Verify Suricata is using pf_ring?

Help
1

Hello community!

I have built from source suricata and NTOP/pf_ring and run suricata using the following switches:

  • suricata -c /etc/suricata/suricata.yaml -D --pfring-int=ens1

Looking in stats.log for a pf_ring related line and I don’t see anything.

  1. Should there be a pf_ring stats entry?
  2. If not, is there another way to verify suricata is using pf_ring?
2

You can use suricatasc to query the run and capture mode of suricata:
suricatasc -c capture-mode /var/run/suricata/suricata-command.socket (note that the socket name is taken from suricata.yaml (if present). Otherwise, a default value is used.

3

Perfect, that is it! Thank you!