mysql输入dnetstart无法启动_snort安装过程中遇到的问题及解决方案 | 学步园

While installing snort 2.9.* is possible you will receive an error in the compiling of daq 0.6, that says it cannot find a specific version of libpcap library. The error looks like this:

--------------------------------

checking for libpcap version >= "1.0.0"… no ERROR! Libpcap library version >= 1.0.0 not found. Get it from http://www.tcpdump.org

-----------------------------

In this case you need to install libpcap-1.0.0 or later:

------------------------

wget http://www.tcpdump.org/release/libpcap-1.0.0.tar.gz tar xvfz libpcap-1.0.0.tar.gz cd libpcap-1.0.0/ ./configure make make install

------------------------

If you still have problems, try to check this link:

libpcap not found I copied the new one over the old one and daq compiled and installed without issue:root@xxxx:# cp /usr/local/lib/libpcap.a /usr/lib/

10.1建立snort配置文件和日志目录

#mkdir /etc/snort

#mkdir /var/log/snort

#tar -zxvf snort-2.4.4.tar.gz

#cd snort-2.4.4

#./configure --with-mysql=/usr/local/mysql

#make

#make install

注意，我在编译snort时出现“ERROR!  Libpcre header not found, go get it from”的错误。这是因为少安装了一个lib的库，如果谁出现了这样的问题，就到ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/ 下载最新的pcre库进行安装。

方法： #tar -zxvf pcre-6.7.tar.gz

#./configure

#make

#make check

#make install

10.2安装规则和配置文件

#cd /etc/snort/

#tar ?zxvf /ruanjian/snortrules-snapshot-2.4.tar.gz

#cd /etc/snort/rules (在snort安装目录下)

#cp *.conf /etc/snort/.

#cp *.config /etc/snort/.

#cp *.map /etc/snort/.

10.3修改snort.conf   (/etc/snort/snort.conf)

var HOME_NET 172.17.4.0/24 (修改为你的内部网网络地址)

var RULE_PATH ./rules 修改为 var RULE_PATH /etc/snort/

改变记录日志数据库:

log与alert数据库要分别建，否则snort启动当有事件发生时候要出错

output database: log, mysql, user=root password=your_password dbname=snort host=localhost

output database: alert, mysql, user=root password=your_password dbname=snort host=localhost

安装DB表:(在schemas 目录)