SURICATASC(1)

📦
version 8.0.8 · 12 versions
, in alpine 3.24

💅 SURICATASC(1) — the Suricata socket-control girlies' guide 🎀

okay bestie, so this is suricatasc, a page from the Suricata manual set, and it's literally the tool that lets you talk to a running Suricata over a unix socket. she's giving assistant-energy, not boss-energy — she just passes your messages along ✨

🦋 NAME 🦋

suricatasc — the tool that lets you interact with Suricata via a unix socket. that's it, that's the whole vibe 🫶

🌸 SYNOPSIS 🌸

suricatasc [OPTIONS] [SOCKET]

💖 DESCRIPTION 💖

it's the Suricata socket control tool. no cap, that's what the page says and we're not gonna pretend otherwise 💅

🎀 SOCKET 🎀

  • an optional path to the Suricata unix socket 🧚

like, you can hand her a socket path if you want, but you don't have to. she's flexible like that.

✨ OPTIONS ✨

  • -v, --verbose — turns on verbose output. she'll yap more. we love a chatty icon 💬
  • -c, --command <COMMAND> — runs a command and returns JSON. that's the whole thing, bestie 🍓
  • -h, --help — prints the help. the classic. the moment. 👑

👑 COMMANDS 👑

this is the main character section, lowkey. here's every single one:

  • shutdown — shuts the Suricata instance down. like, fully down. bye bestie 😭
  • command-list — lists the available commands. a menu of possibilities 💅
  • help — gets help about the available commands. meta, honestly 🌀
  • version — prints the version of the Suricata instance 🌈
  • uptime — displays the uptime of Suricata ⏰
  • running-mode — displays the running mode. this can be either workers, autofp or single 🏃‍♀️
  • capture-mode — displays the capture mode. this can be either of PCAP_DEV, PCAP_FILE, PFRING(DISABLED), NFQ, NFLOG, IPFW, ERF_FILE, ERF_DAG, AF_PACKET_DEV, NETMAP(DISABLED), UNIX_SOCKET or WINDIVERT(DISABLED) 🔍
  • conf-get <variable> — gets the configuration value for a given variable. the variable you provide can be either of the configuration parameters that are written in suricata.yaml 📝
  • dump-counters — dumps Suricata's performance counters 📊
  • ruleset-reload-rules — reloads the ruleset and waits for completion. patient queen ⏳
  • reload-rules — alias .. describe ruleset-reload-rules. (yes, that's literally what the page says, we're keeping it, it's iconic in its own way 🙈)
  • ruleset-reload-nonblocking — reloads the ruleset and proceeds without waiting. no thoughts, head empty, moving on 💨
  • ruleset-reload-time — returns the time of the last reload 🕰️
  • ruleset-stats — displays the number of rules loaded and failed 📈
  • ruleset-failed-rules — displays the list of failed rules 💀
  • register-tenant-handler <id> <htype> [hargs] — registers a tenant handler with the specified mapping 🗂️
  • unregister-tenant-handler <id> <htype> [hargs] — unregisters a tenant handler with the specified mapping 🗑️
  • register-tenant <id> <filename> — registers a tenant with a particular ID and filename 🏷️
  • reload-tenant <id> [filename] — reloads a tenant with the specified ID. a filename to a tenant yaml can be specified. if it's omitted, the original yaml that was used to load / last reload the tenant is used 🔄
  • reload-tenants — reloads all registered tenants by reloading their yaml 🫶
  • unregister-tenant <id> — unregisters the tenant with a particular ID ✂️
  • add-hostbit <ipaddress> <hostbit> <expire> — adds a hostbit on a host IP with a particular bit name and time of expiry 📌
  • remove-hostbit <ipaddress> <hostbit> — removes the hostbit on a host IP with the specified IP address and bit name 🧹
  • list-hostbit <ipaddress> — lists hostbit for a particular host IP 📋
  • reopen-log-files — reopens log files, to be run after external log rotation 🔁
  • memcap-set <config> <memcap> — updates the memcap value of a specified item 🧮
  • memcap-show <config> — shows the memcap value of a specified item 👀
  • memcap-list — lists all memcap values available 🗒️
  • get-flow-stats-by-id <flow_id> — displays information for a specific flow using flow_id values 🌊

🦋 PCAP MODE COMMANDS 🦋

different mode, different rules, same icon energy ⭐

  • pcap-file <file> <dir> [tenant] [continuous] [delete-when-done] — adds pcap files to Suricata for sequential processing. the generated log/alert files will be put into the directory specified as the second argument. make sure to provide absolute path to the files and directory. and ngl, it's acceptable to add multiple files without waiting for the result 👯‍♀️
  • pcap-file-continuous <file> <dir> [tenant] [delete-when-done] — adds pcap files to Suricata for sequential processing. the directory will be monitored for new files being added, until there is a use of pcap-interrupt or the directory is moved or deleted 👀
  • pcap-file-number — number of pcap files waiting to get processed 🔢
  • pcap-file-list — list of queued pcap files 📃
  • pcap-last-processed — processed time of last file in milliseconds since epoch ⏱️
  • pcap-interrupt — terminates the current state by interrupting directory processing 🛑
  • pcap-current — currently processed file 🎯

💀 BUGS 💀

found a bug? want a feature? please visit Suricata's support page for information about submitting bugs or feature requests 🫶 (we're not listing it here, it's coming in NOTES, keep reading bestie)

🌸 NOTES 🌸

2016-2026, OISF

lowkey a whole legal moment, but periodt, credit where credit is due 👑

anyway that's the whole page, you ate that, go talk to your socket and slay 💖✨

this gem is version 8.0.8, dated 2026-10-29, brought to you by OISF — mwah, love u, bye 🫶💅🌷

📦 where this page comes from