Problems starting suri 8.0.2 with napatech support on debian trixie

Help
1

I try to run suricata version 8.0.2 with napatech support on debian trixie on amd64. When using the command line switch “–napatech”, it refuses to start, telling me the correct syntax.

The exact same command line syntax and config file works for me with version 7.0.13 and earlier.

I also added the napatech.so file to the plugin section of the config file, but still no change.

Napatech driver is version 12.14.6.1. I compiled suricata from scratch, and build info says:

This is Suricata version 8.0.2-2~bsoc-nt RELEASE
Features: PCAP_SET_BUFF NAPATECH AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HTTP2_DECOMPRESSION HAVE_LUA HAVE_JA3 HAVE_JA4 HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST POPCNT64
SIMD support: SSE_4_2 SSE_4_1 SSE_3 SSE_2
Atomic intrinsics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 14.2.0, C version 201112
compiled with _FORTIFY_SOURCE=2
L1 cache line size (CLS)=64
thread local storage method: _Thread_local
compiled with LibHTP v8.0.2

Suricata Configuration:
AF_PACKET support:                       yes
AF_XDP support:                          yes
DPDK support:                            yes
eBPF support:                            yes
XDP support:                             yes
PF_RING support:                         no
NFQueue support:                         no
NFLOG support:                           no
IPFW support:                            no
Netmap support:                          no
DAG enabled:                             no
Napatech enabled:                        yes
WinDivert enabled:                       no
Npcap support:

Unix socket enabled:                     yes
Detection enabled:                       yes

Libmagic support:                        yes
libjansson support:                      yes
hiredis support:                         yes
hiredis async with libevent:             yes
PCRE jit:                                yes
GeoIP2 support:                          yes
JA3 support:                             yes
JA4 support:                             yes
Hyperscan support:                       yes
Hwloc support:                           no
Libnet support:                          yes
liblz4 support:                          yes
Landlock support:                        yes
Systemd support:                         yes

Rust strict mode:                        no
Rust compiler path:                      /usr/bin/rustc
Rust compiler version:                   rustc 1.85.0 (4d91de4e4 2025-02-17) (built from a source tarball)
Cargo path:                              /usr/bin/cargo
Cargo version:                           cargo 1.85.0 (d73d2caf9 2024-12-31)

Python support:                          yes
Python path:                             /usr/bin/python3
Install suricatactl:                     yes
Install suricatasc:                      yes
Install suricata-update:                 no, not bundled

Profiling enabled:                       no
Profiling locks enabled:                 no
Profiling rules enabled:                 no

Plugin support (experimental):           yes
DPDK Bond PMD:                           no

Plugins:
nDPI:                                    no

Development settings:
Coccinelle / spatch:                     no
Unit tests enabled:                      no
Debug output enabled:                    no
Debug validation enabled:                no
Fuzz targets enabled:                    no

Generic build parameters:
Installation prefix:                     /usr
Configuration directory:                 /etc/suricata/
Log directory:                           /var/log/suricata/

–prefix                                 /usr
–sysconfdir                             /etc
–localstatedir                          /var
–datarootdir                            /usr/share

Host:                                    x86_64-pc-linux-gnu
Compiler:                                gcc (exec name) / g++ (real)
GCC Protect enabled:                     yes
GCC march native enabled:                no
GCC Profile enabled:                     no
Position Independent Executable enabled: no
CFLAGS                                   -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/opt/maja/src/suricata-debian/build/suricata-8.0.2=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -fPIC -DOS_LINUX -std=c11 -I/usr/include/dpdk -I/usr/include/dpdk/../x86_64-linux-gnu/dpdk -include rte_config.h -march=corei7 -mrtm -I/usr/include/x86_64-linux-gnu -I/usr/include/libnl3 -I/usr/include/dbus-1.0 -I/usr/lib/x86_64-linux-gnu/dbus-1.0/include
PCAP_CFLAGS                              -I/usr/include/dbus-1.0 -I/usr/lib/x86_64-linux-gnu/dbus-1.0/include
SECCFLAGS                                -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security

Does anyone know what to try try next?

Best regards,

MaJa

2

Suricata 8.0.x changed how the Napatech capture plugin is built (compiled into a separate shared object) and used.

See Napatech as a Plugin — Suricata 8.0.2 documentation

This is mentioned in the upgrade documentation.

What we did not document properly is the need to use an additional command line parameter; add --capture-plugin=napatech to the suricata command line (it’s not necessary to use --napatech)

3

Yeah, did’t find the new command line parameter in the documentation.

Now it starts correctly. Thanks.

Best regards,

MaJa