{"id":311,"date":"2019-06-30T19:42:44","date_gmt":"2019-06-30T11:42:44","guid":{"rendered":"http:\/\/note.systw.net\/note\/?p=311"},"modified":"2025-07-27T18:25:29","modified_gmt":"2025-07-27T10:25:29","slug":"zeek-extensions","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/311","title":{"rendered":"Zeek Extensions"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div class=\"wp-block-jetpack-markdown\"><p>\u5e38\u898b\u7684Extensions\u6709\uff1a<\/p>\n<ul>\n<li>PF_RING \u63d0\u6607\u7db2\u8def\u5c01\u5305\u8b80\u53d6\u6548\u80fd<\/li>\n<li>GeoIP \u570b\u5bb6\u89e3\u6790<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<hr>\n<h2>PF_RING<\/h2>\n<h3>\u4e0b\u8f09<\/h3>\n<pre><code>#cd \/usr\/src\n#sudo wget https:\/\/github.com\/ntop\/PF_RING\/archive\/7.2.0-stable.zip\n#sudo unzip 7.2.0-stable.zip\n<\/code><\/pre>\n<p>\u00a0<\/p>\n<h3>\u5b89\u88dd<\/h3>\n<pre><code>cd PF_RING-X.Y.Z-stable\/userland\/lib\nsudo .\/configure --prefix=\/opt\/pfring-X.Y.Z\nsudo make\nsudo make install\n\n#cd ..\/libpcap\n#sudo .\/configure --prefix=\/opt\/pfring-X-Y-Z\n#sudo make\n#sudo make install\n\n#cd ..\/tcpdump-A.B.C\n#sudo .\/configure --prefix=\/opt\/pfring-X-Y-Z\n#sudo make\n#sudo make install\n\n#cd ..\/..\/kernel\n#sudo make\n#sudo make install\n<\/code><\/pre>\n<p>\u00a0<\/p>\n<h3>\u66f4\u65b0\u4e26\u91cd\u958b<\/h3>\n<pre><code>#sudo yum update\n#sudo reboot\n<\/code><\/pre>\n<p>\u00a0<\/p>\n<h3>\u8b80\u53d6pf_ring\u6a21\u7d44<\/h3>\n<pre><code>#sudo modprobe pf_ring enable_tx_capture=0 min_num_slots=65534\n<\/code><\/pre>\n<p>\u00a0<\/p>\n<h3>\u6aa2\u8996pf_ring\u6a21\u7d44\u8cc7\u8a0a<\/h3>\n<pre><code>#cat \/proc\/net\/pf_ring\/info\nPF_RING Version : 7.2.0 (unknown)\nTotal rings : 0\n\nStandard (non ZC) Options\nRing slots : 65534\nSlot version : 17\nCapture TX : No [RX only]\nIP Defragment : No\nSocket Mode : Standard\nCluster Fragment Queue : 0\nCluster Fragment Discard : 0\n<\/code><\/pre>\n<p>\u00a0<\/p>\n<h3>\u8a2d\u5b9a\u6bcf\u6b21\u958b\u6a5f\u81ea\u52d5\u8b80pf_ring\u6a21\u7d44<\/h3>\n<p>\u7de8\u8f2f\/etc\/modules-load.d\/pf_ring.conf\u4e26\u52a0\u5165\u4ee5\u4e0b\u8cc7\u8a0a<\/p>\n<pre><code># load pf_ring\npf_ring\n<\/code><\/pre>\n<p>\u7de8\u8f2f \/etc\/modprobe.d\/pf_ring.conf \u4e26\u52a0\u5165\u4ee5\u4e0b\u8cc7\u8a0a<\/p>\n<pre><code>options pf_ring enable_tx_capture=0 min_num_slots=65534\n<\/code><\/pre>\n<p>\u00a0<\/p>\n<h3>\u91cd\u958b\u6a5f\u6e2c\u8a66\u662f\u5426\u6709\u81ea\u52d5\u8b80\u5165pf_ring\u6a21\u7d44<\/h3>\n<pre><code>#sudo reboot\n#cat \/proc\/net\/pf_ring\/info\n\nPF_RING Version : 7.2.0 (unknown)\nTotal rings : 0\n\nStandard (non ZC) Options\nRing slots : 65534\nSlot version : 17\nCapture TX : No [RX only]\nIP Defragment : No\nSocket Mode : Standard\nCluster Fragment Queue : 0\nCluster Fragment Discard : 0 \n<\/code><\/pre>\n<p>\u00a0<\/p>\n<hr>\n<h2>GeoIP<\/h2>\n<h3>\u5b89\u88ddlibmaxminddb<\/h3>\n<pre><code>#sudo yum --enablerepo=extras install epel-release\n#sudo yum install libmaxminddb-devel\n<\/code><\/pre>\n<p>\u00a0<\/p>\n<h3>\u4e0b\u8f09GeoLite2 database<\/h3>\n<pre><code>#wget http:\/\/geolite.maxmind.com\/download\/geoip\/database\/GeoLite2-City.tar.gz\n#tar xzvf GeoLite2-City.tar.gz\n<\/code><\/pre>\n<p>\u00a0<\/p>\n<h3>\u5c07\u8cc7\u6599\u79fb\u5230\u6307\u5b9a\u7684\u4f4d\u7f6e<\/h3>\n<pre><code>#sudo mv GeoLite2-City_YYYYMMDD\/GeoLite2-City.mmdb \/usr\/share\/GeoIP\/GeoLite2-City.mmdb\n<\/code><\/pre>\n<\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[370],"tags":[],"class_list":["post-311","post","type-post","status-publish","format-standard","hentry","category-blue-team"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":306,"url":"https:\/\/systw.net\/note\/archives\/306","url_meta":{"origin":311,"position":0},"title":"Zeek","author":"raymond","date":"2019 \u5e74 6 \u6708 30 \u65e5","format":false,"excerpt":"https:\/\/www.zeek.org\/ Zeek is a powerful network a\u2026","rel":"","context":"\u5728\u300cblue team\u300d\u4e2d","block_context":{"text":"blue team","link":"https:\/\/systw.net\/note\/archives\/category\/securitytool\/blue-team"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":8,"url":"https:\/\/systw.net\/note\/archives\/8","url_meta":{"origin":311,"position":1},"title":"burpsuite app","author":"raymond","date":"2023 \u5e74 10 \u6708 15 \u65e5","format":false,"excerpt":"burpsuite\u7684app\u4e5f\u7c21\u7a31bapp\uff0c\u53ef\u64f4\u5c55\u8a31\u591a\u66f4\u9032\u968e\u7684\u529f\u80fd\uff0c\u5728bapp store\u4e0a\u53ef\u4ee5\u9078\u64c7\u591a\u2026","rel":"","context":"\u5728\u300cred team\u300d\u4e2d","block_context":{"text":"red team","link":"https:\/\/systw.net\/note\/archives\/category\/securitytool\/red-team"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":302,"url":"https:\/\/systw.net\/note\/archives\/302","url_meta":{"origin":311,"position":2},"title":"SonarQube","author":"raymond","date":"2019 \u5e74 10 \u6708 20 \u65e5","format":false,"excerpt":"SonarQube https:\/\/www.sonarqube.org Open Source\u7684\u7a0b\u5f0f\u2026","rel":"","context":"\u5728\u300cblue team\u300d\u4e2d","block_context":{"text":"blue team","link":"https:\/\/systw.net\/note\/archives\/category\/securitytool\/blue-team"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":539,"url":"https:\/\/systw.net\/note\/archives\/539","url_meta":{"origin":311,"position":3},"title":"PHP\u5b89\u88dd","author":"raymond","date":"2008 \u5e74 8 \u6708 6 \u65e5","format":false,"excerpt":"php(http:\/\/www.php.net\/)..........................\u2026","rel":"","context":"\u5728\u300c\u958b\u767c\u300d\u4e2d","block_context":{"text":"\u958b\u767c","link":"https:\/\/systw.net\/note\/archives\/category\/develop"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3032,"url":"https:\/\/systw.net\/note\/archives\/3032","url_meta":{"origin":311,"position":4},"title":"Red Teaming","author":"raymond","date":"2026 \u5e74 1 \u6708 1 \u65e5","format":false,"excerpt":"Red Team\uff08\u7d05\u968a\uff09\u662f\u6307\u4e00\u500b\u7372\u5f97\u6388\u6b0a\u7684\u5718\u968a\uff0c\u5c0d\u7d44\u7e54\u7684\u7cfb\u7d71\u3001\u6d41\u7a0b\u3001\u4eba\u54e1\u6216\u7269\u7406\u5b89\u5168\u9032\u884c\u653b\u64ca\u6a21\u64ec\u3002\u76ee\u6a19\u2026","rel":"","context":"\u5728\u300c\u5b89\u5168\u89e3\u6c7a\u65b9\u6848\u300d\u4e2d","block_context":{"text":"\u5b89\u5168\u89e3\u6c7a\u65b9\u6848","link":"https:\/\/systw.net\/note\/archives\/category\/securitysloution"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":609,"url":"https:\/\/systw.net\/note\/archives\/609","url_meta":{"origin":311,"position":5},"title":"iptables with l7-filter","author":"raymond","date":"2009 \u5e74 8 \u6708 23 \u65e5","format":false,"excerpt":"\u7c21\u4ecbLinux netfilter\u7684\u5916\u639b\u6a21\u7d44,\u53ef\u8b93iptables\u5c0d\u61c9\u7528\u5c64\u904e\u6ffe\u5206\u6790,\u50cf\u662fp2p,im\u2026","rel":"","context":"\u5728\u300c\u7cfb\u7d71\u7ba1\u7406\u5de5\u5177\u300d\u4e2d","block_context":{"text":"\u7cfb\u7d71\u7ba1\u7406\u5de5\u5177","link":"https:\/\/systw.net\/note\/archives\/category\/system\/systemtool"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=311"}],"version-history":[{"count":1,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/311\/revisions"}],"predecessor-version":[{"id":2416,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/311\/revisions\/2416"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}