Suricata 4.1.10 用户手册：IDS 引擎详解

需积分: 0 148 浏览量更新于2024-06-18 收藏 3MB PDF 举报

"Suricata 是一款开源的网络入侵检测系统（IDS）和网络入侵防御系统（NIDS/NIPS）。用户手册提供了 Suricata 4.1.10 版本的详细使用指南，涵盖了从安装到规则管理等多个方面。" Suricata 是一个强大的网络安全工具，由 Open Information Security Foundation (OISF) 维护，它能够实时分析网络流量，检测潜在的攻击和恶意活动。用户手册包含了以下关键知识点： 1. **关于 Suricata**：Suricata 是一个高效的多线程引擎，能够处理高速网络流量，同时支持多种协议分析，包括但不限于 HTTP、DNS、SSL/TLS 和 SSH。 2. **安装**：手册详细介绍了源代码安装和二进制包安装的方法，同时也涵盖了高级安装选项，以适应不同环境的需求。 3. **命令行选项**：Suricata 提供了许多命令行参数，用于配置其行为，例如日志级别、规则加载、性能调整等。 4. **Suricata 规则**：规则是 Suricata 的核心部分，手册详细解析了规则的格式，包括元关键词（Meta Keywords）、IP 关键词、TCP 关键词、ICMP 关键词等，这些关键词用于定义匹配条件和触发警报。 - **元关键词**：如 gid、sid、rev 等，标识规则的唯一性和版本信息。 - **IP 关键词**：允许基于 IP 地址或网络进行匹配。 - **TCP/UDP/ICMP 关键词**：针对特定传输层协议的行为进行检测。 - **负载关键词**：检查网络数据包的实际载荷内容。 - **流关键词**：处理基于连接的上下文信息。 - **预过滤关键词**：在规则处理之前对流量进行过滤。 - **HTTP/HTTPS、DNS、SSL/TLS、SSH 等应用层关键词**：对特定应用协议进行深入分析。 5. **阈值和 IP 声誉**：Suricata 支持阈值规则来限制警报频率，以及 IP 声誉系统来识别已知恶意 IP。 6. **Lua 脚本编程**：Suricata 允许用户使用 Lua 编写自定义脚本来扩展其功能，如定制事件处理和数据分析。 7. **规则管理**：手册解释了如何使用 Suricata-Update 工具进行规则维护，包括规则的更新、导入和导出。 8. **与其他系统差异**：Suricata 相比 Snort，提供了更多的协议支持和更灵活的规则语法。通过这个用户手册，用户可以深入了解 Suricata 的工作原理，学习如何配置和优化系统，以及有效地利用规则库来保护网络免受各种威胁。无论是初次接触 Suricata 的新手，还是经验丰富的安全分析师，都能从中获取大量有价值的信息。

Suricata User Guide, Release 4.1.10

-U, --unittest-filter=REGEX

With the -U option you can select which of the unit tests you want to run. This option uses REGEX. Example

of use: suricata -u -U http

--list-unittests

List all unit tests.

--fatal-unittests

Enables fatal failure on a unit test error. Suricata will exit instead of continuing more tests.

--unittests-coverage

Display unit test coverage report.

10 Chapter 3. Command Line Options

CHAPTER

FOUR

SURICATA RULES

4.1 Rules Format

Signatures play a very important role in Suricata. In most occasions people are using existing rulesets.

The ofﬁcial way to install rulesets is described in Rule Management with Suricata-Update.

This Suricata Rules document explains all about signatures; how to read, adjust and create them.

A rule/signature consists of the following:

• The action, that determines what happens when the signature matches

• The header, deﬁning the protocol, IP addresses, ports and direction of the rule.

• The rule options, deﬁning the speciﬁcs of the rule.

An example of a rule is as follows:

drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:”ET TROJAN Likely Bot Nick in IRC (USA +..)”;

ﬂow:established,to_server; ﬂowbits:isset,is_proto_irc; content:”NICK ”; pcre:”/NICK .*USA.*[0-9]{3,}/i”; refer-

ence:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)

In this example, red is the action, green is the header and blue are the options.

We will be using the above signature as an example throughout this section, highlighting the different parts of the

signature. It is a signature taken from the database of Emerging Threats, an open database featuring lots of rules that

you can freely download and use in your Suricata instance.

4.1.1 Action

drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:”ET TROJAN Likely Bot Nick in IRC (USA +..)”;

ﬂow:established,to_server; ﬂowbits:isset,is_proto_irc; content:”NICK ”; pcre:”/NICK .*USA.*[0-9]{3,}/i”; refer-

ence:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)

For more information see Action-order.

4.1.2 Protocol

drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:”ET TROJAN Likely Bot Nick in IRC (USA +..)”;

ﬂow:established,to_server; ﬂowbits:isset,is_proto_irc; content:”NICK ”; pcre:”/NICK .*USA.*[0-9]{3,}/i”; refer-

ence:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)

This keyword in a signature tells Suricata which protocol it concerns. You can choose between four basic protocols:

• tcp (for tcp-trafﬁc)

Suricata User Guide, Release 4.1.10

Normally, you would also make use of variables, such as $HOME_NET and $EXTERNAL_NET. The conﬁguration ﬁle

speciﬁes the IP addresses these concern, and these settings will be used in place of the variables in you rules. See

Rule-vars for more information.

For example:

Example Meaning

! 1.1.1.1 Every IP address but 1.1.1.1

![1.1.1.1, 1.1.1.2] Every IP address but 1.1.1.1 and 1.1.1.2

$HOME_NET Your setting of HOME_NET in yaml

[$EXTERNAL_NET, !$HOME_NET] EXTERNAL_NET and not HOME_NET

[10.0.0.0/24, !10.0.0.5] 10.0.0.0/24 except for 10.0.0.5

[..., [....]]

[..., ![.....]]

Warning: If you set your conﬁguration to something like this:

HOME_NET: any

EXTERNAL_NET: ! $HOME_NET

You can not write a signature using $EXTERNAL_NET because it stands for ‘not any’. This is an invalid setting.

4.1.4 Ports (source and destination)

drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:”ET TROJAN Likely Bot Nick in IRC (USA +..)”;

ﬂow:established,to_server; ﬂowbits:isset,is_proto_irc; content:”NICK ”; pcre:”/NICK .*USA.*[0-9]{3,}/i”; refer-

ence:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:2;)

The ﬁrst emphasized part is the source, the second is the destination (note the direction of the directional arrow).

Trafﬁc comes in and goes out through ports. Different ports have different port numbers. For example, the default port

for HTTP is 80 while 443 is typically the port for HTTPS. Note, however, that the port does not dictate which protocol

is used in the communication. Rather, it determines which application is receiving the data.

The ports mentioned above are typically the destination ports. Source ports, i.e. the application that sent the packet,

typically get assigned a random port by the operating system. When writing a rule for your own HTTP service, you

would typically write any -> 80, since that would mean any packet from any source port to your HTTP application

(running on port 80) is matched.

In setting ports you can make use of special operators as well, like described above. Signs like:

Operator Description

: port ranges

! exception/negation

[.., ..] grouping

For example:

Example Meaning

[80, 81, 82] port 80, 81 and 82

[80: 82] Range from 80 till 82

[1024: ] From 1024 till the highest port-number

!80 Every port but 80

[80:100,!99] Range from 80 till 100 but 99 excluded

[1:80,![2,4]] Range from 1-80, except ports 2 and 4

[.., [..,..]]

4.1. Rules Format 13

剩余289页未读，继续阅读

一生为追梦

粉丝: 152
资源: 1

Suricata 4.1.10 用户手册：IDS 引擎详解

最新资源