How to run suricata to check whether the rules I wrote for a certain pcap file are correct

3

Hi!
In addition to JT’s answer, you can first do a basic semantic check by running

suricata -T

Note that this will pick up the rules as configured in suricata.yaml.

This will error on any rules that are incorrect in how the rule keywords should be used.
However, if you have written the rule incorrectly in terms of what it is supposed to do, you should perform a test like JT mentioned on smallest pcap possible where you’d expect the rule to fire.

1 Like