suricata_usage

########################################################################
https://kifarunix.com/install-and-setup-suricata-on-ubuntu-18-04/
https://hackertarget.com/install-suricata-ubuntu-5-minutes/
https://fwhibbit.es/suricata-ids-jugando-con-las-reglas
########################################################################

## execute
suricata -c /etc/suricata/suricata.yaml -i <network interface>

## Scan a PCAP file
sudo suricata -c /etc/suricata/suricata.yaml -r ~/enternalblue.pcap

## View alert logs
tail -f /var/log/suricata/fast.log

## For ubuntu linux you can start suricata on boot

description "Intruder Detection System Daemon"
start on runlevel [2345]
stop on runlevel [!2345]
expect fork
exec suricata -D --pidfile /var/run/suricata.pid -c /etc/suricata/suricata.yaml -i eth1


## You are now ready to perform the tests However, before you can proceed, you need to disable packet offload features on the network interface on which Suricata is listen.
ethtool -K <network interface> gro off lro off