关闭

snort 笔记1 ----- 3种模式简介

标签: preprocessortcplibrarydatabaseinterfacebuild
5360人阅读 评论(0) 收藏 举报
分类:

snort笔记:2011-04-18

 

链接snort中文手册,比较老的一个:

http://man.chinaunix.net/network/snort/Snortman.htm


一 基本操作:


1 配置文件位置:/etc/snort

2 运行:./snort 需要root权限 【这是cd到/usr/sbin目录后的操作,要是在别的目录下,可以通过制定全路径】


【补充:linux下执行程序,如果在当前目录下的执行文件,则需要加 ./程序名 ,如果是全路径,则不需要加这个点,比如

这里全路径指向snort: /usr/sbin/snort -vde 等, ./表示相对当前目录】


3 开机自启动关闭:http://blog.csdn.net/jo_say/archive/2011/03/08/6232952.aspx

snort2345级默认开启,通过chkconfig –-level 2345 snort off.就可将其关闭。(chkconfig操作见:http://blog.csdn.net/jo_say/archive/2011/04/18/6330466.aspx

(网上介绍:onoff开关,系统默认只对运行级345有效,但是reset可以对所有运行级有效,但是我刚才好像把2off了,也ok



二:三种模式:


1 嗅探 (snort从网络上读出数据包并将其显示在控制台上)
2 数据包记录器(将数据包记录在硬盘上)

3 NIDS(最复杂,可配置,允许snort匹配用户自定义的数据集,并根据检测结果执行一定的动作)


三:实际操作: 


  • 嗅探模式


1. ./snort -v 

启动snort后会显示:

【1】模式

【2】初始化输出插件

【3】显示snort版本信息和版权信息

【4】显示数据包到控制台

****************************************************************************************************************************


root@helloworld:/# ./usr/sbin/snort -v

Running in packet dump mode 数据包转储模式

        --== Initializing Snort ==--

Initializing Output Plugins!

***

*** interface device lookup found: eth0

***

Initializing Network Interface eth0

Decoding Ethernet on interface eth0


        --== Initialization Complete ==--


   ,,_     -*> Snort! <*-

  o"  )~   Version 2.8.5.2 (Build 121)  

   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team

           Copyright (C) 1998-2009 Sourcefire, Inc., et al.

           Using PCRE version: 8.02 2010-03-19


Not Using PCAP_FRAMES // 为什么会提示?见 http://blog.csdn.net/jo_say/archive/2011/04/18/6331819.aspx]



//下面这个数据包是外部主机发往局域网其它主机的数据包


04/18-16:32:10.267583 118.239.104.219:1119 -> 172.26.75.118:10118

UDP TTL:52 TOS:0x0 ID:5308 IpLen:20 DgmLen:68

Len: 40

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


// 下面这个数据包是本机发往csdn的80端口的数据包


04/18-16:32:10.609564 172.26.75.115:39112 -> 211.100.26.77:80

TCP TTL:64 TOS:0x0 ID:12047 IpLen:20 DgmLen:40 DF

***A***F Seq: 0xD2B01068  Ack: 0xCA0FABA  Win: 0x8E  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


04/18-16:32:10.609645 172.26.75.115:39068 -> 211.100.26.77:80

TCP TTL:64 TOS:0x0 ID:61231 IpLen:20 DgmLen:40 DF

***A***F Seq: 0x9969190B  Ack: 0x8879377  Win: 0xD0  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

**********************************************************************************


2 默认只显示包头信息,如果需要显示数据包应用层的内容,需要加上-d 参数:

结果如下所示,摘取其二:


=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


04/18-18:26:52.610961 172.26.75.115:34474 -> 211.100.26.77:80

TCP TTL:64 TOS:0x0 ID:2855 IpLen:20 DgmLen:536 DF

***AP*** Seq: 0x296C9AB4  Ack: 0xA891280A  Win: 0x5C  TcpLen: 20

32 61 35 31 33 63 64 62 32 37 63 31 39 39 30 66  2a513cdb27c1990f

37 33 63 65 61 37 32 34 30 61 3B 20 5F 5F 6D 65  73cea7240a; __me

73 73 61 67 65 5F 73 79 73 5F 6D 73 67 5F 69 64  ssage_sys_msg_id

3D 39 35 36 3B 20 41 53 50 2E 4E 45 54 5F 53 65  =956; ASP.NET_Se

73 73 69 6F 6E 49 64 3D 79 78 77 78 30 72 79 6D  ssionId=yxwx0rym

74 73 75 6E 35 30 34 35 30 72 61 75 6E 30 6D 69  tsun50450raun0mi

3B 20 54 65 73 74 43 6F 6F 6B 69 65 3D 34 2F 31  ; TestCookie=4/1

38 2F 32 30 31 31 20 35 3A 34 37 3A 34 39 20 50  8/2011 5:47:49 P

4D 3B 20 5F 5F 6D 65 73 73 61 67 65 5F 67 75 5F  M; __message_gu_

6D 73 67 5F 69 64 3D 30 3B 20 5F 5F 6D 65 73 73  msg_id=0; __mess

61 67 65 5F 63 6E 65 6C 5F 6D 73 67 5F 69 64 3D  age_cnel_msg_id=

30 3B 20 5F 5F 6D 65 73 73 61 67 65 5F 69 6E 5F  0; __message_in_

73 63 68 6F 6F 6C 3D 30 3B 20 43 53 44 4E 42 6C  school=0; CSDNBl

6F 67 42 6C 6F 67 49 64 3D 31 37 36 30 36 32 3B  ogBlogId=176062;

20 75 63 68 6F 6D 65 5F 73 79 6E 66 72 69 65 6E   uchome_synfrien

64 3D 31 3B 20 2E 44 6F 74 74 65 78 74 43 6F 6F  d=1; .DottextCoo

6B 69 65 3D 32 35 44 41 32 43 37 33 41 46 44 37  kie=25DA2C73AFD7

35 30 31 31 32 43 39 46 46 30 38 32 36 46 41 30  50112C9FF0826FA0

39 30 32 38 36 36 30 36 35 30 30 44 37 33 46 32  90286606500D73F2

44 31 45 44 42 42 44 37 35 35 39 44 32 42 43 34  D1EDBBD7559D2BC4

33 42 37 46 44 34 30 46 37 35 43 38 45 32 41 30  3B7FD40F75C8E2A0

32 38 38 44 30 43 33 45 36 34 34 45 38 46 35 36  288D0C3E644E8F56

32 31 43 33 35 43 31 31 38 42 34 34 30 42 31 46  21C35C118B440B1F

44 37 31 30 44 37 38 34 43 46 45 31 35 34 30 33  D710D784CFE15403

44 46 35 37 41 42 44 43 36 42 34 33 41 44 31 31  DF57ABDC6B43AD11

32 46 33 35 43 36 39 45 43 33 32 44 44 41 44 34  2F35C69EC32DDAD4

30 41 39 38 38 45 45 31 37 43 38 46 30 36 46 34  0A988EE17C8F06F4

42 42 34 31 30 46 41 31 44 30 31 46 34 44 46 37  BB410FA1D01F4DF7

37 37 32 37 44 44 42 33 41 35 36 33 45 42 41 42  7727DDB3A563EBAB

41 37 37 44 38 34 32 37 38 41 45 44 46 42 37 46  A77D84278AEDFB7F

42 42 42 30 42 46 42 35 39 38 32 30 0D 0A 0D 0A  BBB0BFB59820....


=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


 


04/18-18:26:52.738985 211.100.26.77:80 -> 172.26.75.115:34474

TCP TTL:47 TOS:0x0 ID:42094 IpLen:20 DgmLen:269 DF

***AP*** Seq: 0xA891280A  Ack: 0x296CD8AC  Win: 0x56  TcpLen: 20

48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D  HTTP/1.1 200 OK.

0A 53 65 72 76 65 72 3A 20 6E 67 69 6E 78 2F 30  .Server: nginx/0

2E 37 2E 36 38 0D 0A 44 61 74 65 3A 20 4D 6F 6E  .7.68..Date: Mon

2C 20 31 38 20 41 70 72 20 32 30 31 31 20 31 30  , 18 Apr 2011 10

3A 32 36 3A 35 30 20 47 4D 54 0D 0A 43 6F 6E 6E  :26:50 GMT..Conn

65 63 74 69 6F 6E 3A 20 6B 65 65 70 2D 61 6C 69  ection: keep-ali

76 65 0D 0A 58 2D 55 41 2D 43 6F 6D 70 61 74 69  ve..X-UA-Compati

62 6C 65 3A 20 49 45 3D 45 6D 75 6C 61 74 65 49  ble: IE=EmulateI

45 37 0D 0A 58 2D 50 6F 77 65 72 65 64 2D 42 79  E7..X-Powered-By

3A 20 41 53 50 2E 4E 45 54 0D 0A 58 2D 41 73 70  : ASP.NET..X-Asp

4E 65 74 2D 56 65 72 73 69 6F 6E 3A 20 32 2E 30  Net-Version: 2.0

2E 35 30 37 32 37 0D 0A 43 61 63 68 65 2D 43 6F  .50727..Cache-Co

6E 74 72 6F 6C 3A 20 70 72 69 76 61 74 65 0D 0A  ntrol: private..

43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20  Content-Length: 

30 0D 0A 0D 0A                                   0....


=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+



  • 数据包记录器模式
1 将log写入目录/log 
命令: ./snort -vde -l ./log
需要注意:
1) ./log(/usr/sbin/log)目录需要你自己建立,并修改权限,以保证snort能够写入
2)不要遗漏-l参数,用来指定写入日志位置
3)给定的是目录,不是文件。
执行后系统将会在log目录下产生:
**********
root@helloworld:/usr/sbin/log# ls
snort.log.1303126222
**********

 

为了只对本地网络进行日志,需要加上参数-h。如:

./snort -vde -l ./log -h 192.168.1.0/24

这个命令告诉snort把进入C类网络192.168.1的所有包的数据链路、TCP/IP以及应用层的数据记录到目录./log中。

 

二进制方式:

./snort -l ./log -b 

 

 

[ 从manuel中看:使用二进制方式和普通方式应该在log文件命名方面有区别的,但我自己测试后,却没有得到效果,产生的log文件名都是一种类型,eg:

*************************************************

root@helloworld:/usr/sbin# ls ./log

 

snort.log.1303126222  snort.log.1303128331  snort.log.1303128351  snort.log.1303129241

*******************************

 

2 读出写的log文件内容:

【二进制文件是以tcpdump程序使用的格式写入的,可以使用tcpdump和ethereal读出,当然也可以使用snort读出,使用-r参数:

root@helloworld:/usr/sbin# ./snort -v -r ./log/snort.log.1303126222 

将显示在嗅探模式下一样的数据到控制台中。

(不知到为什么,我上面获得的日志都是二进制的,难道那个地方我设置错了??而且都可通过snort -r读出】

如果只想读出icmp包,则需在最后加上一个icmp参数:

./snort -v -r ./log/snort.log.1303126222 icmp

 

 

  • 网络入侵检测模式(NIDS)

这才是snort的本质工作。

命令:-c 指定规则集文件位置

 

./snort -v -l  ./log -c /etc/snort/snort.conf 

 

下面给出整个运行结果,以做分析:

 

*******************************************************************************************

 

Running in IDS mode 【显示了当前模式】

 

        --== Initializing Snort ==--

Initializing Output Plugins!

Initializing Preprocessors!

Initializing Plug-ins!

Parsing Rules file "/etc/snort/snort.conf"

PortVar 'HTTP_PORTS' defined :  [ 80 ]

PortVar 'SHELLCODE_PORTS' defined :  [ 0:79 81:65535 ]

PortVar 'ORACLE_PORTS' defined :  [ 1521 ]

PortVar 'FTP_PORTS' defined :  [ 21 ]

Tagged Packet Limit: 256

Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... done

Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/...

  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... done

  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... done

  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... done

  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... done

  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... done

  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... done

  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//lib_sfdynamic_preprocessor_example.so... done

  Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... done

  Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/

Log directory = ./log

Frag3 global config:

    Max frags: 65536

    Fragment memory cap: 4194304 bytes

Frag3 engine config:

    Target-based policy: FIRST

    Fragment timeout: 60 seconds

    Fragment min_ttl:   1

    Fragment Problems: 1

    Overlap Limit:     10

    Min fragment Length:     0

Stream5 global config:

    Track TCP sessions: ACTIVE

    Max TCP sessions: 8192

    Memcap (for reassembly packet storage): 8388608

    Track UDP sessions: INACTIVE

    Track ICMP sessions: INACTIVE

    Log info if session memory consumption exceeds 1048576

Stream5 TCP Policy config:

    Reassembly Policy: FIRST

    Timeout: 30 seconds

    Min ttl:  1

    Maximum number of bytes to queue per session: 1048576

    Maximum number of segs to queue per session: 2621

    Reassembly Ports:

      21 client (Footprint) 

      23 client (Footprint) 

      25 client (Footprint) 

      42 client (Footprint) 

      53 client (Footprint) 

      80 client (Footprint) 

      110 client (Footprint) 

      111 client (Footprint) 

      135 client (Footprint) 

      136 client (Footprint) 

      137 client (Footprint) 

      139 client (Footprint) 

      143 client (Footprint) 

      445 client (Footprint) 

      513 client (Footprint) 

      514 client (Footprint) 

      1433 client (Footprint) 

      1521 client (Footprint) 

      2401 client (Footprint) 

      3306 client (Footprint) 

HttpInspect Config:

    GLOBAL CONFIG

      Max Pipeline Requests:    0

      Inspection Type:          STATELESS

      Detect Proxy Usage:       NO

      IIS Unicode Map Filename: /etc/snort/unicode.map

      IIS Unicode Map Codepage: 1252

    DEFAULT SERVER CONFIG:

      Server profile: All

      Ports: 80 8080 8180 

      Server Flow Depth: 300

      Client Flow Depth: 300

      Max Chunk Length: 500000

      Max Header Field Length: 0

      Max Number Header Fields: 0

      Inspect Pipeline Requests: YES

      URI Discovery Strict Mode: NO

      Allow Proxy Usage: NO

      Disable Alerting: NO

      Oversize Dir Length: 500

      Only inspect URI: NO

      Normalize HTTP Headers: NO

      Normalize HTTP Cookies: NO

      Ascii: YES alert: NO

      Double Decoding: YES alert: YES

      %U Encoding: YES alert: YES

      Bare Byte: YES alert: YES

      Base36: OFF

      UTF 8: OFF

      IIS Unicode: YES alert: YES

      Multiple Slash: YES alert: NO

      IIS Backslash: YES alert: NO

      Directory Traversal: YES alert: NO

      Web Root Traversal: YES alert: YES

      Apache WhiteSpace: YES alert: NO

      IIS Delimiter: YES alert: NO

      IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG

      Non-RFC Compliant Characters: NONE

      Whitespace Characters: 0x09 0x0b 0x0c 0x0d 

rpc_decode arguments:

    Ports to decode RPC on: 111 32771 

    alert_fragments: INACTIVE

    alert_large_fragments: ACTIVE

    alert_incomplete: ACTIVE

    alert_multiple_requests: ACTIVE

Portscan Detection Config:

    Detect Protocols:  TCP UDP ICMP IP

    Detect Scan Type:  portscan portsweep decoy_portscan distributed_portscan

    Sensitivity Level: Low

    Memcap (in bytes): 10000000

    Number of Nodes:   36900

FTPTelnet Config:

    GLOBAL CONFIG

      Inspection Type: stateful

      Check for Encrypted Traffic: YES alert: YES

      Continue to check encrypted data: NO

    TELNET CONFIG:

      Ports: 23 

      Are You There Threshold: 200

      Normalize: YES

      Detect Anomalies: NO

    FTP CONFIG:

      FTP Server: default

        Ports: 21 

        Check for Telnet Cmds: YES alert: YES

        Ignore Telnet Cmd Operations: OFF

        Identify open data channels: YES

      FTP Client: default

        Check for Bounce Attacks: YES alert: YES

        Check for Telnet Cmds: YES alert: YES

        Ignore Telnet Cmd Operations: OFF

        Max Response Length: 256

SMTP Config:

    Ports: 25 587 691 

    Inspection Type: Stateful

    Normalize: EXPN RCPT VRFY 

    Ignore Data: No

    Ignore TLS Data: No

    Ignore SMTP Alerts: No

    Max Command Line Length: Unlimited

    Max Specific Command Line Length: 

       ETRN:500 EXPN:255 HELO:500 HELP:500 MAIL:260 

       RCPT:300 VRFY:255 

    Max Header Line Length: Unlimited

    Max Response Line Length: Unlimited

    X-Link2State Alert: Yes

    Drop on X-Link2State Alert: No

    Alert on commands: None

SSH config: 

    Autodetection: DISABLED

    Challenge-Response Overflow Alert: ENABLED

    SSH1 CRC32 Alert: ENABLED

    Server Version String Overflow Alert: ENABLED

    Protocol Mismatch Alert: ENABLED

    Bad Message Direction Alert: DISABLED

    Bad Payload Size Alert: DISABLED

    Unrecognized Version Alert: DISABLED

    Max Encrypted Packets: 20  

    Max Server Version String Length: 80 (Default) 

    MaxClientBytes: 19600 (Default) 

    Ports:

22

DCE/RPC 2 Preprocessor Configuration

  Global Configuration

    DCE/RPC Defragmentation: Enabled

    Memcap: 102400 KB

    Events: none

  Server Default Configuration

    Policy: WinXP

    Detect ports

      SMB: 139 445 

      TCP: 135 

      UDP: 135 

      RPC over HTTP server: 593 

      RPC over HTTP proxy: None

    Autodetect ports

      SMB: None

      TCP: 1025-65535 

      UDP: 1025-65535 

      RPC over HTTP server: 1025-65535 

      RPC over HTTP proxy: None

    Maximum SMB command chaining: 3 commands

DNS config: 

    DNS Client rdata txt Overflow Alert: ACTIVE

    Obsolete DNS RR Types Alert: INACTIVE

    Experimental DNS RR Types Alert: INACTIVE

    Ports: 53

SSLPP config:

    Encrypted packets: not inspected

    Ports:

      443      465      563      636      989

      992      993      994      995

    Server side data is trusted

 

+++++++++++++++++++++++++++++++++++++++++++++++++++

Initializing rule chains...

Warning: /etc/snort/rules/dos.rules(42) => threshold (in rule) is deprecated; use detection_filter instead.

3382 Snort rules read

    3382 detection rules

    0 decoder rules

    0 preprocessor rules

3382 Option Chains linked into 282 Chain Headers

0 Dynamic rules

+++++++++++++++++++++++++++++++++++++++++++++++++++

 

+-------------------[Rule Port Counts]---------------------------------------

|             tcp     udp    icmp      ip

|     src     121      19       0       0

|     dst    2922     130       0       0

|     any     115      53      56      27

|      nc      31      10      15      20

|     s+d      12       6       0       0

+----------------------------------------------------------------------------

 

+-----------------------[detection-filter-config]------------------------------

| memory-cap : 1048576 bytes

+-----------------------[detection-filter-rules]-------------------------------

| none

-------------------------------------------------------------------------------

 

+-----------------------[rate-filter-config]-----------------------------------

| memory-cap : 1048576 bytes

+-----------------------[rate-filter-rules]------------------------------------

| none

-------------------------------------------------------------------------------

 

+-----------------------[event-filter-config]----------------------------------

| memory-cap : 1048576 bytes

+-----------------------[event-filter-global]----------------------------------

| none

+-----------------------[event-filter-local]-----------------------------------

| gen-id=1      sig-id=2494       type=Both      tracking=dst count=20  seconds=60 

| gen-id=1      sig-id=100000162  type=Both      tracking=src count=100 seconds=60 

| gen-id=1      sig-id=100000159  type=Both      tracking=src count=100 seconds=60 

| gen-id=1      sig-id=2496       type=Both      tracking=dst count=20  seconds=60 

| gen-id=1      sig-id=100000310  type=Limit     tracking=src count=1   seconds=360

| gen-id=1      sig-id=3273       type=Threshold tracking=src count=5   seconds=2  

| gen-id=1      sig-id=100000923  type=Threshold tracking=dst count=200 seconds=60 

| gen-id=1      sig-id=100000311  type=Limit     tracking=src count=1   seconds=360

| gen-id=1      sig-id=2275       type=Threshold tracking=dst count=5   seconds=60 

| gen-id=1      sig-id=100000161  type=Both      tracking=dst count=100 seconds=60 

| gen-id=1      sig-id=100000158  type=Both      tracking=src count=100 seconds=60 

| gen-id=1      sig-id=2923       type=Threshold tracking=dst count=10  seconds=60 

| gen-id=1      sig-id=100000163  type=Both      tracking=src count=100 seconds=60 

| gen-id=1      sig-id=100000160  type=Both      tracking=src count=300 seconds=60 

| gen-id=1      sig-id=2523       type=Both      tracking=dst count=10  seconds=10 

| gen-id=1      sig-id=100000312  type=Limit     tracking=src count=1   seconds=360

| gen-id=1      sig-id=2924       type=Threshold tracking=dst count=10  seconds=60 

| gen-id=1      sig-id=2495       type=Both      tracking=dst count=20  seconds=60 

| gen-id=1      sig-id=3152       type=Threshold tracking=src count=5   seconds=2  

+-----------------------[suppression]------------------------------------------

| none

-------------------------------------------------------------------------------

Rule application order: activation->dynamic->pass->drop->alert->log

Verifying Preprocessor Configurations!

Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked.

Warning: flowbits key 'realplayer.playlist' is checked but not ever set.

Warning: flowbits key 'community_uri.size.1050' is set but not ever checked.

Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.

37 out of 512 flowbits in use.

***

*** interface device lookup found: eth0

***

Initializing Network Interface eth0

Decoding Ethernet on interface eth0

Node unique name is: 172.26.75.115

database: compiled support for (mysql)

database: configured to use mysql

database: schema version = 107

database:           host = localhost

database:           user = snort

database:  database name = snort

database:    sensor name = 172.26.75.115

database:      sensor id = 1

database:  data encoding = hex

database:   detail level = full

database:     ignore_bpf = no

database: using the "log" facility

 

[ Port Based Pattern Matching Memory ]

+-[AC-BNFA Search Info Summary]------------------------------

| Instances        : 241

| Patterns         : 22049

| Pattern Chars    : 207222

| Num States       : 137800

| Num Match States : 18343

| Memory           :   3.51Mbytes

|   Patterns       :   0.70M

|   Match Lists    :   0.96M

|   Transitions    :   1.79M

+-------------------------------------------------

 

        --== Initialization Complete ==--

 

   ,,_     -*> Snort! <*-

  o"  )~   Version 2.8.5.2 (Build 121)  

   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team

           Copyright (C) 1998-2009 Sourcefire, Inc., et al.

           Using PCRE version: 8.02 2010-03-19

 

           Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 1.11  <Build 17>

           Preprocessor Object: SF_SSH  Version 1.1  <Build 2>

           Preprocessor Object: SF_Dynamic_Example_Preprocessor  Version 1.0  <Build 1>

           Preprocessor Object: SF_DNS  Version 1.1  <Build 3>

           Preprocessor Object: SF_SSLPP  Version 1.1  <Build 3>

           Preprocessor Object: SF_DCERPC  Version 1.1  <Build 5>

           Preprocessor Object: SF_DCERPC2  Version 1.0  <Build 2>

           Preprocessor Object: SF_FTPTELNET  Version 1.2  <Build 12>

           Preprocessor Object: SF_SMTP  Version 1.1  <Build 8>

Using PCAP_FRAMES = max

04/18-20:56:55.568511 183.62.125.17:80 -> 172.26.75.115:47155

TCP TTL:50 TOS:0x0 ID:32178 IpLen:20 DgmLen:339 DF

***AP*** Seq: 0x8EE60060  Ack: 0xFEFE1836  Win: 0xB3  TcpLen: 32

TCP Options (3) => NOP NOP TS: 113936275 10677776 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

 

04/18-20:56:55.568535 172.26.75.115:47155 -> 183.62.125.17:80

TCP TTL:64 TOS:0x0 ID:65460 IpLen:20 DgmLen:52 DF

***A**** Seq: 0xFEFE1836  Ack: 0x8EE6017F  Win: 0x6C  TcpLen: 32

TCP Options (3) => NOP NOP TS: 10680277 113936275 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

 

04/18-20:56:55.568541 183.62.125.17:80 -> 172.26.75.115:47155

TCP TTL:50 TOS:0x0 ID:32179 IpLen:20 DgmLen:52 DF

***A***F Seq: 0x8EE6017F  Ack: 0xFEFE1836  Win: 0xB3  TcpLen: 32

TCP Options (3) => NOP NOP TS: 113936275 10677776 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

 

04/18-20:56:55.568704 172.26.75.115:47155 -> 183.62.125.17:80

TCP TTL:64 TOS:0x0 ID:65461 IpLen:20 DgmLen:52 DF

***A***F Seq: 0xFEFE1836  Ack: 0x8EE60180  Win: 0x6C  TcpLen: 32

TCP Options (3) => NOP NOP TS: 10680277 113936275 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

 

04/18-20:56:55.583144 183.62.125.17:80 -> 172.26.75.115:47155

TCP TTL:50 TOS:0x0 ID:32180 IpLen:20 DgmLen:52 DF

***A**** Seq: 0x8EE60180  Ack: 0xFEFE1837  Win: 0xB3  TcpLen: 32

TCP Options (3) => NOP NOP TS: 113936278 10680277 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

 

04/18-20:56:55.625244 172.26.75.115:47156 -> 183.62.125.17:80

TCP TTL:64 TOS:0x0 ID:3078 IpLen:20 DgmLen:60 DF

******S* Seq: 0x872FBE2  Ack: 0x0  Win: 0x16D0  TcpLen: 40

TCP Options (5) => MSS: 1460 SackOK TS: 10680292 0 NOP WS: 6 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

 

04/18-20:56:55.639822 183.62.125.17:80 -> 172.26.75.115:47156

TCP TTL:50 TOS:0x0 ID:0 IpLen:20 DgmLen:60 DF

***A**S* Seq: 0x8F5BBE8D  Ack: 0x872FBE3  Win: 0x1650  TcpLen: 40

TCP Options (5) => MSS: 1440 SackOK TS: 113932525 10680292 NOP WS: 6 

*** Caught Int-Signal

Run time prior to being shutdown was 1.310378 seconds

database: Closing connection to database "snort"

===============================================================================

Packet Wire Totals:

   Received:           11

   Analyzed:           11 (100.000%)

    Dropped:            0 (0.000%)

Outstanding:            0 (0.000%)

===============================================================================

Breakdown by protocol (includes rebuilt packets):

      ETH: 11         (100.000%)

  ETHdisc: 0          (0.000%)

     VLAN: 0          (0.000%)

     IPV6: 0          (0.000%)

  IP6 EXT: 0          (0.000%)

  IP6opts: 0          (0.000%)

  IP6disc: 0          (0.000%)

      IP4: 11         (100.000%)

  IP4disc: 0          (0.000%)

    TCP 6: 0          (0.000%)

    UDP 6: 0          (0.000%)

    ICMP6: 0          (0.000%)

  ICMP-IP: 0          (0.000%)

      TCP: 11         (100.000%)

      UDP: 0          (0.000%)

     ICMP: 0          (0.000%)

  TCPdisc: 0          (0.000%)

  UDPdisc: 0          (0.000%)

  ICMPdis: 0          (0.000%)

     FRAG: 0          (0.000%)

   FRAG 6: 0          (0.000%)

      ARP: 0          (0.000%)

    EAPOL: 0          (0.000%)

  ETHLOOP: 0          (0.000%)

      IPX: 0          (0.000%)

    OTHER: 0          (0.000%)

  DISCARD: 0          (0.000%)

InvChkSum: 6          (54.545%)

   S5 G 1: 0          (0.000%)

   S5 G 2: 0          (0.000%)

    Total: 11        

===============================================================================

Action Stats:

ALERTS: 0

LOGGED: 0

PASSED: 0

===============================================================================

Frag3 statistics:

        Total Fragments: 0

      Frags Reassembled: 0

               Discards: 0

          Memory Faults: 0

               Timeouts: 0

               Overlaps: 0

              Anomalies: 0

                 Alerts: 0

                  Drops: 0

     FragTrackers Added: 0

    FragTrackers Dumped: 0

FragTrackers Auto Freed: 0

    Frag Nodes Inserted: 0

     Frag Nodes Deleted: 0

===============================================================================

Stream5 statistics:

            Total sessions: 2

              TCP sessions: 2

              UDP sessions: 0

             ICMP sessions: 0

                TCP Prunes: 0

                UDP Prunes: 0

               ICMP Prunes: 0

TCP StreamTrackers Created: 2

TCP StreamTrackers Deleted: 2

              TCP Timeouts: 0

              TCP Overlaps: 0

       TCP Segments Queued: 0

     TCP Segments Released: 0

       TCP Rebuilt Packets: 0

         TCP Segments Used: 0

              TCP Discards: 1

      UDP Sessions Created: 0

      UDP Sessions Deleted: 0

              UDP Timeouts: 0

              UDP Discards: 0

                    Events: 0

           Internal Events: 0

           TCP Port Filter

                   Dropped: 0

                 Inspected: 0

                   Tracked: 5

           UDP Port Filter

                   Dropped: 0

                 Inspected: 0

                   Tracked: 0

===============================================================================

HTTP Inspect - encodings (Note: stream-reassembled packets included):

    POST methods:                   0         

    GET methods:                    0         

    Headers extracted:              0         

    Header Cookies extracted:       0         

    Post parameters extracted:      0         

    Unicode:                        0         

    Double unicode:                 0         

    Non-ASCII representable:        0         

    Base 36:                        0         

    Directory traversals:           0         

    Extra slashes ("//"):           0         

    Self-referencing paths ("./"):  0         

    Total packets processed:        1         

===============================================================================

dcerpc2 Preprocessor Statistics

  Total sessions: 0

===============================================================================

===============================================================================

Snort exiting

*****************************************************************************************************end copy.

 

 

虽然以上没有检测出问题,也没有给出alert,但是它大概描述了snort在NIDS模式下的工作流程:
1) 初始化:将所有规则导入snort内存,统计规则过滤对象。
2) 开始检测
设置报警模式: 由于还没有构造攻击源,暂时检测不出问题,也产生不了alert,这步没有进行实验】
【copy from mannal】
**************************************

在NIDS模式下,有很多的方式来配置snort的输出。在默认情况下,snort以ASCII格式记录日志,使用full报警机制。如果使用full报警机制,snort会在包头之后打印报警消息。如果你不需

要日志包,可以使用-N选项。

    snort有6种报警机制:full、fast、socket、syslog、smb(winpopup)和none。其中有4个可以在命令行状态下使用-A选项设置。这4个是:

-A fast:报警信息包括:一个时间戳(timestamp)、报警消息、源/目的IP地址和端口。 
-A full:是默认的报警模式。
-A unsock:把报警发送到一个UNIX套接字,需要有一个程序进行监听,这样可以实现实时报警。
-A none:关闭报警机制。

    使用-s选项可以使snort把报警消息发送到syslog,默认的设备是LOG_AUTHPRIV和LOG_ALERT。可以修改snort.conf文件修改其配置。

    snort还可以使用SMB报警机制,通过SAMBA把报警消息发送到Windows主机。为了使用这个报警机制,在运行./configure脚本时,必须使用--enable-smbalerts选项。
下面是一些输出配置的例子:

    使用默认的日志方式(以解码的ASCII格式)并且把报警发给syslog:

    ./snort -c snort.conf -l ./log -s -h 192.168.1.0/24

    使用二进制日志格式和SMB报警机制:  

   ./snort -c snort.conf -b -M WORKSTATIONS

****************************************

今天收工,明天研究snort规则获取和编写。


  


 

1
0

猜你在找
深度学习基础与TensorFlow实践
【在线峰会】前端开发重点难点技术剖析与创新实践
【在线峰会】一天掌握物联网全栈开发之道
【在线峰会】如何高质高效的进行Android技术开发
机器学习40天精英计划
Python数据挖掘与分析速成班
微信小程序开发实战
JFinal极速开发企业实战
备战2017软考 系统集成项目管理工程师 学习套餐
Python大型网络爬虫项目开发实战(全套)
查看评论
* 以上用户言论只代表其个人观点,不代表CSDN网站的观点或立场
    个人资料
    • 访问:486510次
    • 积分:6989
    • 等级:
    • 排名:第3038名
    • 原创:210篇
    • 转载:128篇
    • 译文:0篇
    • 评论:134条
    文章分类
    最新评论