Package: suricata
Version: 1.4-3
Severity: wishlist
Tags: patch
Dear Maintainer,
It would be nice if you could set in /etc/default/suricata:
LISTENMODE=af-packet
Attached is a patch to do that.
Also, the start-stop-daemon in 'stop' seems extraneous. It was not working
right via cron so I commented it out locally. I'm not sure what the intent was
there so I only am mentioning it in passing.
-- System Information:
Debian Release: wheezy/sid
APT prefers quantal-updates
APT policy: (500, 'quantal-updates'), (500, 'quantal-security'), (500,
'quantal')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.5.0-21-generic (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
diff -Nru suricata-1.4/debian/suricata.default suricata-1.4/debian/suricata.default
--- suricata-1.4/debian/suricata.default 2010-12-19 09:51:48.000000000 -0600
+++ suricata-1.4/debian/suricata.default 2013-01-11 07:38:15.000000000 -0600
@@ -6,9 +6,9 @@
# Configuration file to load
SURCONF=/etc/suricata/suricata-debian.yaml
-# Listen mode: pcap or nfqueue
+# Listen mode: pcap, nfqueue, or af-packet
# depending on this value, only one of the two following options
-# will be used
+# may be used (af-packet uses neither).
# Please note that IPS mode is only available when using nfqueue
LISTENMODE=nfqueue
diff -Nru suricata-1.4/debian/suricata.init suricata-1.4/debian/suricata.init
--- suricata-1.4/debian/suricata.init 2012-12-22 08:17:26.000000000 -0600
+++ suricata-1.4/debian/suricata.init 2013-01-11 07:11:05.000000000 -0600
@@ -70,6 +70,10 @@
IDMODE="IDS (pcap)"
LISTEN_OPTIONS=" -i $IFACE"
;;
+ af-packet)
+ IDMODE="IDS (af-packet)"
+ LISTEN_OPTIONS=" --af-packet"
+ ;;
*)
echo "Unsupported listen mode $LISTENMODE, aborting"
exit 1
