这篇文章上次修改于 1144 天前，可能其部分内容已经发生变化，如有疑问可询问作者。 ## 安装suricata with DPDK > 离线环境需要proxychains-ng ，编译安装后配置yum源安装所需依赖包。 ```shell # 可选，下载代理软件 tar xvf proxychains-ng-4.17.tar.xz cd proxychains-ng-4.17 ./configure --prefix=/usr --sysconfdir=/etc make && make install make install-config proxychains4 -q /bin/bash #可配置全局代理 ``` ### 安装DPDK19.11.14稳定版 ```shell [root@ids-dpdk ~]# cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) [root@ids-dpdk ~]# uname -r #查看一下系统版本 3.10.0-514.el7.x86_64 [root@ids-dpdk ~]# rpm -qa kernel #通过rpm命令查看我所安装的内核版本 kernel-3.10.0-514.el7.x86_64 kernel-3.10.0-1160.92.1.el7.x86_64 [root@ids-dpdk ~]# ls /usr/src/kernels/ #查看有没有相应的内核开发包 空 #如果该目录下没有系统内核源码或版本不匹配，执行以下操作 [root@ids-dpdk ~]# yum install kernel-devel [root@ids-dpdk ~]# yum -y update kernel kernel-devel [root@ids-dpdk ~]# reboot ##重启，版本号一致，问题解决 [root@ids-dpdk ~]# ls /usr/src/kernels/ 3.10.0-1160.108.1.el7.x86_64 [root@ids-dpdk ~]# uname -r 3.10.0-1160.108.1.el7.x86_64 #下载所需依赖 [root@ids-dpdk ~]# yum install gcc gcc-c++ make [root@ids-dpdk ~]# yum install libpcap libpcap-devel [root@ids-dpdk ~]# yum install numactl numactl-devel 将dpdk压缩包下载到/home目录下并解压 [root@ids-dpdk ~]# wget http://fast.dpdk.org/rel/dpdk-19.11.14.tar.xz [root@ids-dpdk ~]# xz -d dpdk-19.11.14.tar.xz [root@ids-dpdk ~]# tar -xvf dpdk-19.11.14.tar #设置env export RTE_SDK='/home/dpdk-19.11.14' export RTE_TARGET=x86_64-native-linuxapp-gcc #可写入bash.profile后source #编译过程 cd /home/dpdk-19.11.14/usertools/ ./dpdk-setup.sh #依次选择 [41] x86_64-native-linuxapp-gcc [48] Insert IGB UIO module [51] Setup hugepage mappings for non-NUMA systems #测试环境无numa [53] Display current Ethernet/Baseband/Crypto device settings [54] Bind Ethernet/Baseband/Crypto device to IGB UIO module #绑定网卡 进入examples编译helloword，成功运行： # cd /home/dpdk-19.11.14/examples/helloworld/build/ # [root@localhost build]# ./helloworld EAL: Detected 8 lcore(s) EAL: Detected 1 NUMA nodes EAL: Multi-process socket /var/run/dpdk/rte/mp_socket EAL: Selected IOVA mode 'PA' EAL: No available hugepages reported in hugepages-1048576kB EAL: Probing VFIO support... EAL: PCI device 0000:03:00.0 on NUMA socket -1 EAL: probe driver: 8086:10fb net_ixgbe EAL: PCI device 0000:03:00.1 on NUMA socket -1 EAL: probe driver: 8086:10fb net_ixgbe EAL: PCI device 0000:08:00.0 on NUMA socket -1 EAL: probe driver: 8086:1533 net_e1000_igb EAL: PCI device 0000:09:00.0 on NUMA socket -1 EAL: probe driver: 8086:1533 net_e1000_igb EAL: PCI device 0000:0a:00.0 on NUMA socket -1 EAL: probe driver: 8086:1533 net_e1000_igb EAL: PCI device 0000:0b:00.0 on NUMA socket -1 EAL: probe driver: 8086:1533 net_e1000_igb EAL: PCI device 0000:0c:00.0 on NUMA socket -1 EAL: probe driver: 8086:1533 net_e1000_igb EAL: PCI device 0000:0d:00.0 on NUMA socket -1 EAL: probe driver: 8086:1533 net_e1000_igb EAL: PCI device 0000:0e:00.0 on NUMA socket -1 EAL: probe driver: 8086:1533 net_e1000_igb EAL: PCI device 0000:0f:00.0 on NUMA socket -1 EAL: probe driver: 8086:1533 net_e1000_igb hello from core 1 hello from core 4 hello from core 5 hello from core 2 hello from core 3 hello from core 6 hello from core 7 hello from core 0 ``` ### 安装Suricata 4.1.4 with dpdk ```shell #安装依赖 [root@ids-dpdk ~]# yum -y install gcc libpcap-devel pcre-devel libyaml-devel file-devel \ zlib-devel jansson-devel nss-devel libcap-ng-devel libnet-devel tar make openssl openssl-devel \ libnetfilter_queue-devel lua-devel PyYAML libmaxminddb-devel rustc cargo librdkafka-devel \ lz4-devel libxml2 autoconf [root@ids-dpdk ~]# sudo yum install -y pciutils ##下载DPDK_Suricata安装包，直接克隆项目代码即可 [root@ids-dpdk ~]# git clone https://github.com/vipinpv85/DPDK_SURICATA-4_1_1 #编译并安装DPDK_Suricata [root@ids-dpdk ~]# cd /home/DPDK_SURICATA-4_1_1/suricata-4.1.4 #构建支持DPDK的配置脚本： [root@ids-dpdk suricata-4.1.4]# autoconf #使用dpdk进行配置： [root@ids-dpdk suricata-4.1.4]# ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-dpdk #修改configure.ac文件，替换i40e为ixgbe： -Wl,-lrte_pmd_ixgbe \ #编译DPDK_Suricata，make出错就yum安装automake： [root@ids-dpdk suricata-4.1.4]# make #安装DPDK_Suricata： [root@ids-dpdk suricata-4.1.4]# make install #更新规则文件： [root@ids-dpdk suricata-4.1.4]# make install-full #安装相关配置文件： [root@ids-dpdk suricata-4.1.4]# make install-conf #运行suricata查看绑定接口，检查大页情况 [root@localhost build]# suricata --list-dpdkports EAL: Detected 8 lcore(s) EAL: Detected 1 NUMA nodes EAL: Multi-process socket /var/run/dpdk/rte/mp_socket EAL: Selected IOVA mode 'PA' EAL: No available hugepages reported in hugepages-1048576kB EAL: Probing VFIO support... EAL: PCI device 0000:03:00.0 on NUMA socket -1 EAL: probe driver: 8086:10fb net_ixgbe EAL: PCI device 0000:03:00.1 on NUMA socket -1 EAL: probe driver: 8086:10fb net_ixgbe ``` ```shell #修改yaml配置文件中的dpdk内容 dpdk: # port index input-output-map: ["0"] mpipe: # List of interfaces we will listen on. inputs: - interface: 0 #- interface: xgbe3 #- interface: xgbe4 ``` ### 运行成功状态   ======================================================================================= 解决编译后执行显示dpdkports空的问题： ```shell - - DPDK Mode selected - - (name:suricatareassembly) - - (n:8000) - - This is Suricata version 4.1.4 (rev 09ee165) - - [ERRCODE: SC_ERR_DPDK_CONFIG(319)] - No DPDK ports found #提示找不到绑定的网卡 <Error> - [ERRCODE: SC_ERR_DPDK_CONFIG(319)] - No DPDK ports found 解决方法： 在configure.ac中，替换i40e为ixgbe ``` ```shell 报错提示： pkg_check_modules(libpcreversion, libpcre = 8.35,libpcre_buggy_found="yes",libprce_buggy_found="no")' 解决办法： 需要编译安装automake及pkg-config两个工具。无需升级gcc10 ``` ```shell ### 报aclocal错误的问题 yum install automake 一般可解决 #编译安装automake wget https://ftp.gnu.org/gnu/automake/automake-1.15.tar.gz tar -xzvf automake-1.15.tar.gz cd automake-1.15 #编译安装pkg-config wget https://pkg-config.freedesktop.org/releases/pkg-config-0.29.2.tar.gz 解压 tar -zvxf pkg-config-0.29.2.tar.gz 编译安装 cd pkg-config-0.29.2 ./configure --prefix=$HOME/local/pkg-config --with-internal-glib make & make install 修改环境变量，在 ~/.profile 中加入以下行 export PATH=$PATH:$HOME/local/pkg-config/bin 检查是否安装成功 source ~/.profile pkg-config --version ``` 通过查阅资料，在issues中发现，默认的配置文件，在./configure的时候，configure.ac文件 https://github.com/vipinpv85/DPDK_SURICATA-4_1_1/issues/14
没有评论