SNORT用户手册：网络入侵检测与配置指南

需积分: 9 96 浏览量更新于2024-07-24 收藏 1.36MB PDF 举报

"SNORT用户手册，版本2.9.4，由The Snort Project发布，涵盖Snort的概述、使用方法，包括嗅探模式、数据包记录模式、网络入侵检测系统模式及其配置、数据包获取、PCAP、AFPACKET、NFQ、IPQ、IPFW等接口的使用，还有基本输出、统计信息、隧道协议支持以及守护进程运行和规则更新等内容。" Snort是一款开源的网络入侵检测系统（NIDS），它能够嗅探网络流量、记录数据包，并在检测到可疑或恶意活动时发出警报。该手册详细介绍了Snort的各种功能和配置选项，是理解与使用Snort的重要参考资料。 1. Snort概述：这部分介绍了Snort的基本功能和工作原理，包括如何开始使用Snort，以及它的不同运行模式，如嗅探模式、数据包记录模式和网络入侵检测系统模式。 1.1 嗅探模式：Snort可以在不干扰网络流量的情况下监听网络，收集信息。 1.2 数据包记录模式：Snort可以将接收到的数据包保存到日志文件中，供后续分析。 1.3 网络入侵检测系统模式：在NIDS模式下，Snort不仅记录数据包，还分析其内容，识别潜在的攻击。 1.4 网络入侵检测系统模式的配置：包括输出选项设置、标准警报输出理解、高性能配置以及调整警报顺序。 1.5 数据包获取：Snort支持多种数据包捕获机制，如PCAP、AFPACKET、NFQ、IPQ、IPFW和Dump，这些机制适应不同的操作系统和网络环境。 1.6 阅读pcaps：这部分说明了如何处理和分析Snort生成的pcap文件，包括命令行参数和使用示例。 1.7 基本输出：详细阐述了Snort输出的各类统计信息，如时间统计、I/O总量、协议统计，以及动作、限制和判断信息。 1.8 隧道协议支持：Snort能够识别并处理隧道协议，支持多层封装，并提供了相应的日志记录机制。 1.9 杂项：涵盖了运行Snort作为守护进程以及规则更新等高级话题。通过这份手册，用户不仅可以了解Snort的基础知识，还能深入学习如何配置和优化Snort以满足特定的网络安全需求。对于网络管理员和安全分析师来说，这是理解和操作Snort不可或缺的指南。

./snort --daq afpacket -i <device>

[--daq-var buffer_size_mb=<#MB>]

[--daq-var debug]

If you want to run afpacket in inline mode, you must set device to one or more interface pairs, where each member of

a pair is separated by a single colon and each pair is separated by a double colon like this:

eth0:eth1

or this:

eth0:eth1::eth2:eth3

By default, the afpacket DAQ allocates 128MB for packet memory. You can change this with:

--daq-var buffer_size_mb=<#MB>

Note that the total allocated is actually higher, here’s why. Assuming the default packet memory with a snaplen of

1518, the numbers break down like this:

1. The frame size is 1518 (snaplen) + the size of the AFPacket header (66 bytes) = 1584 bytes.

2. The number of frames is 128 MB / 1518 = 84733.

3. The smallest block size that can ﬁt at least one frame is 4 KB = 4096 bytes @ 2 frames per block.

4. As a result, we need 84733 / 2 = 42366 blocks.

5. Actual memory allocated is 42366 * 4 KB = 165.5 MB.

1.5.4 NFQ

NFQ is the new and improved way to process iptables packets:

./snort --daq nfq \

[--daq-var device=<dev>] \

[--daq-var proto=<proto>] \

[--daq-var queue=<qid>] \

[--daq-var queue_len=<qlen>]

<dev> ::= ip | eth0, etc; default is IP injection

<proto> ::= ip4 | ip6 | ip*; default is ip4

<qid> ::= 0..65535; default is 0

<qlen> ::= 0..65535; default is 0

Notes on iptables can be found in the DAQ distro README.

1.5.5 IPQ

IPQ is the old way to process iptables packets. It replaces the inline version available in pre-2.9 versions built with

this:

./configure --enable-inline / -DGIDS

1.5.8 Statistics Changes

The Packet Wire Totals and Action Stats sections of Snort’s output include additional ﬁelds:

•

Filtered

count of packets ﬁltered out and not handed to Snort for analysis.

•

Injected

packets Snort generated and sent, eg TCP resets.

•

Allow

packets Snort analyzed and did not take action on.

•

Block

packets Snort did not forward, eg due to a block rule.

•

Replace

packets Snort modiﬁed.

•

Whitelist

packets that caused Snort to allow a ﬂow to pass w/o inspection by any analysis program.

•

Blacklist

packets that caused Snort to block a ﬂow from passing.

•

Ignore

packets that caused Snort to allow a ﬂow to pass w/o inspection by this instance of Snort.

The action stats show ”blocked” packets instead of ”dropped” packets to avoid confusion between dropped packets

(those Snort didn’t actually see) and blocked packets (those Snort did not allow to pass).

1.6 Reading Pcaps

Instead of having Snort listen on an interface, you can give it a packet capture to read. Snort will read and analyze the

packets as if they came off the wire. This can be useful for testing and debugging Snort.

1.6.1 Command line arguments

Any of the below can be speciﬁed multiple times on the command line (

-r

included) and in addition to other Snort

command line options. Note, however, that specifying

--pcap-reset

and

--pcap-show

multiple times has the same

effect as specifying them once.

Option Description

-r <file>

Read a single pcap.

--pcap-single=<file>

Same as -r. Added for completeness.

--pcap-file=<file>

File that contains a list of pcaps to read. Can specify path to pcap or directory to

recurse to get pcaps.

--pcap-list="<list>"

A space separated list of pcaps to read.

--pcap-dir=<dir>

A directory to recurse to look for pcaps. Sorted in ASCII order.

--pcap-filter=<filter>

Shell style ﬁlter to apply when getting pcaps from ﬁle or directory. This ﬁl-

ter will apply to any

--pcap-file

--pcap-dir

arguments following. Use

--pcap-no-filter

to delete ﬁlter for following

--pcap-file

--pcap-dir

arguments or specify

--pcap-filter

again to forget previous ﬁlter and to apply

to following

--pcap-file

--pcap-dir

arguments.

--pcap-no-filter

Reset to use no ﬁlter when getting pcaps from ﬁle or directory.

--pcap-reset

If reading multiple pcaps, reset snort to post-conﬁguration state before reading

next pcap. The default, i.e. without this option, is not to reset state.

--pcap-show

Print a line saying what pcap is currently being read.

1.6.2 Examples

Read a single pcap

$ snort -r foo.pcap

$ snort --pcap-single=foo.pcap

Read pcaps from a ﬁle

$ cat foo.txt

foo1.pcap

foo2.pcap

/home/foo/pcaps

$ snort --pcap-file=foo.txt

This will read foo1.pcap, foo2.pcap and all ﬁles under /home/foo/pcaps. Note that Snort will not try to determine

whether the ﬁles under that directory are really pcap ﬁles or not.

Read pcaps from a command line list

$ snort --pcap-list="foo1.pcap foo2.pcap foo3.pcap"

This will read foo1.pcap, foo2.pcap and foo3.pcap.

Read pcaps under a directory

$ snort --pcap-dir="/home/foo/pcaps"

This will include all of the ﬁles under /home/foo/pcaps.

Using ﬁlters

$ cat foo.txt

foo1.pcap

foo2.pcap

/home/foo/pcaps

$ snort --pcap-filter="*.pcap" --pcap-file=foo.txt

$ snort --pcap-filter="*.pcap" --pcap-dir=/home/foo/pcaps

The above will only include ﬁles that match the shell pattern ”*.pcap”, in other words, any ﬁle ending in ”.pcap”.

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \

> --pcap-filter="*.cap" --pcap-dir=/home/foo/pcaps

In the above, the ﬁrst ﬁlter ”*.pcap” will only be applied to the pcaps in the ﬁle ”foo.txt” (and any directories that are

recursed in that ﬁle). The addition of the second ﬁlter ”*.cap” will cause the ﬁrst ﬁlter to be forgotten and then applied

to the directory /home/foo/pcaps, so only ﬁles ending in ”.cap” will be included from that directory.

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \

> --pcap-no-filter --pcap-dir=/home/foo/pcaps

In this example, the ﬁrst ﬁlter will be applied to foo.txt, then no ﬁlter will be applied to the ﬁles found under

/home/foo/pcaps, so all ﬁles found under /home/foo/pcaps will be included.

$ snort --pcap-filter="*.pcap --pcap-file=foo.txt \

> --pcap-no-filter --pcap-dir=/home/foo/pcaps \

> --pcap-filter="*.cap" --pcap-dir=/home/foo/pcaps2

In this example, the ﬁrst ﬁlter will be applied to foo.txt, then no ﬁlter will be applied to the ﬁles found under

/home/foo/pcaps, so all ﬁles found under /home/foo/pcaps will be included, then the ﬁlter ”*.cap” will be applied

to ﬁles found under /home/foo/pcaps2.

Resetting state

$ snort --pcap-dir=/home/foo/pcaps --pcap-reset

The above example will read all of the ﬁles under /home/foo/pcaps, but after each pcap is read, Snort will be reset to

a post-conﬁguration state, meaning all buffers will be ﬂushed, statistics reset, etc. For each pcap, it will be like Snort

is seeing trafﬁc for the ﬁrst time.

Printing the pcap

$ snort --pcap-dir=/home/foo/pcaps --pcap-show

The above example will read all of the ﬁles under /home/foo/pcaps and will print a line indicating which pcap is

currently being read.

1.7 Basic Output

Snort does a lot of work and outputs some useful statistics when it is done. Many of these are self-explanatory. The

others are summarized below. This does not include all possible output data, just the basics.

1.7.1 Timing Statistics

This section provides basic timing statistics. It includes total seconds and packets as well as packet processing rates.

The rates are based on whole seconds, minutes, etc. and only shown when non-zero.

Example:

===============================================================================

Run time for packet processing was 175.856509 seconds

Snort processed 3716022 packets.

Snort ran for 0 days 0 hours 2 minutes 55 seconds

Pkts/min: 1858011

Pkts/sec: 21234

===============================================================================

1.7.2 Packet I/O Totals

This section shows basic packet acquisition and injection peg counts obtained from the DAQ. If you are reading pcaps,

the totals are for all pcaps combined, unless you use –pcap-reset, in which case it is shown per pcap.

• Outstanding indicates how many packets are buffered awaiting processing. The way this is counted varies per

DAQ so the DAQ documentation should be consulted for more info.

• Filtered packets are not shown for pcap DAQs.

• Injected packets are the result of active response which can be conﬁgured for inline or passive modes.

Example:

===============================================================================

Packet I/O Totals:

Received: 3716022

Analyzed: 3716022 (100.000%)

剩余244页未读，继续阅读

_rebort

粉丝: 0
资源: 3

SNORT用户手册：网络入侵检测与配置指南

snort_manual.pdf

snort_manual.rar_linux manual_snort_manual

snort_manual

snort2 user manual

Snort中文手册

Snort中文手册.pdf

基于snort的入侵检测

snort安装手册及文件

Snort_SSL_FC2.pdf

基于Linux的Snort入侵检测系统的研究与应用.pdf

最新资源