{"id":113,"date":"2023-04-08T11:25:05","date_gmt":"2023-04-08T11:25:05","guid":{"rendered":"https:\/\/idstower.com\/blog\/?p=113"},"modified":"2026-10-27T03:03:39","modified_gmt":"2026-10-27T03:03:39","slug":"building-a-custom-suricata-deb-package","status":"publish","type":"post","link":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/","title":{"rendered":"Building a Custom Suricata DEB Package"},"content":{"rendered":"\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Updated October 2026:<\/strong> rewritten for Suricata 8.0 on Ubuntu 24.04 LTS. The April 2023 version built Suricata 6.0, which reached end of life in August 2024. The package now lists every library it needs, builds with the same compiler hardening as the official package, adds AF_XDP capture and Suricata&#8217;s eBPF programs, and keeps apt from replacing it with Ubuntu&#8217;s own Suricata.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Suricata is published as source code and as ready-built packages, such as the RPM and DEB packages from Linux distributions and the OISF <a href=\"https:\/\/launchpad.net\/~oisf\/+archive\/ubuntu\/suricata-stable\">Ubuntu PPA<\/a>. Those packages are the easy way to install and upgrade Suricata. They are built for the most common setups, though, so some features you may want are left out, and to get them you have to compile Suricata yourself.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One of IDSTower&#8217;s users needed Suricata to capture with Napatech NICs, a feature the standard packages don&#8217;t enable, and compiling Suricata by hand on every host of the cluster was too much work. They needed to compile it once and deploy it to the whole cluster with IDSTower&#8217;s <a href=\"https:\/\/idstower.com\/docs\/advance\/custom_built_packages_repo.html\">User-Custom Packages Repository<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this post we&#8217;ll build a Suricata .deb package that keeps every feature of the official Ubuntu package and adds what it leaves out for high-speed capture: eBPF and XDP support, and AF_XDP capture. For Rocky Linux, AlmaLinux and RHEL, see <a href=\"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/\">Building a Custom Suricata RPM Package<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The build setup<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We used:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ubuntu 24.04 LTS (Noble Numbat), x86_64<\/li>\n\n\n\n<li>Suricata 8.0.7, the current stable release<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Two things to know before you start:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Build on the same OS release as your sensors.<\/strong> A .deb package depends on the library versions of the release it was built on, so a package built on Ubuntu 24.04 is for Ubuntu 24.04 hosts. For sensors on another release, run the same steps on that release. Suricata 8 needs Rust 1.75 or newer: Ubuntu 24.04 ships 1.75, while Debian 12 ships 1.63, so there you need a newer Rust from <a href=\"https:\/\/rustup.rs\/\">rustup<\/a>. Check with <code>rustc --version<\/code>.<\/li>\n\n\n\n<li><strong>Build on a build machine, not on a sensor.<\/strong> checkinstall packages Suricata by running <code>make install<\/code> for real and recording what it installs, so the machine that builds the package ends up with Suricata installed too. A VM or a container works well.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Building the Suricata .deb package<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A .deb package is an archive of a program&#8217;s files, plus a description of the package: its name, its version, and the other packages it depends on. To build one, we download the Suricata source code, configure it with the features we want, compile it, and package the result. Run all the steps in the same shell, because later steps use variables that earlier ones set.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Compiling the source code<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, install the tools and libraries needed to build Suricata from source. This is the official Ubuntu package&#8217;s list of build dependencies, plus <code>libelf-dev<\/code>, <code>libbpf-dev<\/code>, <code>clang<\/code> and <code>llvm<\/code> for eBPF, and <code>libxdp-dev<\/code> for AF_XDP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt -y install build-essential pkg-config rustc cargo wget checkinstall \\\n    libpcre2-dev libyaml-dev libjansson-dev libpcap-dev libcap-ng-dev \\\n    libmagic-dev libnet1-dev libnetfilter-queue-dev libnss3-dev libnspr4-dev \\\n    libmaxminddb-dev libhiredis-dev libevent-dev libhyperscan-dev \\\n    liblz4-dev liblzma-dev zlib1g-dev libunwind-dev python3 python3-yaml \\\n    libelf-dev libbpf-dev clang llvm libxdp-dev<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then create a directory for the build, and download and extract the source code into it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SURICATA_VERSION=8.0.7\nmkdir suricata_build\ncd suricata_build\/\nwget https:\/\/www.openinfosecfoundation.org\/download\/suricata-$SURICATA_VERSION.tar.gz\ntar xzf suricata-$SURICATA_VERSION.tar.gz\ncd suricata-$SURICATA_VERSION\/<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Next, set the same compiler hardening flags the official package uses, such as stack protection and full RELRO. <code>dpkg-buildflags<\/code> prints Ubuntu&#8217;s standard set, and the official package adds <code>bindnow<\/code> and <code>pie<\/code> and turns off link-time optimization:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>export DEB_BUILD_MAINT_OPTIONS=\"hardening=+pie,+bindnow optimize=-lto\"\neval \"$(dpkg-buildflags --export=sh)\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now configure the build. These are the options the official Ubuntu package is built with, plus two for eBPF at the end: <code>--enable-ebpf<\/code> adds eBPF and XDP support, and <code>--enable-ebpf-build<\/code> uses clang to compile the eBPF programs that come with Suricata, for load balancing, flow bypass and XDP filtering. AF_XDP needs no option: configure turns it on when it finds <code>libxdp<\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/configure --prefix=\/usr\/ --sysconfdir=\/etc\/ --localstatedir=\/var\/ \\\n    --enable-nfqueue --disable-gccmarch-native --enable-hiredis --enable-geoip \\\n    --enable-gccprotect --enable-pie \\\n    --enable-ebpf --enable-ebpf-build<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The summary that configure prints at the end should show AF_XDP, eBPF and XDP support enabled:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Suricata Configuration:\n  AF_PACKET support:                       yes\n  AF_XDP support:                          yes\n  DPDK support:                            no\n  eBPF support:                            yes\n  XDP support:                             yes<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now compile Suricata, on every CPU core:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>make -j\"$(nproc)\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">It takes a few minutes, depending on the machine. You&#8217;ll see many <code>\"_FORTIFY_SOURCE\" redefined<\/code> warnings: the hardening flags and <code>--enable-gccprotect<\/code> both set it, as they do when the official package is built. They are harmless.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Creating the DEB package<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To create the package, we&#8217;ll use checkinstall, one of the easiest ways to turn compiled source code into a .deb or .rpm package.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Suricata&#8217;s <code>make install<\/code> doesn&#8217;t install the eBPF programs, so copy them to <code>\/usr\/libexec\/suricata\/ebpf\/<\/code>, where <a href=\"https:\/\/docs.suricata.io\/en\/latest\/capture-hardware\/ebpf-xdp.html\">Suricata&#8217;s eBPF guide<\/a> puts them. Then list the directories for checkinstall to include in the package, along with the configuration and log directories:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo mkdir -p \/usr\/libexec\/suricata\/ebpf\nsudo cp ebpf\/*.bpf \/usr\/libexec\/suricata\/ebpf\/\necho \"\/etc\/suricata\" > suricata_extra_files\necho \"\/var\/log\/suricata\" >> suricata_extra_files\necho \"\/usr\/libexec\/suricata\/ebpf\" >> suricata_extra_files<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The package also has to name the libraries Suricata needs, so that apt installs them along with it on every host. Rather than typing the list in, let <code>dpkg-shlibdeps<\/code> work it out from the compiled program, which is how the official package gets its list. It needs an empty <code>debian\/control<\/code> file to run. Suricata&#8217;s rule updater, <code>suricata-update<\/code>, is written in Python, so it also needs <code>python3<\/code> and <code>python3-yaml<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p debian &amp;&amp; touch debian\/control\nSURICATA_DEPENDS=\"$(dpkg-shlibdeps -O src\/suricata | sed -e 's\/^shlibs:Depends=\/\/' -e 's\/ (&#91;^)]*)\/\/g'), python3, python3-yaml\"\necho \"$SURICATA_DEPENDS\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>dpkg-shlibdeps<\/code> prints a few warnings about diversions and about the program not being installed yet, which are expected here. The <code>sed<\/code> removes the version constraints, such as <code>(>= 2.38)<\/code>, because checkinstall drops a dependency list that contains them: it prints a shell syntax error, carries on, and builds a package with no dependencies. The library package names already include each library&#8217;s version, so the package still matches this release. You should see:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>libbpf1, libc6, libcap-ng0, libevent-2.1-7t64, libevent-pthreads-2.1-7t64, libhiredis1.1.0, libhyperscan5, libjansson4, liblz4-1, libmagic1t64, libmaxminddb0, libnet1, libnetfilter-queue1, libnfnetlink0, libpcap0.8t64, libpcre2-8-0, libunwind8, libxdp1, libyaml-0-2, zlib1g, python3, python3-yaml<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now build the package:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo checkinstall -y -D --install=no --fstrans=no --backup=no \\\n    --pkgname=suricata --pkgversion=1:$SURICATA_VERSION --pkgrelease=1 \\\n    --exclude=\/home,\/root --include=.\/suricata_extra_files \\\n    --requires=\"$SURICATA_DEPENDS\" \\\n    make install install-conf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>1:<\/code> at the start of the version is an epoch. Ubuntu&#8217;s own Suricata package is version <code>1:7.0.3<\/code>, and apt ranks any version with epoch 1 above every version without an epoch. Without it, apt would treat Ubuntu&#8217;s older Suricata as an upgrade and replace your build the next time you run <code>apt upgrade<\/code>. The official PPA versions its packages the same way.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">checkinstall writes the package to the source directory, as <code>suricata_8.0.7-1_amd64.deb<\/code>; the epoch isn&#8217;t part of the file name.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Installing and checking the package<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Copy the package to a host running the same release, and install it. apt installs the libraries it depends on from the host&#8217;s repositories:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install -y .\/suricata_8.0.7-1_amd64.deb<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then check that AF_XDP, eBPF and XDP support are enabled:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ suricata --build-info\nThis is Suricata version 8.0.7 RELEASE\nFeatures: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HTTP2_DECOMPRESSION HAVE_LUA HAVE_JA3 HAVE_JA4 HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST POPCNT64\n...\nSuricata Configuration:\n  AF_PACKET support:                       yes\n  AF_XDP support:                          yes\n  DPDK support:                            no\n  eBPF support:                            yes\n  XDP support:                             yes\n  PF_RING support:                         no\n  NFQueue support:                         yes\n...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The eBPF programs are in <code>\/usr\/libexec\/suricata\/ebpf\/<\/code>. To use one, point the <code>af-packet<\/code> section of <code>suricata.yaml<\/code> at it, for example <code>ebpf-lb-file: \/usr\/libexec\/suricata\/ebpf\/lb.bpf<\/code> with <code>cluster-type: cluster_ebpf<\/code>. <a href=\"https:\/\/docs.suricata.io\/en\/latest\/capture-hardware\/ebpf-xdp.html\">Suricata&#8217;s eBPF and XDP guide<\/a> covers each program.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AF_XDP is a capture method of its own, next to AF_PACKET: start Suricata with <code>--af-xdp=&lt;interface><\/code>, or set it up in the <code>af-xdp<\/code> section of <code>suricata.yaml<\/code>, as <a href=\"https:\/\/docs.suricata.io\/en\/latest\/capture-hardware\/af-xdp.html\">Suricata&#8217;s AF_XDP guide<\/a> explains. Suricata starts one AF_XDP capture thread per receive queue that the network card reports, up to the number of CPU cores, so it needs a card whose driver reports its queues. A container&#8217;s virtual interface reports none: Suricata logs <code>af-xdp: 0 queues, so using 0 threads<\/code> and captures nothing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Building with other features<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The same steps enable other features that the official packages leave out, such as Napatech and PF_RING support: install the vendor&#8217;s driver and libraries on the build machine, and add the option to the <code>.\/configure<\/code> line (<code>--enable-napatech<\/code> or <code>--enable-pfring<\/code>). The vendor&#8217;s libraries don&#8217;t come from an Ubuntu package, so the package won&#8217;t install them: install the vendor&#8217;s driver on every sensor as well.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How IDSTower can help<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/idstower.com\/\">IDSTower<\/a> deploys your package to every host of a cluster with its <a href=\"https:\/\/idstower.com\/docs\/advance\/custom_built_packages_repo.html\">User-Custom Packages Repository<\/a>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Copy the package and its dependencies once.<\/strong> Put them on the IDSTower server, in a folder named after the Suricata version and the hosts&#8217; OS release and architecture: <code>\/opt\/idstower\/custom\/Suricata\/packages\/8.0.7\/Ubuntu24\/x86_64\/<\/code>. Version 8.0.7 then shows up in the cluster setup wizard.<\/li>\n\n\n\n<li><strong>IDSTower installs them on every host<\/strong>, including hosts without internet access, and checks that each host reports the version you picked. It then runs Suricata under its own configuration and services, alongside health monitoring and rule life-cycle management, from one web interface.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To collect the dependency packages, run this on a host set up like your sensors, with the same release and without Suricata, then copy the .deb files from <code>\/var\/cache\/apt\/archives\/<\/code> into the folder, next to your package:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get clean\nsudo apt-get install --download-only -y .\/suricata_8.0.7-1_amd64.deb<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Try it in the <a href=\"https:\/\/demo.idstower.com\/\">live demo<\/a> (no signup), or <a href=\"https:\/\/idstower.com\/getLicense.php?type=Standard\">get a free license<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Updated October 2026: rewritten for Suricata 8.0 on Ubuntu 24.04 LTS. The April 2023 version built Suricata 6.0, which reached end of life in August 2024. The package now lists every library it needs, builds with the same compiler hardening as the official package, adds AF_XDP capture and Suricata&#8217;s eBPF programs, and keeps apt from [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[3],"tags":[13,8,14],"class_list":["post-113","post","type-post","status-publish","format-standard","hentry","category-suricata-ids","tag-deb","tag-suricata","tag-ubuntu"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Building a Custom Suricata DEB Package - IDSTower Blog<\/title>\n<meta name=\"description\" content=\"Compile Suricata 8 with the features its standard packages leave out, such as eBPF, and build your own .deb package to deploy across your IDS cluster.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Building a Custom Suricata DEB Package - IDSTower Blog\" \/>\n<meta property=\"og:description\" content=\"Compile Suricata 8 with the features its standard packages leave out, such as eBPF, and build your own .deb package to deploy across your IDS cluster.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/\" \/>\n<meta property=\"og:site_name\" content=\"IDSTower Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-08T11:25:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-27T03:03:39+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@IDSTower\" \/>\n<meta name=\"twitter:site\" content=\"@IDSTower\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-deb-package\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-deb-package\\\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/person\\\/de3006b0e8ec6f07ed283b57edc0137d\"},\"headline\":\"Building a Custom Suricata DEB Package\",\"datePublished\":\"2023-04-08T11:25:05+00:00\",\"dateModified\":\"2026-10-27T03:03:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-deb-package\\\/\"},\"wordCount\":1272,\"publisher\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\"},\"keywords\":[\"DEB\",\"Suricata\",\"Ubuntu\"],\"articleSection\":[\"Suricata IDS\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-deb-package\\\/\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-deb-package\\\/\",\"name\":\"Building a Custom Suricata DEB Package - IDSTower Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#website\"},\"datePublished\":\"2023-04-08T11:25:05+00:00\",\"dateModified\":\"2026-10-27T03:03:39+00:00\",\"description\":\"Compile Suricata 8 with the features its standard packages leave out, such as eBPF, and build your own .deb package to deploy across your IDS cluster.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-deb-package\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-deb-package\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-deb-package\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Building a Custom Suricata DEB Package\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\",\"name\":\"IDSTower Blog\",\"description\":\"Suricata tutorials and guides\",\"publisher\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/idstower.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\",\"name\":\"IDSTower\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/logo-min-1.png\",\"contentUrl\":\"https:\\\/\\\/idstower.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/logo-min-1.png\",\"width\":184,\"height\":50,\"caption\":\"IDSTower\"},\"image\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/IDSTower\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/person\\\/de3006b0e8ec6f07ed283b57edc0137d\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"http:\\\/\\\/idstower.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Building a Custom Suricata DEB Package - IDSTower Blog","description":"Compile Suricata 8 with the features its standard packages leave out, such as eBPF, and build your own .deb package to deploy across your IDS cluster.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/","og_locale":"en_US","og_type":"article","og_title":"Building a Custom Suricata DEB Package - IDSTower Blog","og_description":"Compile Suricata 8 with the features its standard packages leave out, such as eBPF, and build your own .deb package to deploy across your IDS cluster.","og_url":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/","og_site_name":"IDSTower Blog","article_published_time":"2023-04-08T11:25:05+00:00","article_modified_time":"2026-10-27T03:03:39+00:00","author":"admin","twitter_card":"summary_large_image","twitter_creator":"@IDSTower","twitter_site":"@IDSTower","twitter_misc":{"Written by":"admin","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/#article","isPartOf":{"@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/"},"author":{"name":"admin","@id":"https:\/\/idstower.com\/blog\/#\/schema\/person\/de3006b0e8ec6f07ed283b57edc0137d"},"headline":"Building a Custom Suricata DEB Package","datePublished":"2023-04-08T11:25:05+00:00","dateModified":"2026-10-27T03:03:39+00:00","mainEntityOfPage":{"@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/"},"wordCount":1272,"publisher":{"@id":"https:\/\/idstower.com\/blog\/#organization"},"keywords":["DEB","Suricata","Ubuntu"],"articleSection":["Suricata IDS"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/","url":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/","name":"Building a Custom Suricata DEB Package - IDSTower Blog","isPartOf":{"@id":"https:\/\/idstower.com\/blog\/#website"},"datePublished":"2023-04-08T11:25:05+00:00","dateModified":"2026-10-27T03:03:39+00:00","description":"Compile Suricata 8 with the features its standard packages leave out, such as eBPF, and build your own .deb package to deploy across your IDS cluster.","breadcrumb":{"@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/idstower.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Building a Custom Suricata DEB Package"}]},{"@type":"WebSite","@id":"https:\/\/idstower.com\/blog\/#website","url":"https:\/\/idstower.com\/blog\/","name":"IDSTower Blog","description":"Suricata tutorials and guides","publisher":{"@id":"https:\/\/idstower.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/idstower.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/idstower.com\/blog\/#organization","name":"IDSTower","url":"https:\/\/idstower.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/idstower.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min-1.png","contentUrl":"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min-1.png","width":184,"height":50,"caption":"IDSTower"},"image":{"@id":"https:\/\/idstower.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/IDSTower"]},{"@type":"Person","@id":"https:\/\/idstower.com\/blog\/#\/schema\/person\/de3006b0e8ec6f07ed283b57edc0137d","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","caption":"admin"},"sameAs":["http:\/\/idstower.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/comments?post=113"}],"version-history":[{"count":13,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/113\/revisions"}],"predecessor-version":[{"id":164,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/113\/revisions\/164"}],"wp:attachment":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/media?parent=113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/categories?post=113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/tags?post=113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}