"hostbit not found" error running suricata command

Help
1

Hi community:
I hope you all are fine.
I am struggling trying to start with Suricata. I am running the command below and I have this error:

[root@centos-agent2 ~]# suricatasc -c "add-hostbit 1.2.3.4 blacklist 60"
{"message": "hostbit not found", "return": "NOK"}

Is this an error? What am I missing?
Thanks a lot for your help!

2

From looking at the code, it appears you can only reference a hostbit in the unix socket that is already in use by a rule. Do you have a rule that uses the blacklist hostbit?

3

Hi @vjulien
Thanks for your reply. I don’t have any custom rule. Do I need one to make this work?
I ahve found this in the suricata.log:
19/10/2021 -- 17:51:00 - <Info> - No 'host-mode': suricata is in IDS mode, using default setting 'sniffer-only'
Is this working “mode” related ti the issue?
Thanks again for your help.

4

Yes you need a rule to do anything with the hostbit, its not magically doing something by itself.