# Using Suricata to scan for attacks

**URL:** <https://forum.suricata.io/t/using-suricata-to-scan-for-attacks/2143>\
**Category:** Help\
**Tags:** pfsense, community, rules, suricata\
**Created:** [January 20, 2022, 8:51pm UTC](https://forum.suricata.io/t/using-suricata-to-scan-for-attacks/2143 "2022-01-20T20:51:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pacosilva93](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/pacosilva93/32/1225_2.png) [@pacosilva93](https://forum.suricata.io/u/pacosilva93)\
**Post date:** [January 20, 2022, 8:51pm UTC](https://forum.suricata.io/t/using-suricata-to-scan-for-attacks/2143/1 "2022-01-20T20:51:45Z")

</div>

Hi guys, new to the forum here. I am currently enrolled in an online masters program for cybersecurity and I am currently stuck on an assignment. Was hoping for some help here.

For my assignment I was to use Suricata via a Ubuntu VM to scan for network vulnerabilities as well as an attack I performed through a Kali Linux VM.

Here’s the instructions:

- Download the Suricata software and configure it on Ubuntu.
- Implement an attack from Kali Linux to target Ubuntu.
- Using Suricata, perform a network and vulnerability scan of your virtual network.

This is where I get confused and bogged down. The steps on my tutorial weren’t clear as to go about scanning on Suricata, but when researching it seems to be an option on pfSense that you can enable, which completely goes around the instructions.

When asking for a scan, I assumed they want PCAP Info, so I type in the command:

Suricata --pcap I get this:

 ![Screen Shot 2022-01-20 at 12.49.51 PM](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/b/b789d337c6d0d10783214ac0ba324e54309f1ad4.jpeg)

What am I doing wrong here?

Specs:

Ubuntu (64-bit)

---

<div class="post-metadata">

**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\
**Post date:** [January 21, 2022, 6:23am UTC](https://forum.suricata.io/t/using-suricata-to-scan-for-attacks/2143/2 "2022-01-21T06:23:49Z")

</div>

Hí,

- You have to indicate where suricata.yaml is located.
- You have to specify in runmode
- In suricata.yaml you have to indicate the interface:

```auto
    pcap:
   - interface: enp0s3

```

- You have to indicate where the logs will be located.

Example:

`sudo suricata --pcap --runmode autofp -c /etc/suricata/suricata.yaml -l ./log -vvv -knone`

.