Snort 2.8.5入侵检测系统用户手册概览与配置指南

需积分: 10 42 浏览量更新于2024-08-02 收藏 861KB PDF 举报

《网络入侵系统Snort用户手册》是关于Snort 2.8.5版本的详细介绍，由The Snort Project于2009年10月22日发布。Snort是一个强大的网络嗅探器和网络入侵检测系统（NIDS），它最初由Martin Roesch在1998年至2003年间创建，后在2001年至2003年由Chris Green扩展，并在2003年至2009年由Sourcefire, Inc.继续维护和更新。本手册分为多个章节，涵盖了Snort的主要功能和配置方法： 1. **概述**：简要介绍Snort的功能，包括如何入门、作为嗅探器（Sniffer Mode）、包日志记录器（Packet Logger Mode）、以及作为NIDS的基本操作模式。 2. **NIDS模式**： - **输出选项**：讨论了NIDS模式下的不同输出选项，如标准警报输出的理解和自定义。 - **性能优化**：提供了关于如何提高Snort性能的建议，如调整规则集和配置以减少误报。 - **警报顺序**：讲解如何改变警报产生的顺序，以便更好地管理和分析。 - ** Inline模式**：Snort的实时数据包处理能力，包括规则应用顺序、替换原始包、安装、运行和使用工具集等。 - **其他功能**：如运行Snort作为守护进程、规则stub的创建、IP地址隐藏、多实例标识符的指定等。 3. **PCAP文件处理**：指导如何读取和解析pcap（Packet Capture）文件，包括命令行参数和示例操作。 4. **隧道协议支持**：解释Snort如何处理和解析加密或隧道化的网络流量，如多层封装。这份手册不仅适合Snort的新手，也对有经验的网络管理员和安全专业人员非常有用，因为它提供了深入的配置指导和技术细节。通过学习和理解这些内容，用户可以充分利用Snort的强大功能来保护网络环境，检测潜在的安全威胁。

1.6 Miscellaneous

1.6.1 Running Snort as a Daemon

If you want to run Snort as a daemon, you can the add -D switch to any combination described in the previous sections.

Please notice that if you want to be able to restart Snort by sending a SIGHUP signal to the daemon, you must specify

the full path to the Snort binary when you start it, for example:

/usr/local/bin/snort -d -h 192.168.1.0/24 \

-l /var/log/snortlogs -c /usr/local/etc/snort.conf -s -D

Relative paths are not supported due to security concerns.

Snort PID File

When Snort is run as a daemon , the daemon creates a PID ﬁle in the log directory. In Snort 2.6, the

--pid-path

command line switch causes Snort to write the PID ﬁle in the directory speciﬁed.

Additionally, the

--create-pidfile

switch can be used to force creation of a PID ﬁle even when not running in

daemon mode.

The PID ﬁle will be locked so that other snort processes cannot start. Use the

--nolock-pidfile

switch to not lock

the PID ﬁle.

1.6.2 Running in Rule Stub Creation Mode

If you need to dump the shared object rules stub to a directory, you might need to use the –dump-dynamic-rulesoption.

These rule stub ﬁles are used in conjunction with the shared object rules. The path can be relative or absolute.

/usr/local/bin/snort -c /usr/local/etc/snort.conf \

--dump-dynamic-rules=/tmp

This path can also be conﬁgured in the snort.conf using the conﬁg option dump-dynamic-rules-path as follows:

config dump-dynamic-rules-path: /tmp/sorules

The path conﬁgured by command line has precedence over the one conﬁgured using dump-dynamic-rules-path.

/usr/local/bin/snort -c /usr/local/etc/snort.conf \

--dump-dynamic-rules

snort.conf:

config dump-dynamic-rules-path: /tmp/sorules

In the above mentioned scenario the dump path is set to /tmp/sorules.

1.6.3 Obfuscating IP Address Printouts

If you need to post packet logs to public mailing lists, you might want to use the -O switch. This switch obfuscates

your IP addresses in packet printouts. This is handy if you don’t want people on the mailing list to know the IP

addresses involved. You can also combine the -O switch with the -h switch to only obfuscate the IP addresses of hosts

on the home network. This is useful if you don’t care who sees the address of the attacking host. For example, you

could use the following command to read the packets from a log ﬁle and dump them to the screen, obfuscating only

the addresses from the 192.168.1.0/24 class C network:

./snort -d -v -r snort.log -O -h 192.168.1.0/24

1.6.4 Specifying Multiple-Instance Identiﬁers

In Snort v2.4, the

-G

command line option was added that speciﬁes an instance identiﬁer for the event logs. This option

can be used when running multiple instances of snort, either on different CPUs, or on the same CPU but a different

interface. Each Snort instance will use the value speciﬁed to generate unique event IDs. Users can specify either a

decimal value (

-G 1

) or hex value preceded by 0x (

-G 0x11

). This is also supported via a long option

--logid

1.7 Reading Pcaps

Instead of having Snort listen on an interface, you can give it a packet capture to read. Snort will read and analyze the

packets as if they came off the wire. This can be useful for testing and debugging Snort.

1.7.1 Command line arguments

Any of the below can be speciﬁed multiple times on the command line (

-r

included) and in addition to other Snort

command line options. Note, however, that specifying

--pcap-reset

and

--pcap-show

multiple times has the same

effect as specifying them once.

Option Description

-r <file>

Read a single pcap.

--pcap-single=<file>

Same as -r. Added for completeness.

--pcap-file=<file>

File that contains a list of pcaps to read. Can speciﬁy path to pcap or directory to

recurse to get pcaps.

--pcap-list="<list>"

A space separated list of pcaps to read.

--pcap-dir=<dir>

A directory to recurse to look for pcaps. Sorted in ascii order.

--pcap-filter=<filter>

Shell style ﬁlter to apply when getting pcaps from ﬁle or directory. This ﬁl-

ter will apply to any

--pcap-file

--pcap-dir

arguments following. Use

--pcap-no-filter

to delete ﬁlter for following

--pcap-file

--pcap-dir

arguments or speciﬁy

--pcap-filter

again to forget previous ﬁlter and to apply

to following

--pcap-file

--pcap-dir

arguments.

--pcap-no-filter

Reset to use no ﬁlter when getting pcaps from ﬁle or directory.

--pcap-reset

If reading multiple pcaps, reset snort to post-conﬁguration state before reading

next pcap. The default, i.e. without this option, is not to reset state.

--pcap-show

Print a line saying what pcap is currently being read.

1.7.2 Examples

Read a single pcap

$ snort -r foo.pcap

$ snort --pcap-single=foo.pcap

Read pcaps from a ﬁle

$ cat foo.txt

foo1.pcap

foo2.pcap

/home/foo/pcaps

$ snort --pcap-file=foo.txt

This will read foo1.pcap, foo2.pcap and all ﬁles under /home/foo/pcaps. Note that Snort will not try to determine

whether the ﬁles under that directory are really pcap ﬁles or not.

Read pcaps from a command line list

$ snort --pcap-list="foo1.pcap foo2.pcap foo3.pcap"

This will read foo1.pcap, foo2.pcap and foo3.pcap.

Read pcaps under a directory

$ snort --pcap-dir="/home/foo/pcaps"

This will include all of the ﬁles under /home/foo/pcaps.

Using ﬁlters

$ cat foo.txt

foo1.pcap

foo2.pcap

/home/foo/pcaps

$ snort --pcap-filter="*.pcap" --pcap-file=foo.txt

$ snort --pcap-filter="*.pcap" --pcap-dir=/home/foo/pcaps

The above will only include ﬁles that match the shell pattern ”*.pcap”, in other words, any ﬁle ending in ”.pcap”.

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \

> --pcap-filter="*.cap" --pcap-dir=/home/foo/pcaps

In the above, the ﬁrst ﬁlter ”*.pcap” will only be applied to the pcaps in the ﬁle ”foo.txt” (and any directories that are

recursed in that ﬁle). The addition of the second ﬁlter ”*.cap” will cause the ﬁrst ﬁlter to be forgotten and then applied

to the directory /home/foo/pcaps, so only ﬁles ending in ”.cap” will be included from that directory.

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \

> --pcap-no-filter --pcap-dir=/home/foo/pcaps

In this example, the ﬁrst ﬁlter will be applied to foo.txt, then no ﬁlter will be applied to the ﬁles found under

/home/foo/pcaps, so all ﬁles found under /home/foo/pcaps will be included.

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \

> --pcap-no-filter --pcap-dir=/home/foo/pcaps \

> --pcap-filter="*.cap" --pcap-dir=/home/foo/pcaps2

In this example, the ﬁrst ﬁlter will be applied to foo.txt, then no ﬁlter will be applied to the ﬁles found under

/home/foo/pcaps, so all ﬁles found under /home/foo/pcaps will be included, then the ﬁlter ”*.cap” will be applied

to ﬁles found under /home/foo/pcaps2.

Resetting state

$ snort --pcap-dir=/home/foo/pcaps --pcap-reset

The above example will read all of the ﬁles under /home/foo/pcaps, but after each pcap is read, Snort will be reset to

a post-conﬁguration state, meaning all buffers will be ﬂushed, statistics reset, etc. For each pcap, it will be like Snort

is seeing trafﬁc for the ﬁrst time.

剩余177页未读，继续阅读

junsofter

粉丝: 2
资源: 3

Snort 2.8.5入侵检测系统用户手册概览与配置指南

入侵检测\snort中文手册

开源入侵防护snort中文手册

Snort 手册

Snort中文手册：网络入侵检测系统详解

Snort用户手册：网络入侵检测系统指南

Snort用户手册：简化网络入侵检测系统配置与使用

Snort用户手册：网络入侵检测详解

Snort入侵检测系统用户手册：配置与使用详解

Snort用户手册：入侵检测与网络监控

Snort中文手册：网络入侵检测与数据包记录

最新资源