1. 安装依赖项
yum -y install gcc flex bison zlib zlib-devel libpcap libpcap-devel pcre pcre-devel libdnet libdnet-devel tcpdump epel-release nghttp2
2.安装
去官网找源码:
Snort Rules and IDS Software Download
wget https://www.snort.org/downloads/snort/snort-2.9.18.1.tar.gz
wget https://www.snort.org/downloads/snort/daq-2.0.7.tar.gz
再下libpcap和libdnet
wget http://www.tcpdump.org/release/libpcap-1.9.0.tar.gz
wget http://prdownloads.sourceforge.net/libdnet/libdnet-1.11.tar.gz
四个包分别解压
进libpcap解压后的目录:cd libpcap
./configure 查看是否有错,没错就make && make install
进libdnet解压后的目录:cd libdnet
./configure 查看是否有错,没错就make && make install
进daq解压后的目录:cd daq
./configure 查看是否有错,没错就make && make install
最后进snort解压后的目录:cd snort
./configure --enable-sourcefire
报错1:
安装zlib : yum -y install zlib-devel 再尝试./configure --enable-sourcefire
报错2:
打开给的网址
http://luajit.org/download.html
下载后解压,进入src目录make,再返回LuaJIT主目录下make install
然后再回到snort文件夹下./configure --enable-sourcefire
报错3:缺少openssl
yum install openssl
yum install openssl-devel
再回到snort文件夹下./configure --enable-sourcefire
报错4:仍是缺少依赖项:对症下药,我的yum install libtirpc-devel 就可以解决
同样再回到snort文件夹下./configure --enable-sourcefire,未报错
执行make && make install
最后:
snort --help 成功显示表示安装成功
【挖个坑,先折腾完snort2, 然后去搞snort3】