SURICATASC(1)

NAME
suricatasc - Tool to interact via unix socket

SYNOPSIS

suricatasc [OPTIONS] [SOCKET]

DESCRIPTION

Suricata socket control tool

SOCKET

Optional path to Suricata unix socket

OPTIONS

    -v, --verbose
        Enable verbose output

    -c, --command <COMMAND>
        Execute command and return JSON

    -h, --help
        Print help

COMMANDS

    shutdown
        Shut Suricata instance down.

    command-list
        List available commands.

    help
        Get help about the available commands.

    version
        Print the version of Suricata instance.

    uptime
        Display the uptime of Suricata.

    running-mode
        Display running mode. This can either be workers, autofp or single.

    capture-mode
        Display the capture mode. This can be either of PCAP_DEV, PCAP_FILE, PFRING(DISABLED), NFQ, NFLOG, IPFW, ERF_FILE, ERF_DAG, AF_PACKET_DEV, NETMAP(DISABLED), UNIX_SOCKET or WINDIVERT(DISABLED).

    conf-get <variable>
        Get configuration value for a given variable. Variable to be provided can be either of the configuration parameters that are written in suricata.yaml.

    dump-counters
        Dump Suricata's performance counters.

    ruleset-reload-rules
        Reload the ruleset and wait for completion.

    reload-rules
        Alias .. describe ruleset-reload-rules.

    ruleset-reload-nonblocking
        Reload ruleset and proceed without waiting.

    ruleset-reload-time
        Return time of last reload.

    ruleset-stats
        Display the number of rules loaded and failed.

    ruleset-failed-rules
        Display the list of failed rules.

    register-tenant-handler <id> <htype> [hargs]
        Register a tenant handler with the specified mapping.

    unregister-tenant-handler <id> <htype> [hargs]
        Unregister a tenant handler with the specified mapping.

    register-tenant <id> <filename>
        Register tenant with a particular ID and filename.

    reload-tenant <id> [filename]
        Reload a tenant with specified ID. A filename to a tenant yaml can be specified. If it is omitted, the original yaml that was used to load / last reload the tenant is used.

    reload-tenants
        Reload all registered tenants by reloading their yaml.

    unregister-tenant <id>
        Unregister tenant with a particular ID.

    add-hostbit <ipaddress> <hostbit> <expire>
        Add hostbit on a host IP with a particular bit name and time of expiry.

    remove-hostbit <ipaddress> <hostbit>
        Remove hostbit on a host IP with specified IP address and bit name.

    list-hostbit <ipaddress>
        List hostbit for a particular host IP.

    reopen-log-files
        Reopen log files to be run after external log rotation.

    memcap-set <config> <memcap>
        Update memcap value of a specified item.

    memcap-show <config>
        Show memcap value of a specified item.

    memcap-list
        List all memcap values available.

    get-flow-stats-by-id <flow_id>
        Display information for a specific flow using flow_id values.

PCAP MODE COMMANDS

    pcap-file <file> <dir> [tenant] [continuous] [delete-when-done]
        Add pcap files to Suricata for sequential processing. The generated log/alert files will be put into the directory specified as second argument. Make sure to provide absolute path to the files and directory. It is acceptable to add multiple files without waiting the result.

    pcap-file-continuous <file> <dir> [tenant] [delete-when-done]
        Add pcap files to Suricata for sequential processing. Directory will be monitored for new files being added until there is a use of pcap-interrupt or directory is moved or deleted.

    pcap-file-number
        Number of pcap files waiting to get processed.

    pcap-file-list
        List of queued pcap files.

    pcap-last-processed
        Processed time of last file in milliseconds since epoch.

    pcap-interrupt
        Terminate the current state by interrupting directory processing.

    pcap-current
        Currently processed file.

BUGS

Please visit Suricata's support page for information about submitting bugs or feature requests.

NOTES

    •   Suricata Home Page
            https://suricata.io/

    •   Suricata Support Page
            https://suricata.io/support/

COPYRIGHT
2016-2026, OISF