1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
|
==============
Support Status
==============
Levels of Support
=================
The support tiers detailed below do not represent a binding
commitment. Instead, they serve as a framework that the OISF employs
to prioritize features and functionality.
Tier 1
------
Tier 1 supported items are developed and supported by the Suricata
team. These items receive full CI (continuous integration)
coverage, and functional failures block git merges and releases. Tier
1 features are enabled by default on platforms that support the
feature.
Tier 2
------
Tier 2 supported items are developed and supported by the Suricata
team, sometimes with help from community members. Major functional
failures block git merges and releases, however less major issues
may be documented as "known issues" and may go into a release. Tier 2
features and functionality may be disabled by default.
Community
---------
When a feature of Suricata is community supported, it means the
OISF/Suricata development team won’t directly support it. This is to
avoid overloading the team.
When accepting a feature into the code base anyway, it will come with
a number of limits and conditions:
* submitter must commit to maintaining it:
- make sure code compiles and correctly functions after Suricata
and/or external (e.g. library) changes.
- support users when they encounter problems on forum and
redmine tickets.
* the code will be disabled by default and will not become part of the
QA setup. This means it will be enabled only by an ``--enable``
configure flag.
* the code may not have CI coverage by the OISF infrastructure.
If the feature gets lots of traction, and/or if the team just
considers it very useful, it may get ‘promoted’ to being officially
supported.
On the other hand, the feature will be removed if the submitter stops
maintaining it and no-one steps up to take over.
Vendor
------
Vendor supported features are features specific to a certain vendor
and usually require software and/or hardware from that vendor. While
these features may exist in the main Suricata code, they rely on
support from the vendor to keep the feature in a functional state.
Vendor supported functionality will generally not have CI or QA
coverage by the OISF.
Unmaintained
------------
When a feature is unmaintained it is very likely broken and may be
(partially) removed during cleanups and code refactoring. No end-user
support is done by the core team. If someone wants to help maintain
and support such a feature, we recommend talking to the core team
before spending a lot of time on it.
Please see :doc:`devguide/contributing/contribution-process`
for more information if you wish to contribute.
Distributions
=============
Tier 1
------
These tier 1 supported Linux distributions and operating systems
receive full CI and QA, as well as documentation.
.. table::
:widths: 20 15 15 10 40
:width: 100%
+------------------+-------------+----------+-------+--------------------------------+
|Distribution |Version |Support |QA |Notes |
+==================+=============+==========+=======+================================+
|RHEL/CentOS |7 |OISF | | |
+------------------+-------------+----------+-------+--------------------------------+
|RHEL/Alma/Rocky |8 |OISF | | |
+------------------+-------------+----------+-------+--------------------------------+
|RHEL/Alma/Rocky |9 |OISF | | |
+------------------+-------------+----------+-------+--------------------------------+
|Ubuntu |20.04 |OISF | | |
+------------------+-------------+----------+-------+--------------------------------+
|Ubuntu |22.04 |OISF | | |
+------------------+-------------+----------+-------+--------------------------------+
|Debian |10 (Buster) |OISF | | |
+------------------+-------------+----------+-------+--------------------------------+
|Debian |11 (Bullseye)|OISF | |Foundation of SELKS |
+------------------+-------------+----------+-------+--------------------------------+
|Debian |12 (Bookworm)|OISF | | |
+------------------+-------------+----------+-------+--------------------------------+
|FreeBSD |12 |OISF | |Foundation of OPNsense, pfSense |
+------------------+-------------+----------+-------+--------------------------------+
|FreeBSD |13 |OISF | |Foundation of OPNSense |
+------------------+-------------+----------+-------+--------------------------------+
Tier 2
------
These tier 2 supported Linux distributions and operating systems
receive CI but not full QA (functional testing).
.. table::
:widths: 20 15 15 10 40
:width: 100%
+------------------+----------+----------+-------+--------------------------------+
|Distribution |Version |Support |QA |Notes |
+==================+==========+==========+=======+================================+
|CentOS |Stream |OISF | | |
+------------------+----------+----------+-------+--------------------------------+
|Fedora |Active |OISF | | |
+------------------+----------+----------+-------+--------------------------------+
|OpenBSD |7.2 |OISF | | |
+------------------+----------+----------+-------+--------------------------------+
|OpenBSD |7.1 |OISF | | |
+------------------+----------+----------+-------+--------------------------------+
|OSX/macOS |?? |OISF | | |
+------------------+----------+----------+-------+--------------------------------+
|Windows/MinGW64 | |OISF | | |
+------------------+----------+----------+-------+--------------------------------+
Architecture Support
====================
Tier 1
------
.. table::
:widths: 15 15 30 40
:width: 100%
+-------------+-------------+-------------+-------------+
|Architecture |Support |QA |Notes |
+=============+=============+=============+=============+
|x86_64 |OISF | | |
+-------------+-------------+-------------+-------------+
|ARM8-64bit |OISF | | |
+-------------+-------------+-------------+-------------+
Tier 2
------
.. table::
:widths: 15 15 30 40
:width: 100%
+-------------+-------------+-------------+-------------+
|Architecture |Support |QA |Notes |
+=============+=============+=============+=============+
|ARM7-32bit |OISF | | |
+-------------+-------------+-------------+-------------+
|i386 |OISF | | |
+-------------+-------------+-------------+-------------+
Community
---------
.. table::
:widths: 15 15 30 40
:width: 100%
+-------------+-------------+---------------------------+---------------------------------------------+
|Architecture |Support |QA |Notes |
+=============+=============+===========================+=============================================+
|PPC64el | |Part of Fedora automated QA|Access can be arranged through IBM dev cloud |
+-------------+-------------+---------------------------+---------------------------------------------+
|PPC64 | | |No access to working hardware |
+-------------+-------------+---------------------------+---------------------------------------------+
|PPC32 | | |No access to working hardware |
+-------------+-------------+---------------------------+---------------------------------------------+
|RISC-V | | | |
+-------------+-------------+---------------------------+---------------------------------------------+
High Level Features
-------------------
Capture support
~~~~~~~~~~~~~~~
Tier 1
^^^^^^
.. table::
:width: 100%
+----------------+-------------------------+----+-----------------------------+
| Capture Type | Maintainer | QA | Notes |
+================+=========================+====+=============================+
|AF_PACKET |OISF | |Used by Security Onion, SELKS|
+----------------+-------------------------+----+-----------------------------+
|NETMAP (FreeBSD)|OISF | |Used by OPNsense, PFsense |
+----------------+-------------------------+----+-----------------------------+
|NFQUEUE |OISF | | |
+----------------+-------------------------+----+-----------------------------+
|libpcap |OISF | | |
+----------------+-------------------------+----+-----------------------------+
Tier 2
^^^^^^
.. table::
:width: 100%
+--------------------+-------------------------+----+---------------+
|Capture Type |Maintainer |QA |Notes |
+====================+=========================+====+===============+
|PF_RING |OISF | | |
+--------------------+-------------------------+----+---------------+
|NETMAP (Linux) |OISF | | |
+--------------------+-------------------------+----+---------------+
|DPDK |OISF | | |
+--------------------+-------------------------+----+---------------+
|AF_PACKET (eBPF/XDP)|OISF | | |
+--------------------+-------------------------+----+---------------+
Community
^^^^^^^^^
.. table::
:width: 100%
+--------------------+--------------------------+----+---------------+
|Capture Type |Maintainer |QA |Notes |
+====================+==========================+====+===============+
|NFLOG |Community | | |
+--------------------+--------------------------+----+---------------+
|AF_XDP |Community | | |
+--------------------+--------------------------+----+---------------+
Vendor
^^^^^^
.. table::
:width: 100%
+--------------------+--------------------------+----+---------------+
|Capture Type |Maintainer |QA |Notes |
+====================+==========================+====+===============+
|Napatech |Napatech / Community | | |
+--------------------+--------------------------+----+---------------+
Unmaintained
^^^^^^^^^^^^
.. table::
:width: 100%
+---------------+-------------------------+----+---------------+
|Capture Type |Maintainer |QA |Notes |
+===============+=========================+====+===============+
|IPFW | | | |
+---------------+-------------------------+----+---------------+
|Endace/DAG | | | |
+---------------+-------------------------+----+---------------+
Operation modes
~~~~~~~~~~~~~~~
Tier 1
^^^^^^
.. table::
:width: 100%
:widths: 25 25 10 40
+-----------------+------------------------+------+--------------------------------+
|Mode |Maintainer |QA |Notes |
+=================+========================+======+================================+
|IDS (passive) |OISF | | |
+-----------------+------------------------+------+--------------------------------+
|IPS (active) |OISF | | |
+-----------------+------------------------+------+--------------------------------+
|Offline pcap file|OISF | | |
+-----------------+------------------------+------+--------------------------------+
Tier 2
^^^^^^
.. table::
:width: 100%
:widths: 25 25 10 40
+-----------------+------------------------+------+--------------------------------+
|Mode |Maintainer |QA |Notes |
+=================+========================+======+================================+
|Unix socket mode |OISF | | |
+-----------------+------------------------+------+--------------------------------+
|IDS (active) |OISF | |Active responses, reject keyword|
+-----------------+------------------------+------+--------------------------------+
|
