{"id":378,"date":"2013-01-20T01:05:00","date_gmt":"2013-01-19T17:05:00","guid":{"rendered":"http:\/\/note.systw.net\/note\/?p=378"},"modified":"2025-07-27T18:26:25","modified_gmt":"2025-07-27T10:26:25","slug":"snort-rule","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/378","title":{"rendered":"Snort Rule"},"content":{"rendered":"\n

Snort rule<\/p>\n\n\n\n

snort rule\u683c\u5f0f: <\/strong>RulesHeader (RulesOption )
ex:root\u7528ftp\u767b\u5165
alert tcp any any -> any any 21(content:”user root”)<\/p>\n\n\n\n

………………………………………………………………………………………………..<\/p>\n\n\n\n

RulesHeader<\/strong><\/h2>\n\n\n\n

\u683c\u5f0f\u70baaction protocol srcip srcport -> dstip dstport
action<\/strong>:\u89f8\u767c\u898f\u5247\u5f8csnort\u9700\u8981\u505a\u7684\u52d5\u4f5c\uff0c\u901a\u5e38\u662f\u6307\u5b9aalert
protocol<\/strong>:\u5354\u5b9a\u652f\u63f4tcp,udp,icmp,ip
srcip<\/strong>:\u6307\u5b9a\u4f86\u6e90ip,\u652f\u63f4cidr\u683c\u5f0f,\u53ef\u4f7f\u7528$HOME_NET\u8b8a\u6578,\u652f\u63f4\u5426\u5b9a\u6a21\u5f0f
srcport<\/strong>:\u6307\u5b9a\u4f86\u6e90port,\u652f\u63f4\u7bc4\u570d\u8a2d\u5b9a
-><\/strong>:\u6307\u5b9a\u901a\u8a0a\u65b9\u5411,\u9084\u652f\u63f4<-\u53ca<>\u96d9\u5411
dstip<\/strong>:\u6307\u5b9a\u76ee\u5730ip,\u652f\u63f4cidr\u683c\u5f0f,\u53ef\u4f7f\u7528$HOME_NET\u8b8a\u6578
dstport<\/strong>:\u6307\u5b9a\u76ee\u5730port,\u652f\u63f4\u7bc4\u570d\u8a2d\u5b9a<\/p>\n\n\n\n

ps:
srcip,srcport,dstip,dstport
\u4f7f\u7528any,\u8868\u793a\u4efb\u4f55ip\u6216\u4efb\u4f55port<\/p>\n\n\n\n

ip\u5426\u5b9a\u6a21\u5f0f,\u4f7f\u7528( ! )
ex:! 10.1.1.1\u8868\u793a\u4e0d\u7b49\u65bc10.1.1.1<\/p>\n\n\n\n

port\u7bc4\u570d\u8a2d\u5b9a,\u4f7f\u7528( : )
ex:
1:1024\u8868\u793aport1\u5230port1024
:1024\u8868\u793a\u5c0f\u65bc\u7b49\u65bc1024\u7684port
1024:\u8868\u793a\u5927\u65bc\u7b49\u65bc1024\u7684port<\/p>\n\n\n\n

…………………………………………………………………………………………….<\/p>\n\n\n\n

RulesOption<\/strong><\/h2>\n\n\n\n

option\u6709\u4ee5\u4e0b:
msg<\/strong>:\u898f\u5247\u540d\u7a31
flow<\/strong>:
to_server<\/strong>:\u7531client\u5411server\u767c\u51fa\u8acb\u6c42\u8a0a\u865f
establised<\/strong>:\u5df1\u5efa\u7acb\u9023\u7dda\u4e4b\u901a\u8a0a
content<\/strong>:\u6bd4\u5c0dpayload,\u670916\u9032\u4f4d\u683c\u5f0f\u548cascii\u683c\u5f0f
classtype<\/strong>:\u898f\u5247\u5206\u985e
gid<\/strong>:snort generator id,\u9810\u8a2d\u70ba1,\u4e00\u822c\u60c5\u6cc1\u4e0b\u4e0d\u7528\u53bb\u8a2d\u5b9a
sid<\/strong>:snort signature\u7de8\u865f,<100\u4fdd\u7559,100~1000000\u5b98\u65b9\u4f7f\u7528,>1000000\u70ba\u7528\u6236\u81ea\u8a02
rev<\/strong>:\u5b9a\u7fa9\u76ee\u524drule\u7248\u672c
uricontent<\/strong>:\u6383\u63cfuri\u4e2d\u7684\u653b\u64ca\u8a9e\u6cd5
reference<\/strong>:\u6307\u5b9a\u5176\u4ed6\u76f8\u95dc\u53c3\u8003\u8cc7\u6599<\/p>\n\n\n\n

…………….<\/p>\n\n\n\n

content\u6bd4\u5c0d<\/strong>
\u683c\u5f0f\u70bacontent:”payload”
payload\u683c\u5f0f\u6709\u4ee5\u4e0b
|hex| \u8868\u793a16\u9032\u4f4d\u683c\u5f0f
ascii \u8868\u793aascii\u683c\u5f0f
ex:
content:”|00|” \u8868\u793a00,16\u9032\u4f4d\u683c\u5f0f
content:”SMB” \u8868\u793aSMB,ascii\u78bc\u683c\u5f0f
content:”|53 4D 42|” \u8868\u793aSMB,16\u9032\u4f4d\u683c\u5f0f<\/p>\n\n\n\n

ps
nocase \u6bd4\u5c0d\u8cc7\u6599\u4e2dascii\u78bc\u4e0d\u8ad6\u5927\u5c0f\u5beb\u90fd\u7b26\u5408\u7279\u5fb4\u503c<\/p>\n\n\n\n

content\u5b9a\u4f4doption<\/strong>
offset:\u7d55\u5c0d\u4f4d\u79fb\u6307\u6a19,\u8d77\u59cb\u4f4d\u7f6e\u662fpayload\u958b\u59cb\u4f4d\u7f6e,\u9810\u8a2d\u70ba0
depth:offset\u9577\u5ea6
ps:\u82e5payload\u4e0d\u5728\u8a72\u8cc7\u6599\u6216\u8d85\u51fa\u7bc4\u570d\u90fd\u8868\u793a\u4e0d\u7b26\u5408\u8a72rule
distance:\u76f8\u5c0d\u4f4d\u79fb\u6307\u6a19,\u8d77\u59cb\u4f4d\u7f6e\u662f\u4e0a\u6b21\u7b26\u5408content\u4f4d\u7f6e\u52a0\u4e0adistance\u9577\u5ea6
within:distance\u9577\u5ea6
ps:\u82e5payload\u4e0d\u5728\u8a72\u8cc7\u6599\u6216\u8d85\u51fa\u7bc4\u570d\u90fd\u8868\u793a\u4e0d\u7b26\u5408\u8a72rule<\/p>\n\n\n\n

content\u5224\u65b7\u5f0f\u6bd4\u5c0d<\/strong>
byte_test:< bytes_to_convert>,< operator>,< value>,< offset> [,[relative],[big],[little][string],[hex],[dec],[oct]]
bytes_to_convert
operator:\u6bd4\u8f03\u5f0f,\u6709<, >, =, !
value:\u689d\u4ef6\u503c
offset:\u7d55\u5c0d\u4f4d\u79fb\u6307\u6a19
relative:\u76f8\u5c0d\u4f4d\u79fb\u6307\u6a19
big:big endian\u904b\u7b97
little:little endian\u904b\u7b97
string:ascii\u6578\u503c
hex:\u5c07\u6578\u503c\u8f49\u621016\u9032\u4f4d
dec:\u5c07\u6578\u503c\u8f49\u621010\u9032\u4f4d,\u9810\u8a2d\u503c
oct:\u5c07\u6578\u503c\u8f49\u62108\u9032\u4f4d<\/p>\n\n\n\n

\u8df3\u904ex byte\u4e0d\u6383\u63cf<\/strong>
byte_jump:< bytes_to_convert>,< offset> [,[relative],[big],[little][string],[hex],[dec],[oct],[align],[from_beginning]]
align:\u5c07byte_jump\u6240\u53d6\u5f97\u7684\u904b\u7b97\u503c,\u81ea\u52d5\u88dc\u6578\u70ba4\u7684\u500d\u6578 ex:\u904b\u7b97\u503c\u70ba13,\u81ea\u52d5\u88dc\u6578\u70ba16
from_beginning:\u4f4d\u79fb\u6307\u6a19\u56de\u5230packet payload\u8d77\u9ede\u958b\u59cb\u8df3\u8e8d<\/p>\n\n\n\n

pcre\u6bd4\u5c0d<\/strong>
\u683c\u5f0f\u70bapcre:”\/re\/parameter”
parameter:\u53c3\u6578,i\u8868\u793a\u4e0d\u5206\u5927\u5c0f\u5beb,R\u8868\u793a\u53c3\u6578\u540c\u898f\u5247\u9078\u9805
ps:snort2.x\u5f8c\u652f\u63f4pcre\u8a9e\u6cd5<\/p>\n","protected":false},"excerpt":{"rendered":"

Snort rule snort rule\u683c\u5f0f:  …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[370],"tags":[],"class_list":["post-378","post","type-post","status-publish","format-standard","hentry","category-blue-team"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/378","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=378"}],"version-history":[{"count":1,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/378\/revisions"}],"predecessor-version":[{"id":2422,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/378\/revisions\/2422"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}