在kali2虚拟机上第一次成功运行snort和barnyard2

最新推荐文章于 2023-08-15 10:00:00 发布
最新推荐文章于 2023-08-15 10:00:00 发布
阅读量4.3k 收藏 1
点赞数
分类专栏： 安全 文章标签： snort
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/caiqiiqi/article/details/70939664
版权 
参考：
http://sublimerobots.com/2017/01/snort-2-9-9-x-ubuntu-installing-snort/    (2017新版)
http://sublimerobots.com/2015/12/snort-2-9-8-x-on-ubuntu-part-1/           (2015旧版)
➜  barnyard2-master /usr/local/bin/snort -q -u snort -g snort -c /etc/snort/snort.conf -i eth0 -D                                 [3:06:46]
Spawning daemon child...
My daemon child 53485 lives...
Daemon parent exiting (0)
➜  barnyard2-master barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -w /var/log/snort/barnyard2.waldo -g snort -u snort 

Running in Continuous mode

        --== Initializing Barnyard2 ==--
Initializing Input Plugins!
Initializing Output Plugins!
Parsing config file "/etc/snort/barnyard2.conf"


+[ Signature Suppress list ]+
----------------------------
+[No entry in Signature Suppress List]+
----------------------------
+[ Signature Suppress list ]+

Barnyard2 spooler: Event cache size set to [2048] 
Log directory = /var/log/barnyard2
INFO database: Defaulting Reconnect/Transaction Error limit to 10 
INFO database: Defaulting Reconnect sleep time to 5 second 
[ClassificationPullDataStore()]: No Classification found in database ... 
[SignaturePullDataStore()]: No signature found in database ... 
[SystemPullDataStore()]: No System found in database ... 
[ReferencePullDataStore()]: No Reference found in database ... 
[SignatureReferencePullDataStore()]: No Reference found in database ... 
database: compiled support for (mysql)
database: configured to use mysql
database: schema version = 107
database:           host = localhost
database:           user = snort
database:  database name = snort
database:    sensor name = kali:NULL
database:      sensor id = 1
database:     sensor cid = 1
database:  data encoding = hex
database:   detail level = full
database:     ignore_bpf = no
database: using the "log" facility

        --== Initialization Complete ==--

  ______   -*> Barnyard2 <*-
 / ,,_  \  Version 2.1.14 (Build 337)
 |o"  )~|  By Ian Firns (SecurixLive): http://www.securixlive.com/
 + '''' +  (C) Copyright 2008-2013 Ian Firns <firnsy@securixlive.com>

WARNING: Ignoring corrupt/truncated waldofile '/var/log/snort/barnyard2.waldo'
Opened spool file '/var/log/snort/snort.u2.1493147217'
Waiting for new data

不要着急在树莓派上发包然后等待barnyard2去处理，本身在我高配的kali2虚拟机上barnyard2启动都要好久(至少2分钟吧)。处理第一个包的时候已经过了半个小时了。虽然包是在十几分钟的时候发的。

➜  repos journalctl -f -u barnyard2                                                                                [16:40:56]
-- Logs begin at Wed 2017-04-26 04:32:11 CST. --
Apr 28 16:40:50 kali systemd[1]: Started Barnyard2 Daemon.
Apr 28 16:40:50 kali barnyard2[41387]: Running in Continuous mode
Apr 28 16:40:50 kali barnyard2[41387]: 
Apr 28 16:40:50 kali barnyard2[41387]:         --== Initializing Barnyard2 ==--
Apr 28 16:40:50 kali barnyard2[41387]: Initializing Input Plugins!
Apr 28 16:40:50 kali barnyard2[41387]: Initializing Output Plugins!
Apr 28 16:40:50 kali barnyard2[41387]: Parsing config file "/etc/snort/barnyard2.conf"
Apr 28 16:40:50 kali barnyard2[41387]: 

                                       +[ Signature Suppress list ]+
                                       ----------------------------
Apr 28 16:40:50 kali barnyard2[41387]: +[No entry in Signature Suppress List]+
Apr 28 16:40:50 kali barnyard2[41387]: ----------------------------
                                       +[ Signature Suppress list ]+
Apr 28 16:42:44 kali barnyard2[41387]: WARNING: invalid Reference spec '2015-0666'. Ignored
Apr 28 16:42:49 kali barnyard2[41387]: Barnyard2 spooler: Event cache size set to [2048]
Apr 28 16:42:49 kali barnyard2[41387]: Log directory = /var/log/barnyard2
Apr 28 16:42:49 kali barnyard2[41387]: INFO database: Defaulting Reconnect/Transaction Error limit to 10
Apr 28 16:42:49 kali barnyard2[41387]: INFO database: Defaulting Reconnect sleep time to 5 second
Apr 28 16:42:49 kali barnyard2[41387]: Initializing daemon mode
Apr 28 16:42:49 kali barnyard2[41387]: Daemon initialized, signaled parent pid: 1
Apr 28 16:42:49 kali barnyard2[41387]: PID path stat checked out ok, PID path set to /var/run/
Apr 28 16:42:49 kali barnyard2[41387]: Writing PID "41387" to file "/var/run//barnyard2_NULL.pid"
Apr 28 17:14:03 kali barnyard2[41387]: database: compiled support for (mysql)
Apr 28 17:14:03 kali barnyard2[41387]: database: configured to use mysql
Apr 28 17:14:03 kali barnyard2[41387]: database: schema version = 107
Apr 28 17:14:03 kali barnyard2[41387]: database:           host = localhost
Apr 28 17:14:03 kali barnyard2[41387]: database:           user = snort
Apr 28 17:14:03 kali barnyard2[41387]: database:  database name = snort
Apr 28 17:14:03 kali barnyard2[41387]: database:    sensor name = kali:NULL
Apr 28 17:14:03 kali barnyard2[41387]: database:      sensor id = 1
Apr 28 17:14:03 kali barnyard2[41387]: database:     sensor cid = 5
Apr 28 17:14:03 kali barnyard2[41387]: database:  data encoding = hex
Apr 28 17:14:03 kali barnyard2[41387]: database:   detail level = full
Apr 28 17:14:03 kali barnyard2[41387]: database:     ignore_bpf = no
Apr 28 17:14:03 kali barnyard2[41387]: database: using the "log" facility
Apr 28 17:14:03 kali barnyard2[41387]: 
Apr 28 17:14:03 kali barnyard2[41387]:         --== Initialization Complete ==--
Apr 28 17:14:03 kali barnyard2[41387]: Barnyard2 initialization completed successfully (pid=41387)
Apr 28 17:14:03 kali barnyard2[41387]: Using waldo file '/var/log/snort/barnyard2.waldo':
                                           spool directory = /var/log/snort
                                           spool filebase  = snort.u2
                                           time_stamp      = 1493152162
                                           record_idx      = 8
Apr 28 17:14:03 kali barnyard2[41387]: Opened spool file '/var/log/snort/snort.u2.1493152162'
Apr 28 17:14:03 kali barnyard2[41387]: Closing spool file '/var/log/snort/snort.u2.1493152162'. Read 8 records
Apr 28 17:14:03 kali barnyard2[41387]: Opened spool file '/var/log/snort/snort.u2.1493152669'
Apr 28 17:14:04 kali barnyard2[41387]: Waiting for new data

而我的树莓派就慢一些了。

4月 28 18:55:49 snort-ids systemd[1]: Started Barnyard2 Daemon.
4月 28 18:55:49 snort-ids barnyard2[23757]: Running in Continuous mode
4月 28 18:55:49 snort-ids barnyard2[23757]:
4月 28 18:55:49 snort-ids barnyard2[23757]:         --== Initializing Barnyard2 ==--
4月 28 18:55:49 snort-ids barnyard2[23757]: Initializing Input Plugins!
4月 28 18:55:49 snort-ids barnyard2[23757]: Initializing Output Plugins!
4月 28 18:55:49 snort-ids barnyard2[23757]: Parsing config file "/etc/snort/barnyard2.conf"
4月 28 18:55:49 snort-ids barnyard2[23757]:

                                             +[ Signature Suppress list ]+
                                             ----------------------------
4月 28 18:55:49 snort-ids barnyard2[23757]: +[No entry in Signature Suppress List]+
4月 28 18:55:49 snort-ids barnyard2[23757]: ----------------------------
                                             +[ Signature Suppress list ]+
4月 28 19:04:43 snort-ids barnyard2[23757]: WARNING: invalid Reference spec '2015-0666'. Ignored
4月 28 19:04:55 snort-ids barnyard2[23757]: Barnyard2 spooler: Event cache size set to [2048]
4月 28 19:04:55 snort-ids barnyard2[23757]: Log directory = /var/log/barnyard2
4月 28 19:04:55 snort-ids barnyard2[23757]: INFO database: Defaulting Reconnect/Transaction Error limit to 10
4月 28 19:04:55 snort-ids barnyard2[23757]: INFO database: Defaulting Reconnect sleep time to 5 second
4月 28 19:04:55 snort-ids barnyard2[23757]: Initializing daemon mode
4月 28 19:04:55 snort-ids barnyard2[23757]: Daemon initialized, signaled parent pid: 1
4月 28 19:04:55 snort-ids barnyard2[23757]: PID path stat checked out ok, PID path set to /var/run/
4月 28 19:04:55 snort-ids barnyard2[23757]: Writing PID "23757" to file "/var/run//barnyard2_NULL.pid"

是说怎么在我的kali2虚拟机里和树莓派上的不一样呢。虚拟机里用的是master分支(也就是新版本)，而树莓派里用的是老版本的。看到这个才知道barnyard2在新版本中给一个.h文件里面的ref_system_id变量加上了反单引号，这才是问题所在。

➜  output-plugins grep "ref_system_id" spo_database_cache.h                                                        [18:59:09]
#define PGSQL_SQL_SELECT_SPECIFIC_REFERENCE_SYSTEM "SELECT `ref_system_id` FROM reference_system WHERE ref_system_name = E'%s';"
#define PGSQL_SQL_INSERT_SPECIFIC_REF  "INSERT INTO reference (`ref_system_id`,ref_tag) VALUES ('%u',E'%s');"
#define PGSQL_SQL_SELECT_SPECIFIC_REF  "SELECT ref_id FROM reference WHERE `ref_system_id` = '%u' AND ref_tag = E'%s';"
#define SQL_SELECT_SPECIFIC_REFERENCE_SYSTEM "SELECT `ref_system_id` FROM reference_system WHERE ref_system_name = '%s';"
#define SQL_INSERT_SPECIFIC_REF  "INSERT INTO reference (`ref_system_id`,ref_tag) VALUES ('%u','%s');"
#define SQL_SELECT_SPECIFIC_REF  "SELECT ref_id FROM reference WHERE `ref_system_id` = '%u' AND ref_tag = '%s';"
#define SQL_SELECT_ALL_REFERENCE_SYSTEM  "SELECT `ref_system_id`, ref_system_name FROM reference_system;"
#define SQL_SELECT_ALL_REF "SELECT ref_id, `ref_system_id`, ref_tag FROM reference; "
➜  output-plugins pwd                                                                                              [18:59:20]
/root/snort_src/barnyard2-master/src/output-plugins
caiqiiqi
关注
  • 0
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
专栏目录
centos6.7下snort2.9.9.0+base+barnyard2的安装
dhfttkl123的博客
07-21 1948
0x01 YUM源准备 阿里云Linux安装镜像源地址：http://mirrors.aliyun.com/ 第一步：备份原镜像文件 mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.bak 第二步：下载CentOS-Base.repo 到/etc/yum.repos.d/ CentOS 5 wge
PostgreSQL数据库中的常见错误
热门推荐
步行者的专栏
11-28 10万+
 我们在操作数据库的时候，我们总会遇到很多错误。下面整理了一下常见的错误。错误1      FATAL: connection limit exceeded for non-superusers      原因：非超级用户的连接数（max_connections - superuser_reserved_connections）超过了设定值      解决办法：增加max_co
FreeBSD环境中源码部署Snort+Barnyard2+MySQL+BASE
最新发布
ZL_1618的博客
08-15 1313
到此FreeBSD设置BASE设置就圆满完成。相比较LInux系统安装，我们在这里不用考虑依赖包的问题，不用建立繁琐的软连接，安装过程基本实现半自动化，需要注意的是FreeBSD11~13 都可以安装 Snort+Barnyard+Mysql。但只有FreeBSD11可以安装BASE，本文场景适用于复杂繁重的网络环境让FreeBSD系统的IDS做数据分析存储，然后在LInux环境中安装WebUI实现报警可视化。
Windows 10环境中安装Snort+Barnyard2+MySQL
李晨光原创IT博客
03-09 1215
本文介绍如何在Windows10环境中安装Snort+Barnyard2+MySQL系统。
snorby_test
公众号shadow sock7
04-28 1684
参考： http://sublimerobots.com/2015/12/snort-2-9-8-x-on-ubuntu-part-3/cqq@kali:/etc/snort$ sudo /usr/sbin/snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0 04/17-04:51:02.052102 [*
在KaliLinux中更改GRUB2背景的5种方式
02-01
KaliLinux中更改GRUB背景的简单指南(实际上它是KaliLinux的GRUB 启动图像)。Kali开发团队在这方面做的不多，他们好像太忙了，所以在这篇文章中，我会对GRUB解释一二，但是不会冗长到我失去写作的激情。 那么我们开始...
Kali Linux安装ipython2 和 ipython3的方法
12-31
2、安装 pip3 ：apt-get install python3-pip 3、安装ipython 2 : pip install ipython. 查看 ipython 命令的所在位置：which /usr/local/bin/ipython 改名： mv /usr/local/bin/ipython /usr/local/bin/ipython2 ...
Snorter:Snort + Barnyard2 + Pulledpork→简单的方法！
05-07
已在以下位置成功测试： Raspberry Pi + Raspbian Jessie Kali Linux滚动发布Debian 9.0以上Ubuntu 18.04 使用脚本的Ubuntu 14.04。安装详细的安装。下载只需在您的终端上运行： git clone ...
CentOS6u9 基于Snort+Barnyard2+Base的入侵检测系统搭建
VincentQB的博客
06-15 1411
简单说明： 本实验基于博文 https://www.cnblogs.com/zlslch/p/7306632.html 搭建测试 该IDS是基于LAMP架构的入侵检测系统，核心组件为Snort和Barnyard2以及Base 使用Snort做入侵检测并输出到alert文件 使用Barnyard2读取alert文件格式化输出到库 使用Base从库中读取数据进行展示 依据《CentOS6实验机模板搭...
kali虚拟机上安装Snort
weixin_54658101的博客
03-10 2105
kali虚拟机上snort的安装
编译barnyard2-2.1.14出现的问题
有理论，有实验，有结论，可为一篇文章
10-17 1091
根据文档（Snort 2.9.7.x on Ubuntu 12 LTS and 14 LTS）为snort安装barnyard2的时候遇到问题： 缺少dnet.h头文件 decode.c:38:18: fatal error: dnet.h: No such file or directory #include <dnet.h> ^ compila...
基于ubuntu-20.04.3的snort+Barnyard2+BASE的入侵检测系统安装时Barnyard2反编译时出错解决
qq_45944626的博客
12-09 2952
基于ubuntu-20.04.3的snort+Barnyard2+BASE的入侵检测系统安装时Barnyard2反编译时出错解决
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值