CentOS8下安装snort2.9.18.1

1. 安装依赖项

yum -y install gcc flex bison zlib zlib-devel libpcap libpcap-devel pcre pcre-devel libdnet libdnet-devel tcpdump epel-release nghttp2

2.安装

去官网找源码：

Snort Rules and IDS Software Download

wget https://www.snort.org/downloads/snort/snort-2.9.18.1.tar.gz

wget https://www.snort.org/downloads/snort/daq-2.0.7.tar.gz

再下libpcap和libdnet

wget http://www.tcpdump.org/release/libpcap-1.9.0.tar.gz

wget http://prdownloads.sourceforge.net/libdnet/libdnet-1.11.tar.gz

四个包分别解压

进libpcap解压后的目录:cd libpcap

./configure 查看是否有错，没错就make && make install

进libdnet解压后的目录:cd libdnet

./configure 查看是否有错，没错就make && make install

进daq解压后的目录:cd daq

./configure 查看是否有错，没错就make && make install

最后进snort解压后的目录:cd snort

./configure --enable-sourcefire

报错1：

安装zlib : yum -y install zlib-devel  再尝试./configure --enable-sourcefire

报错2：

打开给的网址

http://luajit.org/download.html

 下载后解压，进入src目录make,再返回LuaJIT主目录下make install

然后再回到snort文件夹下./configure --enable-sourcefire

报错3：缺少openssl

yum install openssl

yum install openssl-devel

再回到snort文件夹下./configure --enable-sourcefire

报错4：仍是缺少依赖项：对症下药，我的yum install libtirpc-devel 就可以解决

同样再回到snort文件夹下./configure --enable-sourcefire，未报错

执行make && make install

最后：

snort --help 成功显示表示安装成功

 【挖个坑，先折腾完snort2, 然后去搞snort3】