Increasing Suricata Cache memory limits

This procedure applies when the number of source ports in the switch mirroring (SPAN) session is
24 or more. Barracuda recommends increasing Suricata cache memory from the default 1 MB to 8 MB.

Step 1 – Stop Suricata

1. Open Services on the Windows Server.

2. Locate the Suricata service.

3. Click Stop.

Step 2 – Open suricata.yaml

1. Open a text editor as Administrator.

2. Open the file: C:\Program Files\Suricata\suricata.yaml

Step 3 – Locate the PCAP section

1. In suricata.yaml, locate the pcap section. It typically looks like this:
   pcap: - interface: Ethernet

Step 4 – Increase cache memory to 8 MB

• Under the same pcap block, add:
  pcap: - interface: Ethernet buffer-size: 8mb

Step 5 – Save the configuration

1. Save suricata.yaml.

2. Close the text editor.

Step 6 – Start Suricata

1. Return to Services.

2. Start the Suricata service.

Step 7 – Verification (Optional)

• Open the log file below and confirm Suricata starts without errors:
  C:\Program Files\Suricata\log\suricata.log