:: --list-runmodes
|
|
|
|
The option --list-runmodes lists all possible runmodes.
|
|
|
|
Unit Tests
|
|
~~~~~~~~~~
|
|
|
|
Builtin unittests are only available if Suricata has been built with
|
|
--enable-unittests.
|
|
|
|
Running unittests does not take a configuration file. Use -l to supply
|
|
an output directory.
|
|
|
|
.. option:: -u
|
|
|
|
With the -u option you can run unit tests to test Suricata's code.
|
|
|
|
.. option:: -U <regex>
|
|
|
|
With the -U option you can select which of the unit tests you want
|
|
to run. This option uses REGEX. Example of use: suricata -u -U
|
|
http
|
|
|
|
.. option:: --list-unittests
|
|
|
|
The --list-unittests option shows a list with all possible unit
|
|
tests.
|
|
|
|
.. option:: --fatal-unittests
|
|
|
|
With the --fatal-unittests option you can run unit tests but it
|
|
will stop immediately after one test fails so you can see directly
|
|
where it went wrong.
|
|
|