The support tiers detailed below do not represent a binding commitment. Instead, they serve as a framework that the OISF employs to prioritize features and functionality.
Tier 1 supported items are developed and supported by the Suricata team. These items receive full CI (continuous integration) coverage, and functional failures block git merges and releases. Tier 1 features are enabled by default on platforms that support the feature.
Tier 2 supported items are developed and supported by the Suricata team, sometimes with help from community members. Major functional failures block git merges and releases, however less major issues may be documented as "known issues" and may go into a release. Tier 2 features and functionality may be disabled by default.
When a feature of Suricata is community supported, it means the OISF/Suricata development team won’t directly support it. This is to avoid overloading the team.
When accepting a feature into the code base anyway, it will come with a number of limits and conditions:
- submitter must commit to maintaining it:
- make sure code compiles and correctly functions after Suricata and/or external (e.g. library) changes.
- support users when they encounter problems on forum and redmine tickets.
- the code will be disabled by default and will not become part of the QA setup. This means it will be enabled only by an
--enableconfigure flag. - the code may not have CI coverage by the OISF infrastructure.
If the feature gets lots of traction, and/or if the team just considers it very useful, it may get ‘promoted’ to being officially supported.
On the other hand, the feature will be removed if the submitter stops maintaining it and no-one steps up to take over.
Vendor supported features are features specific to a certain vendor and usually require software and/or hardware from that vendor. While these features may exist in the main Suricata code, they rely on support from the vendor to keep the feature in a functional state.
Vendor supported functionality will generally not have CI or QA coverage by the OISF.
When a feature is unmaintained it is very likely broken and may be (partially) removed during cleanups and code refactoring. No end-user support is done by the core team. If someone wants to help maintain and support such a feature, we recommend talking to the core team before spending a lot of time on it.
Please see devguide/contributing/contribution-process for more information if you wish to contribute.
These tier 1 supported Linux distributions and operating systems receive full CI and QA, as well as documentation.
| Distribution | Version | Support | QA | Notes |
|---|---|---|---|---|
| RHEL/CentOS | 7 | OISF | ||
| RHEL/Alma/Rocky | 8 | OISF | ||
| RHEL/Alma/Rocky | 9 | OISF | ||
| Ubuntu | 20.04 | OISF | ||
| Ubuntu | 22.04 | OISF | ||
| Debian | 10 (Buster) | OISF | ||
| Debian | 11 (Bullseye) | OISF | Foundation of SELKS | |
| Debian | 12 (Bookworm) | OISF | ||
| FreeBSD | 12 | OISF | Foundation of OPNsense, pfSense | |
| FreeBSD | 13 | OISF | Foundation of OPNSense |
These tier 2 supported Linux distributions and operating systems receive CI but not full QA (functional testing).
| Distribution | Version | Support | QA | Notes |
|---|---|---|---|---|
| CentOS | Stream | OISF | ||
| Fedora | Active | OISF | ||
| OpenBSD | 7.2 | OISF | ||
| OpenBSD | 7.1 | OISF | ||
| OSX/macOS | ?? | OISF | ||
| Windows/MinGW64 | OISF |
| Architecture | Support | QA | Notes |
|---|---|---|---|
| x86_64 | OISF | ||
| ARM8-64bit | OISF |
| Architecture | Support | QA | Notes |
|---|---|---|---|
| ARM7-32bit | OISF | ||
| i386 | OISF |
| Architecture | Support | QA | Notes |
|---|---|---|---|
| PPC64el | Part of Fedora automated QA | Access can be arranged through IBM dev cloud | |
| PPC64 | No access to working hardware | ||
| PPC32 | No access to working hardware | ||
| RISC-V |
| Capture Type | Maintainer | QA | Notes |
|---|---|---|---|
| AF_PACKET | OISF | Used by Security Onion, SELKS | |
| NETMAP (FreeBSD) | OISF | Used by OPNsense, PFsense | |
| NFQUEUE | OISF | ||
| libpcap | OISF |
| Capture Type | Maintainer | QA | Notes |
|---|---|---|---|
| PF_RING | OISF | ||
| NETMAP (Linux) | OISF | ||
| DPDK | OISF | ||
| AF_PACKET (eBPF/XDP) | OISF |
| Capture Type | Maintainer | QA | Notes |
|---|---|---|---|
| NFLOG | Community | ||
| AF_XDP | Community |
| Capture Type | Maintainer | QA | Notes |
|---|---|---|---|
| Napatech | Napatech / Community |
| Capture Type | Maintainer | QA | Notes |
|---|---|---|---|
| IPFW | |||
| Endace/DAG |
| Mode | Maintainer | QA | Notes |
|---|---|---|---|
| IDS (passive) | OISF | ||
| IPS (active) | OISF | ||
| Offline pcap file | OISF |
| Mode | Maintainer | QA | Notes |
|---|---|---|---|
| Unix socket mode | OISF | ||
| IDS (active) | OISF | Active responses, reject keyword |