snort
(http:\/\/www.snort.org\/)
1,opensource\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71,\u4f5c\u8005\u70baMarty Roesch
2,\u89e3\u6790\u5c01\u5305\u7528BPF(berkeley packet filter),\u53ef\u76f8\u5bb9\u65bctcpdump
3,\u7531\u4ee5\u4e0b\u67b6\u69cb\u7d44\u6210
\u3000sniffer
\u3000preprocessor
\u3000detect engine
\u3000alert<\/p>\n\n\n\n
……………………………………………………………………………..<\/p>\n\n\n\n
snort\u6709\u56db\u7a2emode,\u5982\u4e0b:
\u3000packet logger
\u3000sniffer
\u3000NIDS
\u3000inline mode<\/p>\n\n\n\n
sniffer mode<\/strong> ……………………………………………………………<\/p>\n\n\n\n snort \u5e38\u898b\u53c3\u6578\u5982\u4e0b<\/strong> \u6307\u5b9a\u76f8\u95dc log\u76f8\u95dc \u5176\u4ed6 snort.conf <\/strong><\/p>\n\n\n\n \u91cd\u65b0\u8b80\u53d6snort.conf<\/strong> ………<\/p>\n\n\n\n snort.conf\u8a2d\u5b9a\u683c\u5f0f<\/strong><\/p>\n\n\n\n 1,\u8b80\u53d6\u90e8\u4efd\u7d44\u614b\u6a94\u683c\u5f0f 2,variable\u683c\u5f0f 3,\u53c3\u6578\u683c\u5f0f …………<\/p>\n\n\n\n snort.conf\u5e38\u7528\u8a2d\u5b9a<\/strong><\/p>\n\n\n\n \u8b80\u53d6\u591a\u500b\u5b8c\u6574\u7d44\u614b\u6a94<\/strong> \u8a2d\u5b9adetection engine<\/strong> \u5176\u4ed6config <\/p>\n\n\n\n $snort_home\/etc\/generators<\/strong> $snort_home\/etc\/gen-msg.map<\/strong> \u5176\u4ed6\u88dc\u5145<\/p>\n\n\n\n S-CERT\u7de8\u865fVU#196240\/CVE\u7de8\u865fCVE-2006-5276<\/strong> snort(http:\/\/www.snort.org\/)1, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[370],"tags":[],"class_list":["post-380","post","type-post","status-publish","format-standard","hentry","category-blue-team"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=380"}],"version-history":[{"count":1,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/380\/revisions"}],"predecessor-version":[{"id":2425,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/380\/revisions\/2425"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u5e38\u7528option
\u3000-d:Dump the Application Layer
\u3000-e:Display the second layer header info
\u3000-v:Be verbose
ex:
\u986f\u793a\u5c01\u5305\u5167\u5bb9
#snort -dev<\/p>\n\n\n\n
packet logger<\/strong>
\u5e38\u7528option
\u3000-l < directory >: Log to directory
\u3000-L < file >: Log to this tcpdump file
\u3000-b Log packets in tcpdump format (much faster!)
\u3000-r < file > Read and process tcpdump file
ex
\u5c07log\u4fe1\u606f\u8f38\u51fa\u5230\/tmp\/snortlog\u76ee\u9304\u4e0b,\u4e26\u4ee5binary code(\u4e8c\u9032\u4f4d\u78bc)\u7684\u65b9\u5f0f\u5132\u5b58\u5c01\u5305\u8cc7\u6599
#snort -l \/tmp\/snortlog -b
\u8b80\u53d6\u5df2\u5132\u5b58\u7684\u5c01\u5305\u8a18\u9304\u6a94\u6848packet.log
#snort -dvr packet.log<\/p>\n\n\n\n
NIDS<\/strong>
\u5e38\u7528option
\u3000-c \u6307\u5b9a\u7d44\u614b\u6a94
\u3000-l \u6307\u5b9a\u8f38\u51fa\u8b66\u5831\u7684\u76ee\u9304,\u9810\u8a2d\u70ba\/var\/log\/snort
\u3000-h \u6307\u5b9a\u7db2\u8def\u7bc4\u570d
\u3000-D \u555f\u52d5\u6642\u9032\u5165\u80cc\u666f\u6210\u70badaemon
ex:.\/snort -d -l .\/log -h 192.168.1.0\/24 -c snort.conf
\u6307\u5b9a\u8f38\u51fa\u683c\u5f0f
-A < mode >
mode\u6709\u4ee5\u4e0b\u53ef\u9078
\u3000full(\u9810\u8a2d):\u5b8c\u6574\u8b66\u5831\u6a21\u5f0f,\u8a18\u9304\u6a19\u6e96\u7684alert
\u3000fast:\u5feb\u901f\u8b66\u5831\u6a21\u5f0f,\u53ea\u5beb\u5165timestamp,alert messages,\u4f86\u6e90\u8207\u76ee\u5730\u7684ip\u53caports
\u3000unsock:\u5c07\u8b66\u5831\u8a0a\u606f\u9001\u81f3\u5176\u4ed6\u4e3b\u6a5f\u7684\u7a0b\u5f0f
\u3000none:\u95dc\u9589\u8b66\u5831\u529f\u80fd
\u3000console:\u5c07fast mode\u683c\u5f0f\u7684\u8b66\u5831\u8a0a\u606f\u9001\u81f3Console(\u7d42\u7aef\u6a5f)
\u3000cmg:\u7522\u751fcmg style\u7684\u8b66\u5831<\/p>\n\n\n\n
\u986f\u793a\u76f8\u95dc
-v \u986f\u793a\u5b8c\u6574\u6a19\u982d\u6a94\u5728console\u4e2d
-d \u986f\u793a\u5c01\u5305\u5167\u5bb9,\u89e3\u78bc\u61c9\u7528\u5c64
-e \u986f\u793a\u8cc7\u6599\u9023\u7d50\u5c64\u5167\u5bb9
-a \u986f\u793aARP\u5305
-V \u986f\u793a\u7248\u672c
-C \u986f\u793a\u8a0a\u606f\u7528ASCII\u78bc\u800c\u4e0d\u662fhexdump<\/p>\n\n\n\n
-c \u6307\u5b9a\u7d44\u614b\u6a94
-F \u6307\u5b9aBPF filter\uff0cTCPDump\u7684man\u5167\u6709\u8a73\u7d30\u8aaa\u660e
-h \u6307\u5b9a\u7db2\u8def\u7bc4\u570d
-i \u6307\u5b9a\u7db2\u8def\u4ecb\u9762
-n \u6307\u5b9a\u5728\u8655\u7406\u5e7e\u500b\u5c01\u5305\u5f8c\u9000\u51fa<\/p>\n\n\n\n
-N \u95dc\u9589LOG\u8a18\u9304\uff0c\u4f46\u4fdd\u6301ALERT\u529f\u80fd
-l \u6307\u5b9aLOG\u8f38\u51fa\u76ee\u9304
-b \u628aLOG\u8a18\u9304\u70baTCPDUMP\u683c\u5f0f\uff0c\u4e5f\u5c31\u662f\u88ab\u8a18\u9304\u70babinary\u683c\u5f0f
-s \u8a18\u9304\u5230syslog\u4e2d\u53bb
-o \u6539\u8b8a\u8a18\u9304\u9806\u5e8f\uff0c\u5c07\u539f\u672cAlert->pass->Log order\u6539\u6210Pass->Alert->Log order
ps:Pass\u662f\u5141\u8a31\u901a\u904e\u7684\u898f\u5247\u800c\u4e0d\u8a18\u9304\u548c\u5831\u8b66\uff0cALERT\u662f\u4e0d\u5141\u8a31\u901a\u904e\u7684\u898f\u5247\uff0cLOG\u6307LOG\u8a18\u9304\u3000<\/p>\n\n\n\n
-S \u8a2d\u5b9a\u8b8a\u6578\uff0c\u53ef\u5728\u547d\u4ee4\u5217\u4e2d\u5b9a\u7fa9Snort rules\u6587\u4ef6\u4e2d\u7684\u8b8a\u6578
-r \u8b80\u53d6tcpdump\u65b9\u5f0f\u7522\u751f\u7684Shadow\u6587\u4ef6
-p \u95dc\u9589Promiscuous mode\uff0c\u5e38\u7528\u4f86\u505a\u7db2\u8def\u6e2c\u8a66<\/p>\n\n\n\n
ps:
alert order<\/strong>
\u9810\u8a2d\u9806\u5e8f\u5982\u70ba Pass rules > Drop rules > Alert rules > Log rules
\u6539\u8b8a\u9806\u5e8f\u53c3\u6578\u6709
–alert-before-pass \u8a2d\u5b9aalert rules\u5728pass rules\u4e4b\u524d
–treat-drop-as-alert
–process-all-events<\/p>\n\n\n\n
……………………………………………………………………………………………………………<\/p>\n\n\n\n
\u65b9\u6cd51,\u5efa\u8b70
\u91cd\u65b0\u555f\u52d5snort
\u65b9\u6cd52
\u81ea\u52d5\u91cd\u8b80\u7d44\u614b\u6a94,\u90e8\u4efd\u7d44\u614b\u88ab\u4fee\u6539\u4ecd\u8981\u91cd\u65b0\u555f\u52d5snort
1,configure\u6642\u8981\u52a0–enable-reload
2,\u7d44\u614b\u6a94\u4fee\u6539\u5f8c\u57f7\u884ckill -SIGHUP < snortpid><\/p>\n\n\n\n
include < file path><\/p>\n\n\n\n
\u6709\u4ee5\u4e0b\u5e7e\u7a2e
var < name> < value>
portvar < name> < [express]>
ipvar < name> < [express]>
ex:
var RULES_PATH rules\/
portvar MY_PORTS [22,80,1024:1050]
ipvar MY_NET [192.168.1.0\/24,10.1.1.0\/24]
alert tcp any any->$MY_NET $MY_PORTS (flags:S;msg:”SYN packet”;)
include $RULE_PATH\/example.rule<\/p>\n\n\n\n
config [:< value>]<\/p>\n\n\n\n
\u4f9d\u64da\u4e0d\u540cvlan\u8b80\u53d6\u4e0d\u540c\u7684\u7d44\u614b\u6a94
config binding:< path_to_snort.conf> vlan < vlanIdList>
\u4f9d\u64da\u4e0d\u540c\u7db2\u6bb5\u8b80\u53d6\u4e0d\u540c\u7684\u7d44\u614b\u6a94
config binding:< path_to_snort.conf> net < ipList><\/p>\n\n\n\n
\u8a2d\u5b9asnort decoder<\/strong>
config checksum_mode: all \u8a08\u7b97packet checksum\u7684\u985e\u578b,\u503c\u6709none,noip,notcp,noicmp,noudp,ip,tcp,udp,icmp,all
config disable_decode_alerts \u95dc\u9589\u5728decode\u968e\u6bb5\u6642\u6240\u7522\u751f\u7684alert
config disable_tcpopt_experimental_alerts \u95dc\u9589\u7531experimental(\u5be6\u9a57\u6027\u7684)tcp option\u6240\u7522\u751f\u7684alert
config disable_tcpopt_obsolete_alerts \u95dc\u9589\u7531obsolete(\u904e\u6642\u7684)tcp option\u6240\u7522\u751f\u7684alert
config disable_ttcp_alerts \u95dc\u9589\u7531tcp option\u6240\u7522\u751f\u7684alert
config disable_tcpopt_alerts \u7981\u7528option length validation alert
config disable_ipopt_alerts \u7981\u7528ip option length validation alert
config disable_decode_drops<\/p>\n\n\n\n
\u8a18\u9304event\u7684\u65b9\u5f0f
config detection: max_queue_events 5 \u6307\u5b9a\u6bcf\u500b\u5c01\u5305event\u6700\u591a\u53ef\u9032\u5165queue\u7684\u6578\u91cf
config event_queue: max_queue 8 log 3 order_events content_length \u8abf\u6574event queue\u76f8\u95dc\u53c3\u6578
\u3000max_queue < n> \u6307\u5b9a\u55ae\u4e00packet\u6216stream\u7684\u53ef\u7528event queue\u6700\u5927size\u70ban
\u3000log < n> \u6307\u5b9a\u55ae\u4e00packet\u6216stream\u53ef\u8a18\u9304event\u7684\u6700\u5927\u6578\u91cf\u70ban
\u3000order_events < content_length|priority> \u6307\u5b9a\u8a18\u9304event\u9806\u5e8f\u7684\u65b9\u6cd5,\u53ef\u4f9drule\u7684content_length\u6216event\u512a\u5148\u6b0a<\/p>\n\n\n\n
\u8a2d\u5b9adynamic module<\/strong>
\u8b80\u53d6dynamic preprocessor shared library(\u5171\u4eab\u51fd\u5f0f\u5eab)<\/strong>
\u683c\u5f0f\u70ba:dynamicpreprocessor file < path>
\u5e38\u7528\u7684\u6709\u4ee5\u4e0b
dynamicpreprocessor file \/usr\/local\/snort\/lib\/snort_dynamicpreprocessor\/libsf_dce2_preproc.so
dynamicpreprocessor file \/usr\/local\/snort\/lib\/snort_dynamicpreprocessor\/libsf_dns_preproc.so
dynamicpreprocessor file \/usr\/local\/snort\/lib\/snort_dynamicpreprocessor\/libsf_ftptelnet_preproc.so
dynamicpreprocessor file \/usr\/local\/snort\/lib\/snort_dynamicpreprocessor\/libsf_smtp_preproc.so
dynamicpreprocessor file \/usr\/local\/snort\/lib\/snort_dynamicpreprocessor\/libsf_ssh_preproc.so
dynamicpreprocessor file \/usr\/local\/snort\/lib\/snort_dynamicpreprocessor\/libsf_ssl_preproc.so
\u8b80\u53d6dynamic engine shared library<\/strong>
\u683c\u5f0f\u70ba:dynamicengine < path>
\u5e38\u7528\u7684\u6709\u4ee5\u4e0b
dynamicengine \/usr\/local\/snort\/lib\/snort_dynamicengine\/libsf_engine.so
\u8b80\u53d6dynamic rule shared library<\/strong>
\u683c\u5f0f\u70ba:dynamicdetection file < path>
\u5e38\u7528\u7684\u6709\u4ee5\u4e0b
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/bad-traffic.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/chat.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/dos.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/exploit.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/imap.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/misc.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/multimedia.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/netbios.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/nntp.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/p2p.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/smtp.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/sql.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/web-client.so
dynamicdetection file \/usr\/local\/snort\/lib\/snort_dynamicrules\/web-misc.so<\/p>\n\n\n\n
…………….<\/p>\n\n\n\n
\u8a18\u9304\u5404generators id<\/p>\n\n\n\n
\u8a18\u9304preprocessor\u7684sid<\/p>\n\n\n\n
$snort_home\/etc\/classification.config<\/strong>
\u8a18\u9304\u5404classtype\u7684priority<\/p>\n\n\n\n
…………………………………………………………………………………………………………….<\/p>\n\n\n\n
\u5728Sourcefire Snort DCE\/RPC[\u9060\u7aef\u7a0b\u5e8f\u547c\u53eb]\u8655\u7406\u5668\u4e2d\u7684\u4e00\u9805\u5806\u758a\u7de9\u885d\u5340\u6ea2\u4f4d\u5f31\u9ede\u53ef\u4f7f\u9060\u7aef\u672a\u6388\u6b0a\u7684\u653b\u64ca\u8005\u4ee5Snort\u884c\u7a0b\u7684\u6b0a\u9650\u4f86\u57f7\u884c\u4efb\u610f\u7a0b\u5f0f
\u89e3\u6c7a\u65b9\u6cd5:<\/strong>
\u66f4\u65b0\u5230Snort 2.6.1.3
\u95dc\u9589DCE\/RPC[\u9060\u7aef\u7a0b\u5e8f\u547c\u53eb]\u8655\u7406\u5668:\u95dc\u9589\u8655\u7406\u5668\u5c07\u4fdd\u8b77Snort\u4e0d\u6703\u91cd\u7d44\u5206\u5272\u7684SMB\u53caDCE\/RPC\u5c01\u5305<\/p>\n\n\n\n
\u5176\u4ed6\u53c3\u8003
http:\/\/security.nknu.edu.tw\/textbook\/chap13.pdf
http:\/\/forum.icst.org.tw\/phpbb\/viewtopic.php?f=11&t=14590
http:\/\/www.ixpub.net\/archiver\/tid-619953-page-1.html<\/p>\n","protected":false},"excerpt":{"rendered":"