Windows Installation Guide for Suricata

IDS/IPS

This is a Suircata Windows Installation Guide –

Compilation from scratch.

Tested on Win XP, Windows Vista, Windows 7, Windows Server 2003, Windows
Server 2008R2 64 bit.

Date: 26 May 2012

Document Version: 1.3

Author: Peter Manev

1|Page
SECTION I - ADVANCED USERS 4

Step 1 – You need to download and install Cygwin 4

Step 2 – Make sure you have WinPcap installed. 5

Step 3 Add some paths to the system path. 6

Step 4 Get libyaml 6

Step 5 Get and compile Suricata. 6

Suricata from git: 7
Suricata Stable (at the moment of this writing the stable version is 1.2.1): 7

Ste 5.1 – MD5 support 8

For stable - 8
For git – 8

Step 6 Configure and run Suricata 10

SECTION II - STEP BY STEP FOR NEWBIE 13

Step 1 Download Cygwin 13

Step 2 Install extra packages 24

Step 3 Add paths to system variables 30

Step 4 Get libyaml 33

Step 5 Get libpcap – for windows 33

Step 6 Start Cygwin and compile yaml 34

Step 7 Compile Suricata 39

Step 7.1 – Suricata from git – latest version 39
Step 7.2 Suricata stable 43

Step 8 Set up Suricata for Windows 45

Step 9 Runing Suricata 50

2|Page
MORE INFO AND DOCUMENTATION 52

3|Page
This is a guide of how to compile and come up with your own executable/binary of Suricata on
Windows. If you do not want to do that – there is a auto installation (MSI) windows native
package here:

[Link]

just run it and it will install Suricata for you on your Windows system.

This guide consists of two sections.

Section I – is for advanced users, a quick overview of what needs to be done. If you have had
experience with Cygwin and Suricata before, this section should be enough. Should you feel you
need a bit more details, please jump to Section II.

Section II – is a step by step guide and detailed instructions on how to install and configure
Suricata on Windows OS, for newbies.

SECTION I - Advanced users

Step 1 – You need to download and install Cygwin

Download Cygwin – [Link]

After the installation is done you would need to add the packages below to your Cygwin
installation - needed for Suricata to run.

4|Page
w32api, mpfr, pthreads, gcc-core , gcc4-core , make , zlib , autoconf , automake , libtool , glib ,
pkg-config , pkg-config , git .

Or in a bit more detail:

Step 2 – Make sure you have WinPcap installed.

[Link]

You would also need to download and unzip (anywhere you like) the devs pkgs of WinPcap

[Link]

Copy libraries (from the unpacked directory) like this:

5|Page
  Copy all the content of WpdPack\Lib\ to cygwin\lib\
 Copy all headers (all the content)from WpdPack\Include\ to C:\cygwin\usr\include\
 Rename “libwpcap” to “libpcap” (in your cygwin\lib\ directory)

Step 3 Add some paths to the system path.

Add to system path (Win 7, 2008 - Control Panel\System and Security\System\Advanced system
settings\Environment Variables), select “path” under “system variables”, click “edit”, append
the following to the end:

C:\cygwin\bin;C:\cygwin\lib\pkgconfig;

Add the above to environment system variables in your windows system!!

Step 4 Get libyaml

Download the yaml package (at the time of this writing the current version is [Link])

[Link]

Unpack it in (for example in your Cygwin tmp directory) - C:\cygwin\tmp

Start Cygwin, go to the yaml directory then execute –

./configure --prefix=/usr && make && make install

Step 5 Get and compile Suricata.

As you are still in the CYGWIN environment -

6|Page
Suricata from git:
If you want to install Suricata from git – latest version

go to a tmp dir. Type in :

a) git clone git://[Link]/[Link]

b) cd oisf

c) [Link] libhtp/[Link] && [Link] libhtp/[Link] && [Link]

libhtp/[Link]
d) ./[Link] && ./configure && make

Suricata Stable (at the moment of this writing the stable version is 1.2.1):
If you want to install Suricata stable – latest stable version (production)

(You can find it here - [Link] )

go to a tmp dir. Type in :

a) wget [Link]
b) tar –zxf [Link]
c) cd suricata-1.2.1

d) [Link] libhtp/[Link] && [Link] libhtp/[Link] && [Link]

libhtp/[Link]
e) libtoolize -c && autoreconf -fv --install && ./configure && make

7|Page
Ste 5.1 – MD5 support
OPTIONALLY – if you would like to compile Suricata with MD5s support ()to be able to log
MD5s on opened/downloaded/transferred files coming through the wire- you must compile
like this –

Make sure you add the following for Cygwin:

Then -

For stable -
libtoolize -c && autoreconf -fv --install && ./configure --with-libnss-libraries=/usr/lib --with-
libnss-includes=/usr/include/nss/ --with-libnspr-libraries=/usr/lib --with-libnspr-
includes=/usr/include/nspr && make

For git –
./[Link] && ./configure --with-libnss-libraries=/usr/lib --with-libnss-
includes=/usr/include/nss/ --with-libnspr-libraries=/usr/lib --with-libnspr-
includes=/usr/include/nspr && make

Make sure you add the following DLLs to the directory where you will run suricata (copy them
from the Cygwin\bin directory):

[Link]

8|Page
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

Then continue with the instructions below (the bellow mentioned DLLs are also needed), just
substitute the oisf directory with suricata-1.2.1 directory!

After it is done, go to your /oisf/src/.lib (or /suricata-1.2.1/src/.lib for Suricata stable) directory
and copy the [Link] file to a dedicated directory, for example –C:\Suricata

Also - copy [Link] , [Link] and [Link] (form your oisf/ directory)
to (your dedicated directory) C:\Suricata

NOTE: If you would like to make a standalone installation, copy (from C:\cygwin\bin)
[Link]

[Link]

[Link]

[Link]

9|Page
cyggcc_s-[Link]

[Link]

[Link]

to your C:\Suricata directory

Also copy C:\cygwin\usr\share\misc\[Link] to your C:\Suricata directory

Step 6 Configure and run Suricata

…run intruders…run….

Download some rule sets and copy them to your rules directory.

Edit your [Link] - (for example, at least change these lines and create the necessary
folders respectively):

”default-log-dir: C:\Suricata\log

………

- file:

enabled: yes

filename: C:\Suricata\[Link]

……….

default-rule-path: C:\Suricata\rules\

10 | P a g e
classification-file: C:\Suricata\[Link]”

Open a cmd.

cd to your Suricata directory , execute –

[Link] -c [Link] -i [Link]

change [Link] with your respective IP and you are done.

NOTE:

If you need to run Suricata on an un-ip'd interfaces(thanks to Rich Rumble for pointing that
out):

You can get the NIC UUID in a variety of ways, the simplest is using a single command for
WMIC:(from cmd prompt paste in the following)

wmic nicconfig get ipaddress,SettingID

If you know your NIC's IP you can filter the results with findstr:

wmic nicconfig get ipaddress,SettingID | findstr [Link]

(replace [Link] with your NIC's IP)

Then use that as your interface argument:

[Link] -c [Link] –i \\DEVICE\\NPF_\{EE7B2A76-9343-449F-B3D8-3CB0F37DCA49\}

Make sure the double slashes are used, and a backslash is placed before the curly braces!

11 | P a g e
12 | P a g e
SECTION II - Step By Step for newbie

The following installations instructions were executed on Windows Server 2008R2 64 bit.

About 500 -600MB of space needed in total with all the necessary prerequisites installed.

Step 1 Download Cygwin

[Link]

Then double click the [Link] to install

Go ahead and install it with the default options (basically just click next and ok)

13 | P a g e
 Pic1

14 | P a g e
 Pic2

15 | P a g e
 Pic3

16 | P a g e
 Pic4

17 | P a g e
 Pic5

Here , select any mirror you want:

18 | P a g e
 Pic6

Then you are going to see a progress bar:

19 | P a g e
 Pic7

You might get a warning if you already have installed CYGWIN – this is a guide for an installation
from scratch :

20 | P a g e
 Pic8

Click next:

21 | P a g e
 Pic9

Then CYGWIN will start downloading and installing the necessary packages:

22 | P a g e
 Pic10

It will probably take 10-15 min.

After it is finished - click finish  :

23 | P a g e
 Pic11

Step 2 Install extra packages

Go back and double-click the very same [Link] – we will need to install the extra packages
necessary for Suricata to run.

Click next and ok until you are presented with the following screen:

24 | P a g e
 Pic12

Here (Pic below) is where we search select and queue for installation the additional packages
needed.

In the picture below , in the search box type in the name of the package- the search will return
automatically , results , select the necessary package. Erase the contentment of the search box
and type in the name of the next package, select …

Do the same for all the needed packages, DO NOT hit next until you have selected all the
packages.

25 | P a g e
 Pic13

The necessary packages are:

26 | P a g e
 Pic14

After you are done selecting the packages – make sure the “search” box is cleared, click the
“view” button until the text on the right of the button displays “pending”.

Check and make sure all the needed packages are selected! If something is missing, go back and
select it!

Click Next.

After that click next (make sure the option “select required packages (RECOMMENDED)” is
selected!) :

27 | P a g e
 Pic15

The extra packages that you have selected will start to download and install:

28 | P a g e
 Pic16

This could also take 5 min or so.

Then click finish:

29 | P a g e
 Pic17

Step 3 Add paths to system variables

Add path to system variables (Win 7, 2008 - Control Panel\System and
Security\System\Advanced system settings\Environment Variables) :

C:\cygwin\bin;C:\cygwin\lib\pkgconfig;

Add the above to environment system variables in your windows system!!

See the picture below

30 | P a g e
 Pic18

Edit the system path variable:

31 | P a g e
 Pic19

Add “ C:\cygwin\bin;C:\cygwin\lib\pkgconfig; “ without the quotes to the end of the ” Variable

value path “ :

Pic20

32 | P a g e
Step 4 Get libyaml
Go to [Link]

Download the yaml package (at the time of this writing the current version is [Link])

[Link]

Unpack it in :

C:\cygwin\tmp

After you have unpacked it you should have the following directory:

C:\cygwin\tmp\yaml-0.1.4

Step 5 Get libpcap – for windows

Go to

[Link]

and download the WinPcap installer for windows (at the time of this writing the current version
was 4.1.2 )

Install the WinPcap (double click, and just use the default options, basically click next and ok
until finished.)

After that is done go to

[Link]

33 | P a g e
This is IMPORTANT , this is the development pack, we need that for Suricata to be able to run
on Windows.

Download the package

Unpack it anywhere you like.

Copy libraries (from the unpacked directory) like this:

 Copy ALL the content of WpdPack\Lib\ to cygwin\lib\

 Copy all headers (all the content)from WpdPack\Include\ to C:\cygwin\usr\include\
 Rename “libwpcap” to “libpcap” (in your cygwin\lib\ directory)

Step 6 Start Cygwin and compile yaml

Open CYGWIN

Double click your CYGWIN icon on your desktop.

A Linux/bash like command prompt will open:

34 | P a g e
 Pic21

Type the following commands as shown in the picture below (hit enter after each command):

35 | P a g e
 Pic22

Basically the commands are :

cd /tmp

cd yaml-0.1.4

./configure --prefix=/usr && make && make install

The last command above is on one line.

36 | P a g e
This will configure and install the yaml package that we need for Suricata, let it finish:

Pic23

After it is done, it should be something like this:

37 | P a g e
 Pic24

Then go up one directory.

“ cd .. “

38 | P a g e
Step 7 Compile Suricata
Step 7.1 – Suricata from git – latest version
(Step 7.2 – follows just after (7.1) – Suricata stable – latest stable release , if you would like to
use the stable version, please go to 7.2)

Get and compile Suricata.

As you are still in the CYGWIN environment -

Type in

git clone git://[Link]/[Link]

Then after it is done

cd oisf

like so:

39 | P a g e
 Pic25

After that we execute the following (one line):

[Link] libhtp/[Link] && [Link] libhtp/[Link] && [Link]

libhtp/[Link]

Like so:

40 | P a g e
 Pic26

Then we execute the following command:

./[Link] && ./configure && make

The above command is on one line

That will start configuration and compilation of Suricata.

Like so:

41 | P a g e
 Pic27

Let it run…..this could take 10 min. or so

After it is done:

42 | P a g e
 Pic28

Step 7.2 Suricata stable

Get and compile Suricata.

As you are still in the CYGWIN environment -

Suricata Stable (at the moment of this writing the stable version is 1.2.1):

If you want to install Suricata stable – latest stable version (production)

43 | P a g e
(You can find it here - [Link] )

go to a tmp dir. Type in (if you do not have “wget” installed - go ahead and install it the very
same way you searched and added/installed the other pkgs to Cygwin) :

f) wget [Link]
g) tar –zxf [Link]
h) cd suricata-1.2.1

i) [Link] libhtp/[Link] && [Link] libhtp/[Link] && [Link]

libhtp/[Link]
j) libtoolize -c && autoreconf -fv --install && ./configure && make

44 | P a g e
(--enable-debug and --enable-profiling are optional, you do not have to add them, I just add
them because I like them, (pic above))

Then continue with the instructions below, just substitute the oisf directory with suricata-1.2.1
directory!

Step 8 Set up Suricata for Windows

Create a directory C:\Suricata – you can use Win Explorer, you don’t need to make it from
Cygwin.

45 | P a g e
Then copy the [Link] file from C:\cygwin\tmp\oisf\src\.libs

To

C:\Suricata

Create a directory C:\Suricata\log

Then create a directory C:\Suricata\rules

This will hold the rule files for Suricata.

Go to [Link]

Download a rule set.

[Link]

Or download rules from [Link] , whichever you like, however Emerging Threats
are developing rules especially for Suricata, in order to use its capabilities to a full extend.

Unzip/untar the rule set in the C:\Suricata\rules directory.

Then go to C:\cygwin\tmp\oisf

Copy

[Link] , [Link] and [Link] to

C:\Suricata

Open [Link] with an editor – Notepad, Notepad++, whichever you like.

Change the following lines:

default-log-dir: C:\Suricata\log

46 | P a g e
………

- file:

enabled: yes

filename: C:\Suricata\[Link]

……….

default-rule-path: C:\Suricata\rules\

classification-file: C:\Suricata\[Link]

HOME_NET: "[[Link]/16]" - (here actually you put any network you want Suricata to
inspect)

Like shown on the pictures below:

47 | P a g e
 Pic29

48 | P a g e
 Pic30

49 | P a g e
 Pic31

Adjust your home network to whatever network you intend the Suricata to protect/inspect (as
shown in the picture above).

Step 9 Runing Suricata

….run intruders run…

Open a cmd as ADMINISTRATOR!!!.

50 | P a g e
Got to C:\Suricata and execute

[Link] -c [Link] -i [Link]

like shown on the picture below (in this case - [Link] is the IP/interface I want Suricata
to listen to, i.e. the IP that my network card has been configured with):

Pic32

And you have yourself Suricata running (the start time could depend the PC/Server CPU/MEM
availability and of course how many rules do you load, but it is max about 1.5 min):

51 | P a g e
 Pic33

That’s it.

From here on it is up to you to configure Suricata the way it suits you best!

Thanks

More info and documentation

You can find much more info about setting up and tuning Suricata here:

[Link]

52 | P a g e
53 | P a g e