snort 安装

最新推荐文章于 2024-07-12 13:45:39 发布

weixin_34357887

最新推荐文章于 2024-07-12 13:45:39 发布

阅读量1.2k

点赞数

文章标签：运维

原文链接：https://my.oschina.net/qbj/blog/911585

版权

为什么80%的码农都做不了架构师？>>>

1. snort 官网地址

https://www.snort.org

2.本次安装所需要的材料

机器：安装好Centos 6.7 版本的虚拟机一个，

文件：

libdnet-debuginfo-1.12-13.1.el7.x86_64.rpm

libpcap-devel-1.4.0-4.20130826git2dbcaa1.el6.x86_64.rpm

snort-2.9.8.3.tar.gz （官网可以下载）

daq-2.0.6.tar.gz （官网可以下载）

libdnet-1.11.tar.gz

3.安装步骤

1. 把文件复制 /tmp 目录下

2. 安装 libdnet

运行命令

rpm –i libdnet-debuginfo-1.12-13.1.el7.x86_64.rpm

即可安装

3. 安装 libpcap

运行命令

rpm -i libpcap -devel-1.4.0-4.20130826git2dbcaa1.el6.x86_64.rpm

即可安装

libpcap是unix/linux平台下的网络数据包捕获函数包，大多数网络监控软件都以它为基础。

4.安装 libdnet-1.11.tar.gz

cd /usr/local/src <enter>

tar -zxvf /tmp/libdnet-1.11.tar.gz <enter>

cd /usr/local/src/libdnet-1.11 <enter>

./configure –with-pic <enter>
make <enter>

make install <enter>

libdnet 简介：

libdnet 提供了简单、可移植的接口来操作底层网络，包括：

网址操作
内核 arp(4) 缓存和 route(4) 表查找和操作
网络防火墙 (IP filter, ipfw, ipchains, pf, PktFilter, ...)
网络接口查找和操作
IP tunnelling (BSD/Linux tun, Universal TUN/TAP device)
原始 IP包和以太网帧传输

支持的编程语言：

C, C++
Python
Perl, Ruby (see below)

支持的平台：

BSD (OpenBSD, FreeBSD, NetBSD, BSD/OS)
Linux (Redhat, Debian, Slackware, etc.)
MacOS X
Windows (NT/2000/XP)
Solaris
IRIX
HP-UX
Tru64

授权协议： BSD
开发语言： C/C++
操作系统：跨平台

5. 安装 daq-2.0.6.tar.gz

cd /usr/local/src <enter>
tar -zxvf /tmp/daq-2.0.6.tar.gz <enter>

cd /usr/local/src/daq-2.0.6 <enter>
./configure <enter>
make <enter>

make install <enter>

6. 安装 snort-2.9.8.3.tar.gz

cd /usr/local/src <enter>

tar -zxvf /tmp/snort-2.9.8.3.tar.gz <enter>

cd /usr/local/src/snort-2.9.8.x <enter>
  ./configure --enable-sourcefire <enter>
   make <enter>
  make install <enter>

7.检查安装成果

随便切换到任意目录下

[root@hcgCollect usr]# snort -v

控制台就会打印如下信息：

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
05/27-11:39:34.691103 10.20.3.11:58913 -> 10.20.1.129:22
TCP TTL:63 TOS:0x0 ID:7447 IpLen:20 DgmLen:40 DF
***A**** Seq: 0xE7AF876E Ack: 0xA2BE809F Win: 0x100 TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

05/27-11:39:34.692059 10.20.1.129:22 -> 10.20.3.11:58913
TCP TTL:64 TOS:0x10 ID:36146 IpLen:20 DgmLen:696 DF
***AP*** Seq: 0xA2BE89DF Ack: 0xE7AF876E Win: 0x190 TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

WARNING: No preprocessors configured for policy 0.
05/27-11:39:34.692114 10.20.3.11:58913 -> 10.20.1.129:22
TCP TTL:63 TOS:0x0 ID:7448 IpLen:20 DgmLen:40 DF
***A**** Seq: 0xE7AF876E Ack: 0xA2BE848F Win: 0xFC TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

05/27-11:39:34.693060 10.20.1.129:22 -> 10.20.3.11:58913
TCP TTL:64 TOS:0x10 ID:36147 IpLen:20 DgmLen:696 DF
***AP*** Seq: 0xA2BE8C6F Ack: 0xE7AF876E Win: 0x190 TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

05/27-11:39:34.694050 10.20.1.129:22 -> 10.20.3.11:58913
TCP TTL:64 TOS:0x10 ID:36148 IpLen:20 DgmLen:392 DF
***AP*** Seq: 0xA2BE8EFF Ack: 0xE7AF876E Win: 0x190 TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

05/27-11:39:34.695051 10.20.1.129:22 -> 10.20.3.11:58913
TCP TTL:64 TOS:0x10 ID:36149 IpLen:20 DgmLen:392 DF
***AP*** Seq: 0xA2BE905F Ack: 0xE7AF876E Win: 0x190 TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

按 crtl+c 退出当前运行，则会显示如下信息：

===============================================================================
Run time for packet processing was 56.365547 seconds
Snort processed 54290 packets.
Snort ran for 0 days 0 hours 0 minutes 56 seconds
Pkts/sec: 969
===============================================================================
Memory usage summary:
Total non-mmapped bytes (arena): 806912
Bytes in mapped regions (hblkhd): 21590016
Total allocated space (uordblks): 669680
Total free space (fordblks): 137232
Topmost releasable block (keepcost): 133408
===============================================================================
Packet I/O Totals:
Received: 54292
Analyzed: 54290 ( 99.996%)
Dropped: 0 ( 0.000%)
Filtered: 0 ( 0.000%)
Outstanding: 2 ( 0.004%)
Injected: 0
===============================================================================
Breakdown by protocol (includes rebuilt packets):
Eth: 54290 (100.000%)
VLAN: 0 ( 0.000%)
IP4: 54152 ( 99.746%)
Frag: 0 ( 0.000%)
ICMP: 1 ( 0.002%)
UDP: 227 ( 0.418%)
TCP: 53883 ( 99.250%)
IP6: 123 ( 0.227%)
IP6 Ext: 128 ( 0.236%)
IP6 Opts: 5 ( 0.009%)
Frag6: 0 ( 0.000%)
ICMP6: 9 ( 0.017%)
UDP6: 111 ( 0.204%)
TCP6: 0 ( 0.000%)
Teredo: 7 ( 0.013%)
ICMP-IP: 0 ( 0.000%)
IP4/IP4: 0 ( 0.000%)
IP4/IP6: 0 ( 0.000%)
IP6/IP4: 0 ( 0.000%)
IP6/IP6: 0 ( 0.000%)
GRE: 0 ( 0.000%)
GRE Eth: 0 ( 0.000%)
GRE VLAN: 0 ( 0.000%)
GRE IP4: 0 ( 0.000%)
GRE IP6: 0 ( 0.000%)
GRE IP6 Ext: 0 ( 0.000%)
GRE PPTP: 0 ( 0.000%)
GRE ARP: 0 ( 0.000%)
GRE IPX: 0 ( 0.000%)
GRE Loop: 0 ( 0.000%)
MPLS: 0 ( 0.000%)
ARP: 20 ( 0.037%)
IPX: 0 ( 0.000%)
Eth Loop: 0 ( 0.000%)
Eth Disc: 0 ( 0.000%)
IP4 Disc: 36 ( 0.066%)
IP6 Disc: 0 ( 0.000%)
TCP Disc: 0 ( 0.000%)
UDP Disc: 0 ( 0.000%)
ICMP Disc: 0 ( 0.000%)
All Discard: 36 ( 0.066%)
Other: 7 ( 0.013%)
Bad Chk Sum: 35270 ( 64.966%)
Bad TTL: 0 ( 0.000%)
S5 G 1: 0 ( 0.000%)
S5 G 2: 0 ( 0.000%)
Total: 54290
===============================================================================
Snort exiting