Snort里如何将一个tcpdump格式的二进制文件读取打印到屏幕上(图文详解)

 

 

 

  不多说,直接上干货!

 

  关于tcpdump二进制格式,这个基本概念不说。

  支持tcpdump二进制格式的嗅探器工具,这里我说两个:tcpdump或者ethereal。

 

 

[root@datatest SecondWeek]# pwd
/root/data/DARPA1999/SecondWeek
[root@datatest SecondWeek]# ll
total 391652
-rw-r--r--. 1 root root 401046958 Aug  9 12:40 inside.tcpdump
[root@datatest SecondWeek]# snort -dv -r inside.tcpdump

 

   我这里,读取的是DARPA 1999数据集的第二周的内网inside.tcpdump二进制数据。

   

   这里的 -r命令,我就不说啦。 就是将一个tcpdump格式的二进制文件读取打印到屏幕上的意思。

  

 

 

 

 

 

 

  这里,我扩展下

[root@datatest SecondWeek]# snort -v 

  这个命令搭配的意思是,使得snort只输出IP、TCP、UDP和ICMP的包头信息

 

[root@datatest SecondWeek]# snort -v -r inside.tcpdump

 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
03/08-21:01:46.461764 207.25.71.141:80 -> 172.16.112.194:1306
TCP TTL:63 TOS:0x0 ID:498 IpLen:20 DgmLen:44
***A**S* Seq: 0x328B83B0  Ack: 0x48DA2A1F  Win: 0x7FE0  TcpLen: 24
TCP Options (1) => MSS: 1460 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
03/08-21:01:46.461920 172.16.112.194:1306 -> 207.25.71.141:80
TCP TTL:64 TOS:0x0 ID:729 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x48DA2A1F  Ack: 0x328B83B1  Win: 0x7D78  TcpLen: 20

*** Caught Int-Signal
WARNING: No preprocessors configured for policy 0.
03/08-21:01:46.869826 172.16.112.194:1559 -> 207.25.71.141:80
TCP TTL:64 TOS:0x0 ID:776 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x6F2E7AF7  Ack: 0xB057C6D7  Win: 0x7D78  TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

===============================================================================
Run time for packet processing was 0.228905 seconds
Snort processed 746 packets.
Snort ran for 0 days 0 hours 0 minutes 0 seconds
   Pkts/sec:          746
===============================================================================
Memory usage summary:
  Total non-mmapped bytes (arena):       925696
  Bytes in mapped regions (hblkhd):      12906496
  Total allocated space (uordblks):      669520
  Total free space (fordblks):           256176
  Topmost releasable block (keepcost):   185520
===============================================================================
Packet I/O Totals:
   Received:          746
   Analyzed:          746 (100.000%)
    Dropped:            0 (  0.000%)
   Filtered:            0 (  0.000%)
Outstanding:            0 (  0.000%)
   Injected:            0
===============================================================================
Breakdown by protocol (includes rebuilt packets):
        Eth:          746 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:          726 ( 97.319%)
       Frag:            0 (  0.000%)
       ICMP:            0 (  0.000%)
        UDP:           79 ( 10.590%)
        TCP:          647 ( 86.729%)
        IP6:            0 (  0.000%)
    IP6 Ext:            0 (  0.000%)
   IP6 Opts:            0 (  0.000%)
      Frag6:            0 (  0.000%)
      ICMP6:            0 (  0.000%)
       UDP6:            0 (  0.000%)
       TCP6:            0 (  0.000%)
     Teredo:            0 (  0.000%)
    ICMP-IP:            0 (  0.000%)
    IP4/IP4:            0 (  0.000%)
    IP4/IP6:            0 (  0.000%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            0 (  0.000%)
    GRE Eth:            0 (  0.000%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            0 (  0.000%)
    GRE Eth:            0 (  0.000%)
   GRE VLAN:            0 (  0.000%)
    GRE IP4:            0 (  0.000%)
    GRE IP6:            0 (  0.000%)
GRE IP6 Ext:            0 (  0.000%)
   GRE PPTP:            0 (  0.000%)
    GRE ARP:            0 (  0.000%)
    GRE IPX:            0 (  0.000%)
   GRE Loop:            0 (  0.000%)
       MPLS:            0 (  0.000%)
        ARP:            8 (  1.072%)
        IPX:            0 (  0.000%)
   Eth Loop:           10 (  1.340%)
   Eth Disc:            0 (  0.000%)
   IP4 Disc:            0 (  0.000%)
   IP6 Disc:            0 (  0.000%)
   TCP Disc:            0 (  0.000%)
   UDP Disc:            0 (  0.000%)
  ICMP Disc:            0 (  0.000%)
All Discard:            0 (  0.000%)
      Other:            2 (  0.268%)
Bad Chk Sum:            0 (  0.000%)
    Bad TTL:            0 (  0.000%)
     S5 G 1:            0 (  0.000%)
     S5 G 2:            0 (  0.000%)
      Total:          746
===============================================================================
Snort exiting

 

 

 

 

 

 

  

[root@datatest SecondWeek]# snort -d 

  这个命令搭配的意思是,使得snort只包的数据信息

  

[root@datatest SecondWeek]# snort -d -r inside.tcpdump

  得到

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
03/08-21:00:58.188692 206.48.44.18:1054 -> 172.16.112.100:21
TCP TTL:126 TOS:0x0 ID:39424 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x17AD29  Ack: 0x17AE81  Win: 0x2238  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
03/08-21:00:58.203130 172.16.112.100:21 -> 206.48.44.18:1054
TCP TTL:128 TOS:0x0 ID:38400 IpLen:20 DgmLen:87 DF
***AP*** Seq: 0x17AE81  Ack: 0x17AD29  Win: 0x2238  TcpLen: 20
32 32 30 20 68 75 6D 65 20 4D 69 63 72 6F 73 6F  220 hume Microso
66 74 20 46 54 50 20 53 65 72 76 69 63 65 20 28  ft FTP Service (
56 65 72 73 69 6F 6E 20 32 2E 30 29 2E 0D 0A     Version 2.0)...
===============================================================================
Run time for packet processing was 0.232618 seconds
Snort processed 254 packets.
Snort ran for 0 days 0 hours 0 minutes 0 seconds
   Pkts/sec:          254
===============================================================================
Memory usage summary:
  Total non-mmapped bytes (arena):       925696
  Bytes in mapped regions (hblkhd):      13180928
  Total allocated space (uordblks):      669520
  Total free space (fordblks):           256176
  Topmost releasable block (keepcost):   185520
===============================================================================
Packet I/O Totals:
   Received:          254
   Analyzed:          254 (100.000%)
    Dropped:            0 (  0.000%)
   Filtered:            0 (  0.000%)
Outstanding:            0 (  0.000%)
   Injected:            0
===============================================================================
Breakdown by protocol (includes rebuilt packets):
        Eth:          254 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:          242 ( 95.276%)
       Frag:            0 (  0.000%)
       ICMP:            0 (  0.000%)
        UDP:           42 ( 16.535%)
        TCP:          200 ( 78.740%)
        IP6:            0 (  0.000%)
    IP6 Ext:            0 (  0.000%)
   IP6 Opts:            0 (  0.000%)
      Frag6:            0 (  0.000%)
      ICMP6:            0 (  0.000%)
       UDP6:            0 (  0.000%)
       TCP6:            0 (  0.000%)
     Teredo:            0 (  0.000%)
    ICMP-IP:            0 (  0.000%)
    IP4/IP4:            0 (  0.000%)
    IP4/IP6:            0 (  0.000%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            0 (  0.000%)
    GRE Eth:            0 (  0.000%)
   GRE VLAN:            0 (  0.000%)
    GRE IP4:            0 (  0.000%)
    GRE IP6:            0 (  0.000%)
GRE IP6 Ext:            0 (  0.000%)
   GRE PPTP:            0 (  0.000%)
    GRE ARP:            0 (  0.000%)
    GRE IPX:            0 (  0.000%)
   GRE Loop:            0 (  0.000%)
       MPLS:            0 (  0.000%)
        ARP:            6 (  2.362%)
        IPX:            0 (  0.000%)
   Eth Loop:            5 (  1.969%)
   Eth Disc:            0 (  0.000%)
   IP4 Disc:            0 (  0.000%)
   IP6 Disc:            0 (  0.000%)
   TCP Disc:            0 (  0.000%)
   UDP Disc:            0 (  0.000%)
  ICMP Disc:            0 (  0.000%)
All Discard:            0 (  0.000%)
      Other:            1 (  0.394%)
Bad Chk Sum:            0 (  0.000%)
    Bad TTL:            0 (  0.000%)
     S5 G 1:            0 (  0.000%)
     S5 G 2:            0 (  0.000%)
      Total:          254
===============================================================================
Snort exiting
[root@datatest SecondWeek]# 

 

 

 

 

 

 

[root@datatest SecondWeek]# snort -dv 

   这个命令搭配的意思是,使得snort在输出IP、TCP、UDP和ICMP的包头信息的通俗,还显示包的数据信息。

 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
03/08-21:01:42.867811 195.73.151.50:1028 -> 172.16.114.168:25
TCP TTL:63 TOS:0x0 ID:494 IpLen:20 DgmLen:77 DF
***AP*** Seq: 0xE888C943  Ack: 0x9A021B4D  Win: 0x7D78  TcpLen: 20
4D 41 49 4C 20 46 72 6F 6D 3A 3C 61 76 72 61 70  MAIL From:<avrap
40 6C 61 6D 62 64 61 2E 6F 72 61 6E 67 65 2E 63  @lambda.orange.c
6F 6D 3E 0D 0A                                   om>..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
03/08-21:01:42.868044 172.16.114.168:25 -> 195.73.151.50:1028
TCP TTL:64 TOS:0x0 ID:542 IpLen:20 DgmLen:84 DF
***AP*** Seq: 0x9A021B4D  Ack: 0xE888C968  Win: 0x7FE0  TcpLen: 20
32 35 30 20 3C 61 76 72 61 70 40 6C 61 6D 62 64  250 <avrap@lambd
61 2E 6F 72 61 6E 67 65 2E 63 6F 6D 3E 2E 2E 2E  a.orange.com>...
20 53 65 6E 64 65 72 20 4F 6B 0D 0A               Sender Ok..



=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

*** Caught Int-Signal
WARNING: No preprocessors configured for policy 0.
03/08-21:01:42.875769 195.73.151.50:1028 -> 172.16.114.168:25
TCP TTL:63 TOS:0x0 ID:498 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE888CD92  Ack: 0x9A021BCE  Win: 0x7D78  TcpLen: 20
6F 66 20 67 61 69 6E 2C 20 77 65 3A 0D 0A 20 20  of gain, we:..  
20 20 20 20 20 20 63 6F 75 6C 64 20 61 6C 73 6F        could also
20 75 73 65 73 20 54 68 65 20 6F 66 20 4E 65 74   uses The of Net
77 6F 72 6B 20 6E 65 75 72 61 6C 20 6E 65 74 77  work neural netw
6F 72 6B 73 20 61 0D 0A 20 20 20 20 20 20 20 20  orks a..        
43 61 73 63 61 64 65 20 72 6F 75 74 69 6E 65 73  Cascade routines
20 79 65 61 72 20 61 76 61 69 6C 61 62 6C 65 20   year available 
76 69 61 20 70 72 69 63 65 20 61 6E 64 20 54 68  via price and Th
65 20 62 75 67 0D 0A 20 20 20 20 20 20 20 20 69  e bug..        i
73 20 61 20 6C 65 63 74 75 72 65 20 6E 6F 74 65  s a lecture note
73 2E 20 0D 0A 0D 0A 20 20 20 20 20 20 20 20 57  s. ....        W
68 65 6E 20 68 65 20 74 6F 20 64 6F 20 6E 6F 74  hen he to do not
20 68 61 76 65 20 61 6E 79 6F 6E 65 20 77 69 74   have anyone wit
68 20 74 6F 6D 6F 72 72 6F 77 2C 20 62 75 74 20  h tomorrow, but 
74 68 65 0D 0A 20 20 20 20 20 20 20 20 65 6C 69  the..        eli
74 65 2C 20 42 75 74 20 49 20 49 20 6B 65 70 74  te, But I I kept
20 54 68 65 20 72 65 6D 61 69 6E 64 65 72 20 61   The remainder a
72 65 20 74 6F 20 74 72 61 69 6E 20 74 72 61 63  re to train trac
6B 73 20 62 79 0D 0A 20 20 20 20 20 20 20 20 74  ks by..        t
69 74 6C 65 3B 20 6F 6E 20 68 69 67 68 20 74 65  itle; on high te
6D 70 65 72 61 74 75 72 65 20 6C 69 6D 69 74 20  mperature limit 
54 68 65 20 64 65 70 65 6E 64 73 20 6F 66 20 54  The depends of T
68 65 0D 0A 20 20 20 20 20 20 20 20 6E 65 78 74  he..        next
2E 20 20 54 65 6C 65 78 2E 20 20 4A 72 2E 20 20  .  Telex.  Jr.  
4C 6F 6E 64 6F 6E 20 70 6C 61 79 73 20 41 6E 64  London plays And
72 65 20 54 65 6C 3A 20 61 20 77 68 69 6C 65 0D  re Tel: a while.
0A 20 20 20 20 20 20 20 20 73 74 69 6C 6C 20 69  .        still i
6E 20 61 2C 20 67 6F 6F 64 20 61 75 74 6F 6D 61  n a, good automa
74 69 63 61 6C 6C 79 20 77 68 69 63 68 20 64 6F  tically which do
20 74 68 65 69 72 20 6D 61 69 6C 69 6E 67 0D 0A   their mailing..
20 20 20 20 20 20 20 20 46 69 6C 65 20 49 66 20          File If 
54 68 65 20 6F 6E 65 73 20 64 6F 6E 27 74 20 6B  The ones don't k
6E 6F 77 20 49 6E 74 72 6F 64 75 63 74 6F 72 79  now Introductory
20 63 6F 75 72 73 65 20 6F 66 0D 0A 20 20 20 20   course of..    
20 20 20 20 70 72 6F 6F 66 73 20 49 20 68 61 64      proofs I had
20 61 20 70 72 65 66 69 78 20 74 68 65 2E 20 20   a prefix the.  
49 20 62 65 6C 69 65 76 65 20 74 68 65 20 76 61  I believe the va
6C 75 65 20 46 72 6F 6D 0D 0A 20 20 20 20 20 20  lue From..      
20 20 68 6F 73 74 20 68 6F 73 74 20 70 6F 72 74    host host port
20 74 6F 20 67 6C 6F 62 61 6C 20 65 61 63 68 20   to global each 
53 70 65 61 6B 65 72 20 72 65 63 6F 67 6E 69 74  Speaker recognit
69 6F 6E 0D 0A 20 20 20 20 20 20 20 20 73 70 65  ion..        spe
===============================================================================
Run time for packet processing was 0.521737 seconds
Snort processed 343 packets.
Snort ran for 0 days 0 hours 0 minutes 0 seconds
   Pkts/sec:          343
===============================================================================
Memory usage summary:
  Total non-mmapped bytes (arena):       925696
  Bytes in mapped regions (hblkhd):      13180928
  Total allocated space (uordblks):      669520
  Total free space (fordblks):           256176
  Topmost releasable block (keepcost):   185520
===============================================================================
Packet I/O Totals:
   Received:          343
   Analyzed:          343 (100.000%)
    Dropped:            0 (  0.000%)
   Filtered:            0 (  0.000%)
Outstanding:            0 (  0.000%)
   Injected:            0
===============================================================================
Breakdown by protocol (includes rebuilt packets):
        Eth:          343 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:          323 ( 94.169%)
       Frag:            0 (  0.000%)
       ICMP:            0 (  0.000%)
        UDP:           73 ( 21.283%)
        TCP:          250 ( 72.886%)
        IP6:            0 (  0.000%)
    IP6 Ext:            0 (  0.000%)
    IP4/IP6:            0 (  0.000%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            0 (  0.000%)
    GRE Eth:            0 (  0.000%)
   GRE VLAN:            0 (  0.000%)
    GRE IP4:            0 (  0.000%)
    GRE IP6:            0 (  0.000%)
GRE IP6 Ext:            0 (  0.000%)
   GRE PPTP:            0 (  0.000%)
    GRE ARP:            0 (  0.000%)
    GRE IPX:            0 (  0.000%)
   GRE Loop:            0 (  0.000%)
       MPLS:            0 (  0.000%)
        ARP:            8 (  2.332%)
        IPX:            0 (  0.000%)
   Eth Loop:           10 (  2.915%)
   Eth Disc:            0 (  0.000%)
   IP4 Disc:            0 (  0.000%)
   IP6 Disc:            0 (  0.000%)
   TCP Disc:            0 (  0.000%)
   UDP Disc:            0 (  0.000%)
  ICMP Disc:            0 (  0.000%)
All Discard:            0 (  0.000%)
      Other:            2 (  0.583%)
Bad Chk Sum:            0 (  0.000%)
    Bad TTL:            0 (  0.000%)
     S5 G 1:            0 (  0.000%)
     S5 G 2:            0 (  0.000%)
      Total:          343
===============================================================================
Snort exiting
[root@datatest SecondWeek]# 

 

 

 

  

   进一步,见

Snort 命令参数详解

 

  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值