home-ids-with-snort-and-snorby

参考：
https://techanarchy.net/2015/01/home-ids-with-snort-and-snorby/

需要的组件

• snort 监控原始流量，并将原始流量与rules对比
• PulledPort rule管理应用
• Barnyard2 处理由snort产生的alerts并将其变成数据库的格式
• Snorby 写入到数据库的event数据展示的前端界面

---

• Barnyard2 is a dedicated spooler for Snort’s unified2 binary output format. Packet processing is very resource intensive, so to reduce the load on the Snort process: we have Snort save suspicious packets to a directory in a native binary format without processing the packets. Barnyard2 then asynchronously processes those packets and saves them in a MySQL database.
• PulledPork is a Perl script that automatically downloads the latest Snort rulesets. Since the threat landscape is constantly evolving, new rulesets are required by Snort to identify the latest types of suspicious traffic (rulesets are similar to antivirus signatures).

- Snorby provides a web front-end to query and analyze the alerts coming from a Snort system.

参考：http://sublimerobots.com/2015/12/snort-2-9-8-x-on-ubuntu-part-1/
作者的环境是 Virtual Ubuntu 14.04-x86_64 server, 2G RAM,这对于小型家庭网络足够了。
有两个网卡。一个用于管理(可以是无线网)，另一个运行在混杂模式(promiscuous)

参考：http://www.ubuntu-howtodoit.com/?p=138
Snort is wrting to the correct binary log file. Barnyard is reading those logs. Barnyard is writing the events to the MySQL database.

Barnyard is an output system for Snort. Snort creates a special binary output format called unified. Barnyard reads this file, and then resends the data to a database backend.

参考：http://www.forensicswiki.org/wiki/Barnyard2

The waldo.file helps Barnyard keep a checkpoint of what data it has processed. The references to gen-msg.map and sid-msg.map help Barnyard translate generators and Snort IDs into human-readable formats.

参考：http://searchitchannel.techtarget.com/feature/Getting-Barnyard-working-with-Snort-databases

base

开启snort + barnyard2 + base 之后还是蛮有用的嘛。每次继续开启kali虚拟机的时候都会向我询问是否允许网络监听，开始觉得有点奇怪，想了一下才想到是snort在监听kali的eth0网络接口，使其变成混杂模式，能够监听局域网的流量，然而之前我对他是半信半疑，因为我监听无线局域网时并没能捕获到有用的内容，但是这次snort没有让我失望，从base展示的可以看出，确实捕获到了局域网的其他主机的ICMP流量。

另外从mysq数据库中也能找到日志的记录(barnyard2的功劳)。