suricata+pfring安装部署

1. 安装suricata前依赖安装

sudo yum -y install gcc libpcap-devel pcre-devel libyaml-devel file-devel \
  zlib-devel jansson-devel nss-devel libcap-ng-devel libnet-devel tar make \
  libnetfilter_queue-devel lua-devel PyYAML libmaxminddb-devel rustc cargo \
  lz4-devel  readline-devel 

2.安装pfring

git clone https://github.com/ntop/PF_RING.git
cd PF_RING/
make    //直接在跟目录下面make,进行全部编译

cd PF_RING/kernel
make
make install 

cd ../userland/lib
./configure
make
make install

sudo modprobe pf_ring
modinfo pf_ring && cat /proc/net/pf_ring/info

3.安装luajit

• mkdir -p /opt/openresty

• 上传lua库https://download.csdn.net/download/yztezhl/84836060

• tar -xzvf openresty-1.9.7.4.tar.gz

• mv openresty-1.9.7.4 openresty

• cd openresty/bundle/lua-5.1.5/

make linux test 
make install

• cd openresty/bundle/LuaJIT-2.1-20160108/

make
make install

• cd openresty/bundle/lua-cjson-2.1.0.3/

make 
make install

luajit安装完成后

使用https://download.csdn.net/download/yztezhl/84836430第三方lua库就可以直接向kafka消息，但前提是要安装yum install -y librdkafka-devel

unzip luardkafka-master.zip
cd  luardkafka-master
cp -r rdkafka/ /usr/local/share/lua/5.1/

4.安装suricata

• git clone https://github.com/OISF/suricata.git
• cd suricata
• git checkout 787473ec64550a2448b81aa13064c1f613642c57
• git clone https://github.com/OISF/libhtp

chmod +x libhtp/get-version.sh 
sh autogen.sh
./configure --enable-rust=no -enable-gccmarch-native=no --enable-rdkafka  --prefix=/usr   --sysconfdir=/etc \ 
 --localstatedir=/var \
--enable-pfring --with-libpfring-includes=/usr/local/include --with-libpfring-libraries=/usr/local/lib \
--enable-luajit  --with-libluajit-includes=/usr/local/include/luajit-2.1/ --with-libluajit-libraries=/usr/local/lib/
make
make install
ldconfig
make install-full

• 配置suricata.yaml

• 安装完成启动 suricata --pfring-int=ens3f0 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow -c /etc/suricata/suricata.yaml #ens3f0 网卡

启动参数及suricata手册见5. 命令行选项 — Suricata 7.0.0-dev 文档