snort没有create_mysql_snort安装和简单应用

1 安装Ubuntu16.04

2 配置网络eth1或em1

3 安装snort的前提条件：

sudo apt-get install -y build-essential; sudo apt-get install -y libpcap-dev libpcre3-dev libdumbnet-dev; sudo apt-get install -y bison flex;

创建文件夹: mkdir ~/snort_src; cd ~/snort_src

进入官网下载DAQ最新版: wget https://snort.org/downloads/snort/daq-2.0.6.tar.gz

tar -xvzf daq-2.0.6.tar.gz; cd daq-2.0.6; ./configure; make; sudo make install

4 安装snort

sudo apt-get install -y zlib1g-dev liblzma-dev openssl libssl-dev; sudo apt-get install -y libnghttp2-dev

cd ~/snort_src; wget https://snort.org/downloads/snort/snort-2.9.12.tar.gz; tar -xvzf snort-2.9.12.tar.gz

cd snort-2.9.12; ./configure --enable-sourcefire; make; sudo make install

更新共享库：sudo ldconfig;

sudo ln -s /usr/local/bin/snort /usr/sbin/snort

snort -V

5 配置snort运行在NIDS模式

# 创建snort用户和组：

sudo groupadd snort

sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort

# 创建snort目录:

sudo mkdir /etc/snort

sudo mkdir /etc/snort/rules

sudo mkdir /etc/snort/rules/iplists

sudo mkdir /etc/snort/preproc_rules

sudo mkdir /usr/local/lib/snort_dynamicrules

sudo mkdir /etc/snort/so_rules

<