入侵检测系统snort

要求

snort 的安装与配置

自己设计snort 规则发现入侵企图

实验步骤

1. 安装相应软件
   参考链接：
   apache编译安装，解决configure: error: APR not found . Please read the documentation问题！ - ★昔梦无痕★ - CSDN博客
   https://blog.csdn.net/superbirds/article/details/52373102

2. test.conf
   注意规则之间要有空格

var HOME_NET 192.168.59.110

log tcp any any -> $HOME_NET 80 (msg:"log http"; sid:100;)
alert tcp ![192.168.59.10] any -> $HOME_NET 22 (msg:"ssh attack"; sid:101;)
#pass tcp 192.168.59.1 any -> any any 
alert icmp any any -> $HOME_NET any (msg:"icmp attack"; sid:102;)

3. snort -dev -l /ver/log/snort/ -c ./test.conf