本人2009年最新的windows2003下配置snort2.8.4.1的总结

最近在win2003server下配snort2.8.4.1+php5.3+apache2.2+mysql5+adodb509a+base1.4.4+jpgraph+winpcap402，（也尝试用了acid0.9.6b23）
按照网上的提示配置，走了不少弯路，终于能运行起来。
用到的各个软件目前网上都能下载到，我也是刚下载的，所以需要的人自己去下即可。
安装顺序没有明确的先后，大致是
1,snort
2,winpcap
3,mysql5
4,apache2.2
5,php5.3
6,adodb, base, jpgraph

其中遇到过的问题有
1、php5.3 for windows有好几个安装或zip版本，包括nts(Non Thread Safe )或ts（Thread Safe ）的，应该下载ts。TS也分VC9或VC6，应该下载VC6的。然后又分zip和msi，我选择的是zip。如果搞错版本和文件，按网上其他人写的配置过程就会找不到一些dll文件。
2、apache2.2配php5好像有另一种写法，但还是用常见的写法比较合适，即
LoadModule php5_module "D:/PHP5/php5apache2_2.dll"
AddType application/x-httpd-php .php .phtml
3、snort本身不带rules，需要到他的网站用email注册并激活账号，就可以下载snortrules-snapshot-CURRENT.tar.gz。
4、mysql我用的是msi安装包，安装时会提示输入root的密码。我用的是sqlyog管理mysql，建立snort对应的数据表。有的帖子说要建立snort账号并授权，我懒得建立。
5、adodb解压到php5目录下，好像不用改它的配置
6、解压base到apache2\htdocs下，直接从ie里浏览，它会提示你一步步的配置，或者直接修改它的配置base_conf.php，里面有写adodb的路径，mysql的参数等，还可以设置界面语言简体中文。acid是很早以前的版本，已经不再更新，base是基于acid修改的，功能更好些，不过代码有问题，需要修改includes\base_state_citems.inc.php，在294行的ProtocolFieldCriteria类里，增加一个构造函数
function ProtocolFieldCriteria(&$db, &$cs, $export_name, $element_cnt, $field_list = Array() )
{
$tdb =& $db;
$cs =& $cs;

$this->BaseCriteria($tdb, $cs, $export_name);

$this->element_cnt = $element_cnt;
$this->criteria_cnt = 0;
$this->valid_field_list = $field_list;
}

7、snort安装时会提示你使用什么数据库，默认支持mysql，可选mssql或oracle。但如果选择后两种，好像需要你本机安装有相应的驱动，否则启动snort会报错找不到某些dll。
8、浏览base里图形页面，会报jpgragh临时目录没设置的问题，还没修改。好像是要建立csimcache目录。
9、运行snort，可能会抓不到数据包，可以运行snort -W 检查有几个网卡设备，然后运行命令时加上 -ix的参数，如-i2。
10、运行snort前，还需要在windows环境变量中加PCAP_FRAMES值为max
以上是已经解决的问题，但运行起snort后，用-v参数，能看见有数据包被抓获，但就是写入不到数据库里面，改成log输出也没有内容，很是奇怪


下面是snort配置，和屏幕输出
#--------------------------------------------------
# http://www.snort.org Snort 2.8.4.1 Ruleset
# Contact: snort-sigs@lists.sourceforge.net
#--------------------------------------------------
###################################################
# Step #1: Set the network variables:
#

var HOME_NET any

# Set up the external network addresses as well. A good start may be "any"
var EXTERNAL_NET any


# List of DNS servers on your network
var DNS_SERVERS $HOME_NET

# List of SMTP servers on your network
var SMTP_SERVERS $HOME_NET

# List of web servers on your network
var HTTP_SERVERS $HOME_NET

# List of sql servers on your network
var SQL_SERVERS $HOME_NET

# List of telnet servers on your network
var TELNET_SERVERS $HOME_NET

# List of snmp servers on your network
var SNMP_SERVERS $HOME_NET

portvar HTTP_PORTS 80

portvar SHELLCODE_PORTS !80

portvar ORACLE_PORTS 1521

var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]

var RULE_PATH d:\snort\rules
var PREPROC_RULE_PATH ../preproc_rules


###################################################
# Step #2: Configure dynamic loaded libraries
#
dynamicpreprocessor directory d:/snort/lib/snort_dynamicpreprocessor/

###################################################
# Step #3: Configure preprocessors
#

preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: policy first detect_anomalies

preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
track_udp no
preprocessor stream5_tcp: policy first, use_static_footprint_sizes
preprocessor http_inspect: global \
iis_unicode_map unicode.map 1252

preprocessor http_inspect_server: server default \
profile all ports { 80 8080 8180 } oversize_dir_length 500

preprocessor rpc_decode: 111 32771

preprocessor bo

preprocessor ftp_telnet: global \
encrypted_traffic yes \
inspection_type stateful

preprocessor ftp_telnet_protocol: telnet \
normalize \
ayt_attack_thresh 200

preprocessor ftp_telnet_protocol: ftp server default \
def_max_param_len 100 \
alt_max_param_len 200 { CWD } \
cmd_validity MODE < char ASBCZ > \
cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
chk_str_fmt { USER PASS RNFR RNTO SITE MKD } \
telnet_cmds yes \
data_chan

preprocessor ftp_telnet_protocol: ftp client default \
max_resp_len 256 \
bounce yes \
telnet_cmds yes

preprocessor smtp: \
ports { 25 587 691 } \
inspection_type stateful \
normalize cmds \
normalize_cmds { EXPN VRFY RCPT } \
alt_max_command_line_len 260 { MAIL } \
alt_max_command_line_len 300 { RCPT } \
alt_max_command_line_len 500 { HELP HELO ETRN } \
alt_max_command_line_len 255 { EXPN VRFY }

preprocessor sfportscan: proto { all } \
memcap { 10000000 } \
sense_level { low }


preprocessor dcerpc2
preprocessor dcerpc2_server: default


preprocessor dns: \
ports { 53 } \
enable_rdata_overflow

preprocessor ssl: noinspect_encrypted, trustservers


####################################################################
# Step #4: Configure output plugins
#
output database: alert, mysql, user=root password=111222 dbname=snort host=localhost encoding=ascii detail=full
# output alert_unified: filename snort.alert, limit 128
# output log_unified: filename snort.log, limit 128
include d:\snort\etc\classification.config
include d:\snort\etc\reference.config

####################################################################
# Step #5: Configure snort with config statements
#

####################################################################
# Step #6: Customize your rule set
#

include $RULE_PATH/local.rules
include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
include $RULE_PATH/ftp.rules
include $RULE_PATH/telnet.rules
include $RULE_PATH/rpc.rules
include $RULE_PATH/rservices.rules
include $RULE_PATH/dos.rules
include $RULE_PATH/ddos.rules
include $RULE_PATH/dns.rules
include $RULE_PATH/tftp.rules


输出

D:\>snort\bin\snort -c snort\etc\snort.conf -l d:\snort\log -i2
Running in IDS mode

--== Initializing Snort ==--
Initializing Output Plugins!Initializing Output Plugins!
Var '_ADDRESS' redefined
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file snort\etc\snort.conf
PortVar 'HTTP_PORTS' defined : [ 80 ]
PortVar 'SHELLCODE_PORTS' defined : [ 0:79 81:65535 ]
PortVar 'ORACLE_PORTS' defined : [ 1521 ]
Frag3 global config:
Max frags: 65536
Fragment memory cap: 4194304 bytes
Frag3 engine config:
Target-based policy: FIRST
Fragment timeout: 60 seconds
Fragment min_ttl: 1
Fragment ttl_limit (not used): 5
Fragment Problems: 1
Stream5 global config:
Track TCP sessions: ACTIVE
Max TCP sessions: 8192
Memcap (for reassembly packet storage): 8388608
Track UDP sessions: INACTIVE
Track ICMP sessions: INACTIVE
Log info if session memory consumption exceeds 1048576
Stream5 TCP Policy config:
Reassembly Policy: FIRST
Timeout: 30 seconds
Min ttl: 1
Maximum number of bytes to queue per session: 1048576
Maximum number of segs to queue per session: 2621
Options:
Static Flushpoint Sizes: YES
Reassembly Ports:
21 client (Footprint)
23 client (Footprint)
25 client (Footprint)
42 client (Footprint)
53 client (Footprint)
80 client (Footprint)
110 client (Footprint)
111 client (Footprint)
135 client (Footprint)
136 client (Footprint)
137 client (Footprint)
139 client (Footprint)
143 client (Footprint)
445 client (Footprint)
513 client (Footprint)
514 client (Footprint)
1433 client (Footprint)
1521 client (Footprint)
2401 client (Footprint)
3306 client (Footprint)
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests: 0
Inspection Type: STATELESS
Detect Proxy Usage: NO
IIS Unicode Map Filename: snort\etc\unicode.map
IIS Unicode Map Codepage: 1252
DEFAULT SERVER CONFIG:
Server profile: All
Ports: 80 8080 8180
Server Flow Depth: 300
Client Flow Depth: 300
Max Chunk Length: 500000
Max Header Field Length: 0
Max Number Header Fields: 0
Inspect Pipeline Requests: YES
URI Discovery Strict Mode: NO
Allow Proxy Usage: NO
Disable Alerting: NO
Oversize Dir Length: 500
Only inspect URI: NO
Normalize HTTP Headers: NO
Normalize HTTP Cookies: NO
Ascii: YES alert: NO
Double Decoding: YES alert: YES
%U Encoding: YES alert: YES
Bare Byte: YES alert: YES
Base36: OFF
UTF 8: OFF
IIS Unicode: YES alert: YES
Multiple Slash: YES alert: NO
IIS Backslash: YES alert: NO
Directory Traversal: YES alert: NO
Web Root Traversal: YES alert: YES
Apache WhiteSpace: YES alert: NO
IIS Delimiter: YES alert: NO
IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Non-RFC Compliant Characters: NONE
Whitespace Characters: 0x09 0x0b 0x0c 0x0d
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
Portscan Detection Config:
Detect Protocols: TCP UDP ICMP IP
Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
Sensitivity Level: Low
Memcap (in bytes): 10000000
Number of Nodes: 36900

Tagged Packet Limit: 256
Loading all dynamic preprocessor libs from d:/snort/lib/snort_dynamicpreprocesso
r/...
Loading dynamic preprocessor library d:/snort/lib/snort_dynamicpreprocessor/sf
_dce2.dll... done
Loading dynamic preprocessor library d:/snort/lib/snort_dynamicpreprocessor/sf
_dcerpc.dll... done
Loading dynamic preprocessor library d:/snort/lib/snort_dynamicpreprocessor/sf
_dns.dll... done
Loading dynamic preprocessor library d:/snort/lib/snort_dynamicpreprocessor/sf
_ftptelnet.dll... done
Loading dynamic preprocessor library d:/snort/lib/snort_dynamicpreprocessor/sf
_smtp.dll... done
Loading dynamic preprocessor library d:/snort/lib/snort_dynamicpreprocessor/sf
_ssh.dll... done
Loading dynamic preprocessor library d:/snort/lib/snort_dynamicpreprocessor/sf
_ssl.dll... done
Finished Loading all dynamic preprocessor libs from d:/snort/lib/snort_dynamic
preprocessor/
FTPTelnet Config:
GLOBAL CONFIG
Inspection Type: stateful
Check for Encrypted Traffic: YES alert: YES
Continue to check encrypted data: NO
TELNET CONFIG:
Ports: 23
Are You There Threshold: 200
Normalize: YES
Detect Anomalies: NO
FTP CONFIG:
FTP Server: default
Ports: 21
Check for Telnet Cmds: YES alert: YES
Identify open data channels: YES
FTP Client: default
Check for Bounce Attacks: YES alert: YES
Check for Telnet Cmds: YES alert: YES
Max Response Length: 256
SMTP Config:
Ports: 25 587 691
Inspection Type: Stateful
Normalize: EXPN RCPT VRFY
Ignore Data: No
Ignore TLS Data: No
Ignore SMTP Alerts: No
Max Command Line Length: Unlimited
Max Specific Command Line Length:
ETRN:500 EXPN:255 HELO:500 HELP:500 MAIL:260
RCPT:300 VRFY:255
Max Header Line Length: Unlimited
Max Response Line Length: Unlimited
X-Link2State Alert: Yes
Drop on X-Link2State Alert: No
Alert on commands: None
DCE/RPC 2 Preprocessor Configuration
Global Configuration
DCE/RPC Defragmentation: Enabled
Memcap: 102400 KB
Events: none
Server Default Configuration
Policy: WinXP
Detect ports
SMB: 139 445
TCP: 135
UDP: 135
RPC over HTTP server: 593
RPC over HTTP proxy: None
Autodetect ports
SMB: None
TCP: 1025-65535
UDP: 1025-65535
RPC over HTTP server: 1025-65535
RPC over HTTP proxy: None
Maximum SMB command chaining: 3 commands
DNS config:
DNS Client rdata txt Overflow Alert: ACTIVE
Obsolete DNS RR Types Alert: INACTIVE
Experimental DNS RR Types Alert: INACTIVE
Ports: 53
SSLPP config:
Encrypted packets: not inspected
Ports:
443 465 563 636 989
992 993 994 995
Server side data is trusted

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
d:\snort\rules/scan.rules(30): GID 1 SID 616 in rule: "alert tcp $EXTERNAL_NET a
ny -> $HOME_NET 113 (msg:"SCAN ident version request"; flow:to_server,establishe
d; content:"VERSION|0A|"; depth:16; reference:arachnids,303; classtype:attempted
-recon; sid:616; rev:4;" duplicates previous rule. Ignoring old rule.
608 Snort rules read
607 detection rules
0 decoder rules
0 preprocessor rules
607 Option Chains linked into 163 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

+-------------------[Rule Port Counts]---------------------------------------
| tcp udp icmp ip
| src 42 5 0 0
| dst 346 104 0 0
| any 43 42 16 10
| nc 9 4 3 8
| s+d 0 0 0 0
+----------------------------------------------------------------------------

+-----------------------[thresholding-config]----------------------------------
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]----------------------------------
| none
+-----------------------[thresholding-local]-----------------------------------
| gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=
10
| gen-id=1 sig-id=13948 type=Threshold tracking=src count=200 seconds=
30
+-----------------------[suppression]------------------------------------------
| none
-------------------------------------------------------------------------------
Rule application order: activation->dynamic->pass->drop->alert->log
Log directory = d:\snort\log
Verifying Preprocessor Configurations!
Warning: flowbits key 'mspub_header' is set but not ever checked.
Warning: flowbits key 'swf_file.request' is checked but not ever set.
Warning: flowbits key 'pdf_file.request' is checked but not ever set.
6 out of 512 flowbits in use.

Initializing Network Interface \Device\NPF_{00129D26-BF62-4020-B633-2E8F2DAF621C}
Decoding Ethernet on interface \Device\NPF_{00129D26-BF62-4020-B633-2E8F2DAF621C}
database: compiled support for ( mysql odbc )
database: configured to use mysql
database: user = root
database: password is set
database: database name = snort
database: host = localhost
database: data encoding = ascii
database: detail level = full
database: sensor name = SERVERNEW:\Device\NPF_{00129D26-BF62-4020-B633-2E8F2DAF621C}
database: sensor id = 3
database: schema version = 107
database: using the "alert" facility
fpBuildServicePortGroups: adding protocol-ordinal=6 as service=ftp
fpBuildServicePortGroups: adding protocol-ordinal=7 as service=telnet
fpBuildServicePortGroups: adding protocol-ordinal=33 as service=rtsp
fpBuildServicePortGroups: adding protocol-ordinal=17 as service=finger
fpBuildServicePortGroups: adding protocol-ordinal=5 as service=http
fpBuildServicePortGroups: adding protocol-ordinal=26 as service=sunrpc
fpBuildServicePortGroups: adding protocol-ordinal=15 as service=dns
fpBuildServicePortGroups: adding protocol-ordinal=8 as service=smtp
fpBuildServicePortGroups: adding protocol-ordinal=32 as service=ssl
fpBuildServicePortGroups: adding protocol-ordinal=5 as service=http
fpBuildServicePortGroups: adding protocol-ordinal=7 as service=telnet
fpBuildServicePortGroups: adding protocol-ordinal=15 as service=dns
fpBuildServicePortGroups: adding protocol-ordinal=23 as service=tftp
fpBuildServicePortGroups: adding protocol-ordinal=26 as service=sunrpc
fpBuildServicePortGroups: adding protocol-ordinal=11 as service=netbios-dgm
fpBuildServicePortGroups: adding protocol-ordinal=11 as service=netbios-dgm
fpBuildServicePortGroups: adding protocol-ordinal=15 as service=dns
fpBuildServicePortGroups: adding protocol-ordinal=26 as service=sunrpc

[ Port and Service Based Pattern Matching Memory ]
+-[AC-BNFA Search Info Summary]------------------------------
| Instances : 175
| Patterns : 7289
| Pattern Chars : 33855
| Num States : 17360
| Num Match States : 4146
| Memory : 798.98Kbytes
| Patterns : 203.73K
| Match Lists : 183.63K
| Transitions : 369.93K
+-------------------------------------------------

--== Initialization Complete ==--

,,_ -*> Snort! <*-
o" )~ Version 2.8.4.1-ODBC-MySQL-FlexRESP-WIN32 GRE (Build 38)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
Copyright (C) 1998-2009 Sourcefire, Inc., et al.
Using PCRE version: 7.4 2007-09-21

Preprocessor Object: SF_SSLPP Version 1.1 <Build 2>
Preprocessor Object: SF_SSH Version 1.1 <Build 1>
Preprocessor Object: SF_SMTP Version 1.1 <Build 7>
Preprocessor Object: SF_FTPTELNET Version 1.2 <Build 11>
Preprocessor Object: SF_DNS Version 1.1 <Build 2>
Preprocessor Object: SF_DCERPC Version 1.1 <Build 4>
Preprocessor Object: SF_DCERPC2 Version 1.0 <Build 1>
Using PCAP_FRAMES = max