SURICATA(1)

📦
version 8.0.8 · 12 versions
, in alpine 3.24

💖 SURICATA(1) — the suricata girlie's manual 💖

okay so welcome to the Suricata man page, bestie 🦋 this is SURICATA(1) from the Suricata manual, and we're gonna get you comfy with it, no cap.

✨ NAME ✨

suricata — literally Suricata, that's the name, that's the vibe 💅

🌸 SYNOPSIS 🌸

suricata [OPTIONS] [BPF FILTER]

so you run suricata, you can throw OPTIONS at it, and you can hand it a BPF FILTER if you're feeling fancy 🎀

👑 DESCRIPTION 👑

okay so suricata is a high performance Network IDS, IPS and Network Security Monitoring engine 🔥 like, it's the main character of network security fr fr.

It's Open Source and it's owned by a community run non-profit foundation — the Open Information Security Foundation (OISF) 🫶 iconic behaviour, honestly.

suricata can be used to analyze live traffic and pcap files ✨ and it can generate alerts based on rules — yes bestie, rules, like the rules you write. On top of that, suricata will generate traffic logs 🌈 so you get the receipts.

When you're using it with live traffic, suricata can be passive or active 👀. The active modes are:

  • inline in a L2 bridge setup 🌉
  • inline with L3 integration with a host firewall — that's NFQ, IPFW, WinDivert 💅
  • out of band using active responses 🎀
ngl this is just part one, bestie — there's more coming, so don't go anywhere 💖

✨ OPTIONS ✨

okay bestie, this is the whole command-line menu — every flag, every path, every little config gremlin. No skipping, no “you’ll figure it out,” we’re going through it together 💅

  • -h — Shows you a brief usage overview. A little hello, but make it flags 🎀
  • -V — Displays the version of Suricata.
  • -c <path> — Path to the configuration file.
  • --include <path> — Extra configuration files to include. You can provide multiple additional configuration files, and they’ll be included in the order specified on the command line. These additional configuration files are loaded as if they existed at the end of the main configuration file. ✨

Example including one additional file:

--include /etc/suricata/other.yaml

Example including more than one additional file:

--include /etc/suricata/other.yaml --include /etc/suricata/extra.yaml
  • -T — Test configuration. Tiny vibe check for your config 🧚
  • -v — Increase the verbosity of the Suricata application logging by increasing the log level from the default. This option can be passed multiple times to further increase the verbosity.
    • -v: INFO
    • -vv: PERF
    • -vvv: CONFIG
    • -vvvv: DEBUG

This option will not decrease the log level set in the configuration file if it is already more verbose than the level requested with this option. Respect the existing drama 💅

  • -r <path> — Run in pcap offline mode (replay mode), reading files from a pcap file. If the path specifies a directory, all files in that directory will be processed in order of modified time, maintaining flow state between files. 🦋
  • --pcap-file-continuous — Used with the -r option to indicate that the mode should stay alive until interrupted. This is useful with directories to add new files and not reset flow state between files.
  • --pcap-file-recursive — Used with the -r option when the path provided is a directory. This option enables recursive traversal into subdirectories to a maximum depth of 255. This option cannot be combined with --pcap-file-continuous. Symlinks are ignored. Not the symlinks’ moment, apparently 💀
  • --pcap-file-delete — Used with the -r option to indicate that the mode should delete pcap files after they have been processed. This is useful with pcap-file-continuous to continuously feed files to a directory and have them cleaned up when done. If this option is not set, pcap files will not be deleted after processing. Cleanup queen behavior, but only if you ask 🧹
  • --pcap-file-buffer-size <value> — Set read buffer size using setvbuf to speed up pcap reading. Valid values are 0, which disables setvbuf buffering, or 4 KiB to 64 MiB. Default value is 128 KiB. Supported on Linux only. 🐧
  • -i <interface> — After the -i option you can enter the interface card you would like to use to sniff packets from. This option will try to use the best capture method available. Can be used several times to sniff packets from several interfaces. Multitasking icon behavior 💖
  • --pcap[=<device>] — Run in PCAP mode. If no device is provided, the interfaces provided in the pcap section of the configuration file will be used.
  • --af-packet[=<device>] — Enable capture of packet using AF_PACKET on Linux. If no device is supplied, the list of devices from the af-packet section in the yaml is used.
  • --af-xdp[=<device>] — Enable capture of packet using AF_XDP on Linux. If no device is supplied, the list of devices from the af-xdp section in the yaml is used.
  • -q <queue id> — Run inline of the NFQUEUE queue ID provided. May be provided multiple times.
  • -s <filename.rules> — With the -s option you can set a file with signatures, which will be loaded together with the rules set in the yaml.

It is possible to use globbing when specifying rules files. For example, -s '/path/to/rules/*.rules' ✨

  • -S <filename.rules> — With the -S option you can set a file with signatures, which will be loaded exclusively, regardless of the rules set in the yaml.

It is possible to use globbing when specifying rules files. For example, -S '/path/to/rules/*.rules' ✨

  • -l <directory> — With the -l option you can set the default log directory. If you already have the default-log-dir set in yaml, it will not be used by Suricata if you use the -l option. It will use the log dir that is set with the -l option. If you do not set a directory with the -l option, Suricata will use the directory that is set in yaml. Log directory lore 📁
  • -D — Normally if you run Suricata on your console, it keeps your console occupied. You can not use it for other purposes, and when you close the window, Suricata stops running. If you run Suricata as daemon (using the -D option), it runs at the background and you will be able to use the console for other tasks without disturbing the engine running. Background main character energy 👑
  • --runmode <runmode> — With the --runmode option you can set the runmode that you would like to use. This command line option can override the yaml runmode option.

Runmodes are: workers, autofp and single.

For more information about runmodes see Runmodes in the user guide.

  • -F <bpf filter file> — Use BPF filter from file.
  • -k [all|none] — Force (all) the checksum check or disable (none) all checksum checks.
  • --user=<user> — Set the process user after initialization. Overrides the user provided in the run-as section of the configuration file.
  • --group=<group> — Set the process group to group after initialization. Overrides the group provided in the run-as section of the configuration file.
  • --pidfile <file> — Write the process ID to file. Overrides the pid-file option in the configuration file and forces the file to be written when not running as a daemon.
  • --init-errors-fatal — Exit with a failure when errors are encountered loading signatures. No soft-launching this one, bestie 💀
  • --strict-rule-keywords[=all|<keyword>|<keywords(csv)] — Applies to: classtype, reference and app-layer-event.

By default missing reference or classtype values are warnings and not errors. Additionally, loading outdated app-layer-event events are also not treated as errors, but as warnings instead.

If this option is enabled these warnings are considered errors.

If no value, or the value 'all', is specified, the option applies to all of the keywords above. Alternatively, a comma separated list can be supplied with the keyword names it should apply to.

  • --disable-detection — Disable the detection engine.
  • --disable-hashing — Disable support for hash algorithms such as md5, sha1 and sha256.

By default hashing is enabled. Disabling hashing will also disable some Suricata features such as the filestore, ja3, and rule keywords that use hash algorithms. Important trade-off, not just a vibe shift 🫶

  • --dump-config — Dump the configuration loaded from the configuration file to the terminal and exit.
  • --dump-features — Dump the features provided by Suricata modules and exit. Features list (a subset of) the configuration values and are intended to assist with comparing provided features with those required by one or more rules.
  • --build-info — Display the build information the Suricata was built with.
  • --list-app-layer-protos — List all supported application layer protocols.
  • --list-keywords=[all|csv|<kword>] — List all supported rule keywords.
  • --list-runmodes — List all supported run modes.
  • --set <key>=<value> — Set a configuration value. Useful for overriding basic configuration parameters. For example, to change the default log directory:
--set default-log-dir=/var/tmp

This option cannot be used to add new entries to a list in the configuration file, such as a new output. It can only be used to modify a value in a list that already exists.

For example, to disable the eve-log in the default configuration file:

--set outputs.1.eve-log.enabled=no

Also note that the index values may change as the suricata.yaml is updated.

See the output of --dump-config for existing values that could be modified with their index. Indexes are giving “moveable sticker” energy, so peek before you tweak 👀

  • --engine-analysis — Print reports on analysis of different sections in the engine and exit. Please have a look at the conf parameter engine-analysis on what reports can be printed.
  • --unix-socket=<file> — Use file as the Suricata unix control socket. Overrides the filename provided in the unix-command section of the configuration file.
  • --reject-dev=<device> — Use device to send out RST / ICMP error packets with the reject keyword.
  • --pcap-buffer-size=<size> — Set the size of the PCAP buffer (0 - 2147483647).
  • --netmap[=<device>] — Enable capture of packet using NETMAP on FreeBSD or Linux. If no device is supplied, the list of devices from the netmap section in the yaml is used.
  • --pfring[=<device>] — Enable PF_RING packet capture. If no device provided, the devices in the Suricata configuration will be used.
  • --pfring-cluster-id <id> — Set the PF_RING cluster ID.
  • --pfring-cluster-type <type> — Set the PF_RING cluster type (cluster_round_robin, cluster_flow).
  • -d <divert-port> — Run inline using IPFW divert mode.
  • --dag <device> — Enable packet capture off a DAG card. If capturing off a specific stream, the stream can be selected using a device name like "dag0:4". This option may be provided multiple times read off multiple devices and/or streams.
  • --napatech — Enable packet capture using the Napatech Streams API.
  • --erf-in=<file> — Run in offline mode reading the specific ERF file (Endace extensible record format).
  • --simulate-ips — Simulate IPS mode when running in a non-IPS mode.

🧪 OPTIONS FOR DEVELOPERS 🧪

okay, dev bestie, this section is your little laboratory corner — unit tests, regex filters, coverage reports, the whole nerdy slay 🔥

  • -u — Run the unit tests and exit. Requires that Suricata be configured with --enable-unittests.
  • -U, --unittest-filter=REGEX — With the -U option you can select which of the unit tests you want to run. This option uses REGEX. Example of use: suricata -u -U http ✨
  • --list-unittests — Lists available unit tests.
  • --fatal-unittests — Enables fatal failure on a unit test error. Suricata will exit instead of continuing more tests. No “we’ll just do the next one,” it’s giving final boss 💀
  • --unittests-coverage — Display unit test coverage report.

🚦 SIGNALS 💅

okay so Suricata is out here listening to signals like a bestie who always picks up, and here's the whole tea on what each one does:

  • SIGUSR2 — this one tells Suricata to do a live rule reload, no restart, no drama, no downtime. literally just freshening up the rules mid-run, she stays serving the whole time ✨
  • SIGHUP — this makes Suricata close and re-open all log files. super useful when a log rotation utility has moved your logs somewhere else and you need her to pick up the new ones. think of it as "girl, your logs moved, go find them" 🫶

📁 FILES AND DIRECTORIES 🎀

  • /usr/local/etc/suricata/suricata.yaml — the default spot where the Suricata configuration file lives. that's home base for all your settings 💖
  • /usr/local/var/log/suricata — the default Suricata log directory. all the receipts get dropped here 👑

🌈 EXAMPLES ⭐

want live traffic from interface eno1? say less:

suricata -i eno1

want to analyze a pcap file and drop the logs in the CWD? iconic, do this:

suricata -r /path/to/capture.pcap

want to capture using AF_PACKET and override the flow memcap setting from the suricata.yaml? obsessed, here's how:

suricata --af-packet --set flow.memcap=1gb

want to analyze a pcap file with a custom rule file? yes bestie, custom rules only:

suricata -r /pcap/to/capture.pcap -S /path/to/custom.rules
ngl that last path is written exactly how the manpage has it — /pcap/to/capture.pcap — so don't come for me, I'm just the messenger 💀

🐛 BUGS 🙈

found a bug? got a feature request burning a hole in your Notes app? please visit Suricata's support page for all the info on submitting bugs or feature requests. they wanna hear from you fr fr 🫶

📝 NOTES 🦋

2016-2026, OISF — that's the whole copyright line, no cap, respect the OISF 💜

and that's the whole page bestie!! this was Suricata 8.0.8, dated 2026-10-29, and honestly? she ate. go forth and capture some packets, you absolute main character 🌸💖✨🦋

📦 where this page comes from