snort 联动iptables 配置为IPS，NIDS

一、环境准备
Ubuntu16.10，snort2.9.9，iptables1.6.0，daq-2.0.6

二、snort安装
首先关掉网卡的“Large Receive Offload” (lro) and “Generic Receive Offload” (gro).
看snort手册：

Some network cards have features named “Large Receive Offload” (lro) and “Generic Receive Offload” (gro). With these features enabled, the network card performs packet reassembly before they’re processed by the kernel. By default, Snort will truncate packets larger than the default snaplen of 1518 bytes. In addition, LRO and GRO may cause issues with Stream5 target-based reassembly. We recommend that you turn off LRO and GRO.

执行以下命令：

sudo vi /etc/network/interfaces

打开interfaces后加入下面两句：

post-up ethtool -K enp0s3 gro off
post-up ethtool -K enp0s3 lro off

根据自己的网卡名进行更改，关于网卡名的变更详见

Important note for people running Ubuntu 16: Begining with Ubuntu 15.10, network interfaces no longer follow the ethX standard (eth0, eth1, …). Instead, interfaces names are assigned as Predictable Network Interface Names. This means you need to check the names of your interfaces using ifconfig -a. In my case, what was originally eth0 is now ens160. If you are running Ubuntu 15.10, anywhere in this guide you see eth0, you will need to replace with your new interface name.

安装依赖包

sudo apt-get install -y build-essential libpcap-dev libpcre3-dev libdumbnet-dev bison flex z