suricata: Drop parsers I have never heard of
[people/pmueller/ipfire-2.x.git] / config / suricata / suricata.yaml
CommitLineData
4c6d6c1e
SS
1%YAML 1.1
2---
3
4c6d6c1e 4##
335114b2
SS
5## IPFire specific configuration file - an untouched example configuration
6## can be found in suricata-example.yaml.
4c6d6c1e
SS
7##
8
9vars:
4c6d6c1e 10 address-groups:
42303055 11 # Include HOME_NET declaration from external file.
13d077fd 12 include: /var/ipfire/suricata/suricata-homenet.yaml
4c6d6c1e
SS
13
14 EXTERNAL_NET: "!$HOME_NET"
15 #EXTERNAL_NET: "any"
16
17 HTTP_SERVERS: "$HOME_NET"
18 SMTP_SERVERS: "$HOME_NET"
19 SQL_SERVERS: "$HOME_NET"
20 DNS_SERVERS: "$HOME_NET"
21 TELNET_SERVERS: "$HOME_NET"
22 AIM_SERVERS: "$EXTERNAL_NET"
23 DNP3_SERVER: "$HOME_NET"
24 DNP3_CLIENT: "$HOME_NET"
25 MODBUS_CLIENT: "$HOME_NET"
26 MODBUS_SERVER: "$HOME_NET"
27 ENIP_CLIENT: "$HOME_NET"
28 ENIP_SERVER: "$HOME_NET"
29
30 port-groups:
31 HTTP_PORTS: "80"
32 SHELLCODE_PORTS: "!80"
33 ORACLE_PORTS: 1521
067e1847 34 SSH_PORTS: "[22,222]"
4c6d6c1e
SS
35 DNP3_PORTS: 20000
36 MODBUS_PORTS: 502
37 FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
38 FTP_PORTS: 21
39
4c6d6c1e 40##
335114b2 41## Ruleset specific options.
4c6d6c1e 42##
21cab141 43default-rule-path: /var/lib/suricata
cc60d3df 44rule-files:
335114b2 45 # Include enabled ruleset files from external file.
cc60d3df 46 include: /var/ipfire/suricata/suricata-used-rulefiles.yaml
4c6d6c1e 47
21cab141
SS
48classification-file: /var/lib/suricata/classification.config
49reference-config-file: /var/lib/suricata/reference.config
fd72c85e 50threshold-file: /var/lib/suricata/threshold.config
4c6d6c1e
SS
51
52
53##
335114b2 54## Logging options.
4c6d6c1e 55##
4c6d6c1e
SS
56default-log-dir: /var/log/suricata/
57
58# global stats configuration
59stats:
60 enabled: yes
61 # The interval field (in seconds) controls at what interval
62 # the loggers are invoked.
63 interval: 8
64
65# Configure the type of alert (and other) logging you would like.
66outputs:
67 # a line based alerts log similar to Snort's fast.log
68 - fast:
69 enabled: yes
70 filename: fast.log
71 append: yes
72 #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
73
4c6d6c1e
SS
74 # Stats.log contains data from various counters of the suricata engine.
75 - stats:
76 enabled: yes
77 filename: stats.log
335114b2 78 append: no # append to file (yes) or overwrite it (no)
4c6d6c1e
SS
79 totals: yes # stats for all threads merged together
80 threads: no # per thread stats
81 #null-values: yes # print counters that have value 0
82
4c6d6c1e
SS
83logging:
84 # The default log level, can be overridden in an output section.
85 # Note that debug level logging will only be emitted if Suricata was
86 # compiled with the --enable-debug configure option.
87 #
88 # This value is overriden by the SC_LOG_LEVEL env var.
89 default-log-level: notice
90
4c6d6c1e
SS
91 # A regex to filter output. Can be overridden in an output section.
92 # Defaults to empty (no filter).
93 #
94 # This value is overriden by the SC_LOG_OP_FILTER env var.
95 default-output-filter:
96
97 # Define your logging outputs. If none are defined, or they are all
98 # disabled you will get the default - console output.
99 outputs:
100 - console:
335114b2 101 enabled: no
4c6d6c1e
SS
102 # type: json
103 - file:
335114b2 104 enabled: no
4c6d6c1e
SS
105 level: info
106 filename: /var/log/suricata/suricata.log
107 # type: json
108 - syslog:
335114b2 109 enabled: yes
4c6d6c1e 110 facility: local5
ab1444b4 111 format: ""
4c6d6c1e
SS
112 # type: json
113
4c6d6c1e 114##
335114b2 115## Netfilter configuration
4c6d6c1e 116##
4c6d6c1e 117
335114b2
SS
118nfq:
119 mode: repeat
5d04cfe7
MT
120 repeat-mark: 1879048192
121 repeat-mask: 1879048192
f5ad510e
SS
122# bypass-mark: 1
123# bypass-mask: 1
335114b2
SS
124# route-queue: 2
125# batchcount: 20
126 fail-open: yes
4c6d6c1e
SS
127
128##
129## Step 5: App Layer Protocol Configuration
130##
131
132# Configure the app-layer parsers. The protocols section details each
133# protocol.
134#
135# The option "enabled" takes 3 values - "yes", "no", "detection-only".
136# "yes" enables both detection and the parser, "no" disables both, and
137# "detection-only" enables protocol detection only (parser disabled).
138app-layer:
139 protocols:
140 tls:
141 enabled: yes
142 detection-ports:
96495c9a 143 dp: "[443,444,465,853,993,995]"
4c6d6c1e
SS
144
145 # Completely stop processing TLS/SSL session after the handshake
146 # completed. If bypass is enabled this will also trigger flow
147 # bypass. If disabled (the default), TLS/SSL session is still
148 # tracked for Heartbleed and other anomalies.
149 #no-reassemble: yes
150 dcerpc:
151 enabled: yes
152 ftp:
153 enabled: yes
154 ssh:
155 enabled: yes
156 smtp:
157 enabled: yes
158 # Configure SMTP-MIME Decoder
159 mime:
160 # Decode MIME messages from SMTP transactions
161 # (may be resource intensive)
162 # This field supercedes all others because it turns the entire
163 # process on or off
164 decode-mime: yes
165
166 # Decode MIME entity bodies (ie. base64, quoted-printable, etc.)
167 decode-base64: yes
168 decode-quoted-printable: yes
169
170 # Maximum bytes per header data value stored in the data structure
171 # (default is 2000)
172 header-value-depth: 2000
173
174 # Extract URLs and save in state data structure
175 extract-urls: yes
176 # Set to yes to compute the md5 of the mail body. You will then
177 # be able to journalize it.
178 body-md5: no
179 # Configure inspected-tracker for file_data keyword
180 inspected-tracker:
181 content-limit: 100000
182 content-inspect-min-size: 32768
183 content-inspect-window: 4096
184 imap:
8723bb91 185 enabled: yes
4c6d6c1e 186 msn:
8723bb91 187 enabled: yes
4c6d6c1e
SS
188 smb:
189 enabled: yes
190 detection-ports:
191 dp: 139, 445
192 # smb2 detection is disabled internally inside the engine.
193 #smb2:
194 # enabled: yes
4c6d6c1e
SS
195 dns:
196 # memcaps. Globally and per flow/state.
cf976e93
MT
197 global-memcap: 32mb
198 state-memcap: 512kb
4c6d6c1e
SS
199
200 # How many unreplied DNS requests are considered a flood.
201 # If the limit is reached, app-layer-event:dns.flooded; will match.
cf976e93 202 request-flood: 512
4c6d6c1e
SS
203
204 tcp:
205 enabled: yes
206 detection-ports:
96495c9a 207 dp: 53
4c6d6c1e
SS
208 udp:
209 enabled: yes
210 detection-ports:
96495c9a 211 dp: 53
4c6d6c1e
SS
212 http:
213 enabled: yes
8efbd71c 214 memcap: 256mb
4c6d6c1e
SS
215
216 # default-config: Used when no server-config matches
217 # personality: List of personalities used by default
218 # request-body-limit: Limit reassembly of request body for inspection
219 # by http_client_body & pcre /P option.
220 # response-body-limit: Limit reassembly of response body for inspection
221 # by file_data, http_server_body & pcre /Q option.
222 # double-decode-path: Double decode path section of the URI
223 # double-decode-query: Double decode query section of the URI
224 # response-body-decompress-layer-limit:
225 # Limit to how many layers of compression will be
226 # decompressed. Defaults to 2.
227 #
4c6d6c1e
SS
228 # Currently Available Personalities:
229 # Minimal, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0,
230 # IIS_7_0, IIS_7_5, Apache_2
231 libhtp:
232 default-config:
233 personality: IDS
234
235 # Can be specified in kb, mb, gb. Just a number indicates
236 # it's in bytes.
8efbd71c
MT
237 request-body-limit: 0
238 response-body-limit: 0
4c6d6c1e
SS
239
240 # response body decompression (0 disables)
241 response-body-decompress-layer-limit: 2
242
243 # auto will use http-body-inline mode in IPS mode, yes or no set it statically
244 http-body-inline: auto
245
246 # Take a random value for inspection sizes around the specified value.
247 # This lower the risk of some evasion technics but could lead
248 # detection change between runs. It is set to 'yes' by default.
8efbd71c 249 randomize-inspection-sizes: yes
4c6d6c1e
SS
250 # If randomize-inspection-sizes is active, the value of various
251 # inspection size will be choosen in the [1 - range%, 1 + range%]
252 # range
253 # Default value of randomize-inspection-range is 10.
8efbd71c 254 randomize-inspection-range: 10
4c6d6c1e
SS
255
256 # decoding
257 double-decode-path: no
258 double-decode-query: no
259
4c6d6c1e 260
4c6d6c1e
SS
261# Limit for the maximum number of asn1 frames to decode (default 256)
262asn1-max-frames: 256
263
264
265##############################################################################
266##
267## Advanced settings below
268##
269##############################################################################
270
4c6d6c1e
SS
271# Suricata core dump configuration. Limits the size of the core dump file to
272# approximately max-dump. The actual core dump size will be a multiple of the
273# page size. Core dumps that would be larger than max-dump are truncated. On
274# Linux, the actual core dump size may be a few pages larger than max-dump.
275# Setting max-dump to 0 disables core dumping.
276# Setting max-dump to 'unlimited' will give the full core dump file.
277# On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size
278# to be 'unlimited'.
279
280coredump:
281 max-dump: unlimited
282
283# If suricata box is a router for the sniffed networks, set it to 'router'. If
284# it is a pure sniffing setup, set it to 'sniffer-only'.
285# If set to auto, the variable is internally switch to 'router' in IPS mode
286# and 'sniffer-only' in IDS mode.
287# This feature is currently only used by the reject* keywords.
288host-mode: auto
289
290# Number of packets preallocated per thread. The default is 1024. A higher number
291# will make sure each CPU will be more easily kept busy, but may negatively
292# impact caching.
16446608 293max-pending-packets: 1024
4c6d6c1e
SS
294
295# Runmode the engine should use. Please check --list-runmodes to get the available
296# runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
297# load balancing).
298#runmode: autofp
299
300# Specifies the kind of flow load balancer used by the flow pinned autofp mode.
301#
302# Supported schedulers are:
303#
304# round-robin - Flows assigned to threads in a round robin fashion.
305# active-packets - Flows assigned to threads that have the lowest number of
306# unprocessed packets (default).
307# hash - Flow alloted usihng the address hash. More of a random
308# technique. Was the default in Suricata 1.2.1 and older.
309#
310#autofp-scheduler: active-packets
311
312# Preallocated size for packet. Default is 1514 which is the classical
313# size for pcap on ethernet. You should adjust this value to the highest
314# packet size (MTU + hardware header) on your system.
9f726f8f 315default-packet-size: 1514
4c6d6c1e
SS
316
317# Unix command socket can be used to pass commands to suricata.
318# An external tool can then connect to get information from suricata
319# or trigger some modifications of the engine. Set enabled to yes
320# to activate the feature. In auto mode, the feature will only be
321# activated in live capture mode. You can use the filename variable to set
322# the file name of the socket.
323unix-command:
335114b2 324 enabled: no
4c6d6c1e
SS
325 #filename: custom.socket
326
83b576c8
MT
327# Magic file
328magic-file: /usr/share/misc/magic.mgc
4c6d6c1e
SS
329
330legacy:
331 uricontent: enabled
332
333##
334## Detection settings
335##
336
337# Set the order of alerts bassed on actions
338# The default order is pass, drop, reject, alert
339# action-order:
340# - pass
341# - drop
342# - reject
343# - alert
344
4c6d6c1e
SS
345# When run with the option --engine-analysis, the engine will read each of
346# the parameters below, and print reports for each of the enabled sections
347# and exit. The reports are printed to a file in the default log dir
348# given by the parameter "default-log-dir", with engine reporting
349# subsection below printing reports in its own report file.
350engine-analysis:
351 # enables printing reports for fast-pattern for every rule.
352 rules-fast-pattern: yes
353 # enables printing reports for each rule
354 rules: yes
355
356#recursion and match limits for PCRE where supported
357pcre:
358 match-limit: 3500
359 match-limit-recursion: 1500
360
361##
362## Advanced Traffic Tracking and Reconstruction Settings
363##
364
365# Host specific policies for defragmentation and TCP stream
366# reassembly. The host OS lookup is done using a radix tree, just
367# like a routing table so the most specific entry matches.
368host-os-policy:
369 # Make the default policy windows.
370 windows: [0.0.0.0/0]
371 bsd: []
372 bsd-right: []
373 old-linux: []
374 linux: []
375 old-solaris: []
376 solaris: []
377 hpux10: []
378 hpux11: []
379 irix: []
380 macos: []
381 vista: []
382 windows2k3: []
383
384# Defrag settings:
385
386defrag:
7eed864c 387 memcap: 64mb
4c6d6c1e
SS
388 hash-size: 65536
389 trackers: 65535 # number of defragmented flows to follow
390 max-frags: 65535 # number of fragments to keep (higher than trackers)
391 prealloc: yes
392 timeout: 60
393
4c6d6c1e
SS
394# Flow settings:
395# By default, the reserved memory (memcap) for flows is 32MB. This is the limit
396# for flow allocation inside the engine. You can change this value to allow
397# more memory usage for flows.
398# The hash-size determine the size of the hash used to identify flows inside
399# the engine, and by default the value is 65536.
400# At the startup, the engine can preallocate a number of flows, to get a better
401# performance. The number of flows preallocated is 10000 by default.
402# emergency-recovery is the percentage of flows that the engine need to
403# prune before unsetting the emergency state. The emergency state is activated
404# when the memcap limit is reached, allowing to create new flows, but
405# prunning them with the emergency timeouts (they are defined below).
406# If the memcap is reached, the engine will try to prune flows
407# with the default timeouts. If it doens't find a flow to prune, it will set
408# the emergency bit and it will try again with more agressive timeouts.
409# If that doesn't work, then it will try to kill the last time seen flows
410# not in use.
411# The memcap can be specified in kb, mb, gb. Just a number indicates it's
412# in bytes.
413
414flow:
47cb0571 415 memcap: 256mb
4c6d6c1e
SS
416 hash-size: 65536
417 prealloc: 10000
418 emergency-recovery: 30
47cb0571
MT
419 managers: 1
420 recyclers: 1
4c6d6c1e
SS
421
422# This option controls the use of vlan ids in the flow (and defrag)
423# hashing. Normally this should be enabled, but in some (broken)
424# setups where both sides of a flow are not tagged with the same vlan
425# tag, we can ignore the vlan id's in the flow hashing.
426vlan:
427 use-for-tracking: true
428
429# Specific timeouts for flows. Here you can specify the timeouts that the
430# active flows will wait to transit from the current state to another, on each
431# protocol. The value of "new" determine the seconds to wait after a hanshake or
432# stream startup before the engine free the data of that flow it doesn't
433# change the state to established (usually if we don't receive more packets
434# of that flow). The value of "established" is the amount of
435# seconds that the engine will wait to free the flow if it spend that amount
436# without receiving new packets or closing the connection. "closed" is the
437# amount of time to wait after a flow is closed (usually zero). "bypassed"
438# timeout controls locally bypassed flows. For these flows we don't do any other
439# tracking. If no packets have been seen after this timeout, the flow is discarded.
440#
441# There's an emergency mode that will become active under attack circumstances,
442# making the engine to check flow status faster. This configuration variables
443# use the prefix "emergency-" and work similar as the normal ones.
444# Some timeouts doesn't apply to all the protocols, like "closed", for udp and
445# icmp.
446
447flow-timeouts:
448
449 default:
450 new: 30
451 established: 300
452 closed: 0
453 bypassed: 100
454 emergency-new: 10
455 emergency-established: 100
456 emergency-closed: 0
457 emergency-bypassed: 50
458 tcp:
459 new: 60
460 established: 600
461 closed: 60
462 bypassed: 100
463 emergency-new: 5
464 emergency-established: 100
465 emergency-closed: 10
466 emergency-bypassed: 50
467 udp:
468 new: 30
469 established: 300
470 bypassed: 100
471 emergency-new: 10
472 emergency-established: 100
473 emergency-bypassed: 50
474 icmp:
475 new: 30
476 established: 300
477 bypassed: 100
478 emergency-new: 10
479 emergency-established: 100
480 emergency-bypassed: 50
481
482# Stream engine settings. Here the TCP stream tracking and reassembly
483# engine is configured.
484#
485# stream:
486# memcap: 32mb # Can be specified in kb, mb, gb. Just a
487# # number indicates it's in bytes.
488# checksum-validation: yes # To validate the checksum of received
489# # packet. If csum validation is specified as
490# # "yes", then packet with invalid csum will not
491# # be processed by the engine stream/app layer.
492# # Warning: locally generated trafic can be
493# # generated without checksum due to hardware offload
494# # of checksum. You can control the handling of checksum
495# # on a per-interface basis via the 'checksum-checks'
496# # option
497# prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread
498# midstream: false # don't allow midstream session pickups
499# async-oneside: false # don't enable async stream handling
500# inline: no # stream inline mode
501# drop-invalid: yes # in inline mode, drop packets that are invalid with regards to streaming engine
502# max-synack-queued: 5 # Max different SYN/ACKs to queue
503# bypass: no # Bypass packets when stream.depth is reached
504#
505# reassembly:
506# memcap: 64mb # Can be specified in kb, mb, gb. Just a number
507# # indicates it's in bytes.
508# depth: 1mb # Can be specified in kb, mb, gb. Just a number
509# # indicates it's in bytes.
510# toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
511# # this size. Can be specified in kb, mb,
512# # gb. Just a number indicates it's in bytes.
513# toclient-chunk-size: 2560 # inspect raw stream in chunks of at least
514# # this size. Can be specified in kb, mb,
515# # gb. Just a number indicates it's in bytes.
516# randomize-chunk-size: yes # Take a random value for chunk size around the specified value.
517# # This lower the risk of some evasion technics but could lead
518# # detection change between runs. It is set to 'yes' by default.
519# randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is
520# # a random value between (1 - randomize-chunk-range/100)*toserver-chunk-size
521# # and (1 + randomize-chunk-range/100)*toserver-chunk-size and the same
522# # calculation for toclient-chunk-size.
523# # Default value of randomize-chunk-range is 10.
524#
525# raw: yes # 'Raw' reassembly enabled or disabled.
526# # raw is for content inspection by detection
527# # engine.
528#
529# segment-prealloc: 2048 # number of segments preallocated per thread
530#
531# check-overlap-different-data: true|false
532# # check if a segment contains different data
533# # than what we've already seen for that
534# # position in the stream.
535# # This is enabled automatically if inline mode
536# # is used or when stream-event:reassembly_overlap_different_data;
537# # is used in a rule.
538#
539stream:
0b340f09 540 memcap: 256mb
c9ee3592 541 prealloc-sessions: 4096
4c6d6c1e
SS
542 checksum-validation: yes # reject wrong csums
543 inline: auto # auto will use inline mode in IPS mode, yes or no set it statically
544 reassembly:
545 memcap: 256mb
546 depth: 1mb # reassemble 1mb into a stream
547 toserver-chunk-size: 2560
548 toclient-chunk-size: 2560
549 randomize-chunk-size: yes
0b340f09
MT
550 raw: yes
551 segment-prealloc: 2048
552 check-overlap-different-data: true
4c6d6c1e
SS
553
554# Host table:
555#
556# Host table is used by tagging and per host thresholding subsystems.
557#
558host:
559 hash-size: 4096
560 prealloc: 1000
561 memcap: 32mb
562
563# IP Pair table:
564#
565# Used by xbits 'ippair' tracking.
566#
567#ippair:
568# hash-size: 4096
569# prealloc: 1000
570# memcap: 32mb
571
572# Decoder settings
573
574decoder:
575 # Teredo decoder is known to not be completely accurate
576 # it will sometimes detect non-teredo as teredo.
577 teredo:
890f1bf2 578 enabled: false
4c6d6c1e
SS
579
580
581##
582## Performance tuning and profiling
583##
584
585# The detection engine builds internal groups of signatures. The engine
586# allow us to specify the profile to use for them, to manage memory on an
587# efficient way keeping a good performance. For the profile keyword you
588# can use the words "low", "medium", "high" or "custom". If you use custom
589# make sure to define the values at "- custom-values" as your convenience.
590# Usually you would prefer medium/high/low.
591#
592# "sgh mpm-context", indicates how the staging should allot mpm contexts for
593# the signature groups. "single" indicates the use of a single context for
594# all the signature group heads. "full" indicates a mpm-context for each
595# group head. "auto" lets the engine decide the distribution of contexts
596# based on the information the engine gathers on the patterns from each
597# group head.
598#
599# The option inspection-recursion-limit is used to limit the recursive calls
600# in the content inspection code. For certain payload-sig combinations, we
601# might end up taking too much time in the content inspection code.
602# If the argument specified is 0, the engine uses an internally defined
603# default limit. On not specifying a value, we use no limits on the recursion.
604detect:
5196d8dd 605 profile: high
4c6d6c1e
SS
606 custom-values:
607 toclient-groups: 3
608 toserver-groups: 25
609 sgh-mpm-context: auto
610 inspection-recursion-limit: 3000
99d75ac7 611
4c6d6c1e
SS
612 # If set to yes, the loading of signatures will be made after the capture
613 # is started. This will limit the downtime in IPS mode.
99d75ac7 614 delayed-detect: yes
4c6d6c1e
SS
615
616 prefilter:
617 # default prefiltering setting. "mpm" only creates MPM/fast_pattern
618 # engines. "auto" also sets up prefilter engines for other keywords.
619 # Use --list-keywords=all to see which keywords support prefiltering.
620 default: mpm
621
622 # the grouping values above control how many groups are created per
623 # direction. Port whitelisting forces that port to get it's own group.
624 # Very common ports will benefit, as well as ports with many expensive
625 # rules.
626 grouping:
627 #tcp-whitelist: 53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080
628 #udp-whitelist: 53, 135, 5060
629
630 profiling:
631 # Log the rules that made it past the prefilter stage, per packet
632 # default is off. The threshold setting determines how many rules
633 # must have made it past pre-filter for that rule to trigger the
634 # logging.
635 #inspect-logging-threshold: 200
636 grouping:
637 dump-to-disk: false
638 include-rules: false # very verbose
639 include-mpm-stats: false
640
641# Select the multi pattern algorithm you want to run for scan/search the
642# in the engine.
643#
644# The supported algorithms are:
645# "ac" - Aho-Corasick, default implementation
646# "ac-bs" - Aho-Corasick, reduced memory implementation
647# "ac-cuda" - Aho-Corasick, CUDA implementation
648# "ac-ks" - Aho-Corasick, "Ken Steele" variant
649# "hs" - Hyperscan, available when built with Hyperscan support
650#
651# The default mpm-algo value of "auto" will use "hs" if Hyperscan is
652# available, "ac" otherwise.
653#
654# The mpm you choose also decides the distribution of mpm contexts for
655# signature groups, specified by the conf - "detect.sgh-mpm-context".
656# Selecting "ac" as the mpm would require "detect.sgh-mpm-context"
657# to be set to "single", because of ac's memory requirements, unless the
658# ruleset is small enough to fit in one's memory, in which case one can
659# use "full" with "ac". Rest of the mpms can be run in "full" mode.
660#
661# There is also a CUDA pattern matcher (only available if Suricata was
662# compiled with --enable-cuda: b2g_cuda. Make sure to update your
663# max-pending-packets setting above as well if you use b2g_cuda.
664
665mpm-algo: auto
666
667# Select the matching algorithm you want to use for single-pattern searches.
668#
669# Supported algorithms are "bm" (Boyer-Moore) and "hs" (Hyperscan, only
670# available if Suricata has been built with Hyperscan support).
671#
672# The default of "auto" will use "hs" if available, otherwise "bm".
673
674spm-algo: auto
675
676# Suricata is multi-threaded. Here the threading can be influenced.
677threading:
678 set-cpu-affinity: no
679 # Tune cpu affinity of threads. Each family of threads can be bound
680 # on specific CPUs.
681 #
682 # These 2 apply to the all runmodes:
683 # management-cpu-set is used for flow timeout handling, counters
684 # worker-cpu-set is used for 'worker' threads
685 #
686 # Additionally, for autofp these apply:
687 # receive-cpu-set is used for capture threads
688 # verdict-cpu-set is used for IPS verdict threads
689 #
690 cpu-affinity:
691 - management-cpu-set:
692 cpu: [ 0 ] # include only these cpus in affinity settings
693 - receive-cpu-set:
694 cpu: [ 0 ] # include only these cpus in affinity settings
695 - worker-cpu-set:
696 cpu: [ "all" ]
697 mode: "exclusive"
698 # Use explicitely 3 threads and don't compute number by using
699 # detect-thread-ratio variable:
700 # threads: 3
701 prio:
702 low: [ 0 ]
703 medium: [ "1-2" ]
704 high: [ 3 ]
705 default: "medium"
706 #- verdict-cpu-set:
707 # cpu: [ 0 ]
708 # prio:
709 # default: "high"
710 #
711 # By default Suricata creates one "detect" thread per available CPU/CPU core.
712 # This setting allows controlling this behaviour. A ratio setting of 2 will
713 # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this
714 # will result in 4 detect threads. If values below 1 are used, less threads
715 # are created. So on a dual core CPU a setting of 0.5 results in 1 detect
716 # thread being created. Regardless of the setting at a minimum 1 detect
717 # thread will always be created.
718 #
719 detect-thread-ratio: 1.0