网络入侵检测--Snort软件配置文件snort.conf详解
2024-04-14 05:58:12
Snort最重要的工作模式就是NIDS，网络入侵检测，在NIDS模式下，snort.conf文件是必不可少的。
那么今天，我们来仔细阅读以下snort.conf这个文件，看一下每个部分的功能，都是配置了什么作用。
顺带能够了解很多模块的定义及功能
我选取了我用的一个配置文件，源自于2.9.8.3的snortrules-snapshot
配置文件开头，就写出了如何配置出完整的功能
###################################################
# This file contains a sample snort configuration.
# You should take the following steps to create your own custom configuration:
#
# 1) Set the network variables.
# 2) Configure the decoder
# 3) Configure the base detection engine
# 4) Configure dynamic loaded libraries
# 5) Configure preprocessors
# 6) Configure output plugins
# 7) Customize your rule set
# 8) Customize preprocessor and decoder rule set
# 9) Customize shared object rule set
###################################################
这里简单说下每条的配置功能，需要配置什么内容，去里面具体查看参数，研发的要求，并不需要完全理解，但是必须会用
| 步骤 | 含义 |
|---|---|
| 1 | 配置了多组IP变量，端口变量，和部分路径信息，其中IP变量，端口变量用于rules，路径用于寻找规则和库文件 |
| 2 | 配置解码器的报警，解码阶段大部分报警都是关闭的 |
| 3 | 配置基础检测引擎的参数，例如处理延迟，调试打印 |
| 4 | 配置动态加载库的路径，动态规则路径，动态预处理引擎 |
| 5 | 配置预处理器的开启和关闭，这里面的预处理器会把部分协议的数据，转化成各种变量，例如modbus的操作，后面的规则就可以使用这些参数了 |
| 6 | 配置高速模式下的输出方式 |
| 7 | 配置自定义规则集合 |
| 8 | 配置预处理器和解码器规则集合 |
| 9 | 配置共享对象规则集合 |
然后按照配置文件进行了解释
1) Set the network variables配置网络变量
# 设置要保护的网络地址
ipvar HOME_NET any# 设置外部网络地址。在大多数情况下保留为 any
ipvar EXTERNAL_NET any# 您网络上的DNS服务器列表
ipvar DNS_SERVERS $HOME_NET# 您网络上的SMTP服务器列表
ipvar SMTP_SERVERS $HOME_NET# 您网络上的web服务器列表
ipvar HTTP_SERVERS $HOME_NET# 您网络上的sql服务器列表
ipvar SQL_SERVERS $HOME_NET# 您网络上的telnet服务器列表
ipvar TELNET_SERVERS $HOME_NET# 您网络上的ssh服务器列表
ipvar SSH_SERVERS $HOME_NET# 您网络上的ftp服务器列表
ipvar FTP_SERVERS $HOME_NET# 您网络上的sip服务器列表
ipvar SIP_SERVERS $HOME_NET# 运行web服务器的端口列表
portvar HTTP_PORTS [36,80,81,82,83,84,85,86,87,88,89,90,311,383,443,555,591,593,623,631,664,801,808,818,901,972,1158,1220,1270,1414,1533,1581,1719,1720,1741,1801,1812,1830,1942,2231,2301,2375,2381,2578,2809,2869,2980,3000,3029,3037,3057,3128,3443,3702,4000,4343,4592,4848,5000,5054,5060,5061,5117,5222,5250,5416,5443,5450,5480,5555,5600,5814,5894,5984,5985,5986,6080,6173,6988,7000,7001,7005,7070,7071,7080,7144,7145,7180,7181,7510,7770,7777,7778,7779,8000,8001,8008,8014,8015,8020,8028,8040,8080,8081,8082,8085,8088,8090,8095,8118,8123,8161,8180,8181,8182,8222,8243,8280,8300,8333,8344,8393,8400,8443,8484,8500,8509,8694,8787,8800,8852,8880,8888,8899,8983,9000,9001,9002,9050,9060,9080,9090,9091,9111,9200,9201,9290,9443,9447,9700,9710,9788,9830,9850,9999,10000,10080,10100,10250,10255,10297,10443,11371,12601,13014,14592,15489,16000,16992,16993,16994,16995,17000,18081,19980,29991,30007,30018,30888,33300,34412,34443,34444,36099,40007,41080,44449,49152,49153,50000,50002,50452,51423,53331,54444,55252,55555,56712]# 查看shellcode的端口列表，shellcode是一段用于利用软件漏洞而执行的代码
portvar SHELLCODE_PORTS !80# 可能看到oracle攻击的端口列表
portvar ORACLE_PORTS 1024:# 要查找SSH连接的端口列表
portvar SSH_PORTS 22# 运行ftp服务器的端口列表
portvar FTP_PORTS [21,2100,3535]#运行SIP服务器的端口列表
portvar SIP_PORTS [5060,5061,5600]# 用于文件检查的文件数据端口列表
portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]# GTP预处理器使用的GTP端口列表
portvar GTP_PORTS [2123,2152,3386]# 其他变量，不要修改
ipvar AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]# 你的规则文件路径 (可以是相对路径)
var RULE_PATH ../rules
var SO_RULE_PATH ../so_rules
var PREPROC_RULE_PATH ../preproc_rules#如果使用黑白名单预处理器，请配置这些
var WHITE_LIST_PATH ../rules
var BLACK_LIST_PATH ../rules
此处的变量分为了三种
| 选项 | 含义 | 例子 |
|---|---|---|
| ipvar | 用来定义一组IP， 这种定义可以是一个IP，几个IP，一段IP，并配合取反，并集等操作 | ipvar EXAMPLE [1.1.1.1,2.2.2.0/24,![2.2.2.2,2.2.2.3]] |
| portvar | 用来定义一组端口， 这种定义也可以是一个端口，几个端口，端口范围，并配合取反，并集等操作 | portvar |
| portvar EXAMPLE4 [!70:90] | ||
| portvar EXAMPLE5 [80,91:95,100:200] | ||
| var | 用来定义一个普通变量 | var PREPROC_RULE_PATH …/preproc_rules |
理解了变量的写法，就可以增加自己的变量，用在自己的rules中
2) Configure the decoder配置解码器
解码是数据包在Snort中首先经过的过程之一。解码器的任务是确定数据包中使用了哪些底层协议（如以太网、IP、TCP等），并将该数据与数据包中的有效载荷/应用程序数据的位置（它不尝试解码）以及该有效载荷的大小一起保存，以供预处理器和检测引擎使用。
听上去就像是包数据的整理。里面主要包含了多项配置，按照功能不同拆开了解释
# 停止通用解码事件：
config disable_decode_alerts# 停止关于实验性TCP选项的警报
config disable_tcpopt_experimental_alerts# 停止有关过时TCP选项的警报
config disable_tcpopt_obsolete_alerts# 停止T/TCP警报上的警报
config disable_tcpopt_ttcp_alerts# 停止所有其他TCPOption类型事件的警报：
config disable_tcpopt_alerts# 停止关于无效ip选项的警报
config disable_ipopt_alerts# 如果长度字段（IP、TCP、UDP）中的值大于数据包的长度，则发出警报
# config enable_decode_oversized_alerts# 与上一条一样, 只是会丢掉数据包 ，如果是内联模式 (需要enable_decode_oversized_alerts)
# config enable_decode_oversized_drops# 配置 IP / TCP 校验码模式
config checksum_mode: all
其他配置Decode
| 选项 | 含义 |
|---|---|
| disable_decode_alerts | By default, decoder alerts are enabled - use this option to disable these alerts. |
| enable_decode_drops | If in inline mode, drop packets that are alerted on. |
| disable_ipopt_alerts | Disable alerts generated due to bad IP options. |
| enable_ipopt_drops | Drop packets that are alerted on due to bad IP options. |
| disable_tcpopt_alerts | Disable alerts generated due to bad TCP options. |
| enable_tcpopt_drops | Drop packets that are alerted on due to bad TCP options. |
| disable_ttcp_alerts | Disable alerts generated due to detection of T/TCP. |
| enable_ttcp_drops | Drop packets that are alerted on due to T/TCP detection. |
| disable_tcpopt_obsolete_alerts | Disable alerts generated due to detection of obsolete TCP options - Skeeter, Bubba and Unassigned. |
| enable_tcpopt_obsolete_drops | Drop packets that are alerted on due to obsolete TCP options. |
| disable_tcpopt_experimental_alerts | Disable alerts generated due to detection of experimental TCP options (kinds 9,10,15,20,21,22,23,24 - see http://www.iana.org/assignments/tcp-parameters for what these are). |
| enable_tcpopt_experimental_drops | Drop packets that are alerted on due to experimental TCP options. |
| enable_decode_oversized_alerts | Enable alerts generated due to the length field (IP, TCP, UDP) indicating a larger packet than we captured. Note that this is the only decoder alert option that is disabled by default. |
| enable_decode_oversized_drops | Drop packets that are alerted on due to the header lengthfield indicating a larger packet than we captured. |
| checksum_mode: all|none|noip|notcp|noudp|noicmp|ip|tcp|udp|icmp | By default checksums are computed for IP, TCP, UDP and ICMP. Use this option to disable checksum checking of specificprotocols. Use a space separated list. |
| checksum_drop: all|none|noip|notcp|noudp|noicmp|ip|tcp|udp|icmp | - By default packets with bad checksums are not dropped if in inline mode. Use a space separated list. Note that Snort must be doing checksums for a particular protocol in order to drop packets with bad checksums for that protocol. |
配置flowbits最大范围
flowbits检测插件使用流预处理器在传输协议会话期间跟踪规则状态。这对于TCP会话最有用，因为它允许规则一般地跟踪应用程序协议的状态。
# 配置flowbit最大值. For more information, see README.flowbits
# config flowbits_size: 64# 配置忽略端口
# config ignore_ports: tcp 21 6667:6671 1356
# config ignore_ports: udp 1:17 53
配置active
配置在会话的当前窗口内尝试登录TCP RST的次数（以便接收TCP的用户可以接受）。这个“扫射”序列只在被动模式下有用。在内联模式下，重置被直接放入流中，以代替触发数据包，因此无需扫射。
# 配置非内联模式下主动应答. For more information, see REAMDE.active
# config response: eth0 attempts 2
配置DAQ
Snort 2.9为数据包I/O引入了DAQ或数据采集库。DAQ用一个抽象层取代了对libpcap函数的直接调用，该抽象层便于在各种硬件和软件接口上进行操作，而无需更改Snort。调用Snort执行pcap回读或内联操作等时，可以选择DAQ类型和模式。
# Configure DAQ related options for inline operation. For more information, see README.daq
#
# config daq: <type>
# config daq_dir: <dir>
# config daq_mode: <mode>
# config daq_var: <var>
#
# <type> ::= pcap | afpacket | dump | nfq | ipq | ipfw
# <mode> ::= read-file | passive | inline
# <var> ::= arbitrary <name>=<value passed to DAQ
# <dir> ::= path as to where to look for DAQ module so's
配置gid uid snaplen bpf文件和log路径
这里是一些运行的程序属性参数，在前一篇博客中也介绍了，在后面的补充中，也介绍了两个常用参数，这些参数都是可以通过运行参数配置，也可以放在配置文件中生效。
# 配置特定的UID和GID以在删除privs后运行snort. For more information see snort -h command line options
#
# config set_gid:
# config set_uid:# 配置默认snaplen. Snort defaults to MTU of in use interface. For more information see README
#
# config snaplen:
## 配置默认bpf_file 用来过滤流量. For more information see snort -h command line options (-F)
#
# config bpf_file:
## 配置默认log路径. For more information see snort -h command line options (-l)
#
# config logdir:
3) Configure the base detection engine配置基础检测引擎
# 配置 PCRE match limitations
config pcre_match_limit: 3500
config pcre_match_limit_recursion: 1500#配置检测引擎 See the Snort Manual, Configuring Snort - Includes - Config
config detection: search-method ac-split search-optimize max-pattern-len 20# 配置事件队列. For more information, see README.event_queue
config event_queue: max_queue 15 log 15 order_events content_length###################################################
##如果使用了GTP需要在这里开启
## For more information, see README.GTP
##################################################### config enable_gtp###################################################
# 每个数据包和规则延迟执行
# For more information see README.ppm
#################################################### 每包延迟配置
#config ppm: max-pkt-time 250, \
# fastpath-expensive-packets, \
# pkt-log# 每规则延迟配置
#config ppm: max-rule-time 200, \
# threshold 3, \
# suspend-expensive-rules, \
# suspend-timeout 20, \
# rule-log alert###################################################
# 配置性能评测以进行调试
# For more information see README.PerfProfiling
####################################################config profile_rules: print all, sort avg_ticks
#config profile_preprocs: print all, sort avg_ticks###################################################
# 配置协议感知刷新
# For more information see README.stream5
###################################################
config paf_max: 16000
4) Configure dynamic loaded libraries配置动态加载库
# 动态预处理器库路径 path to dynamic preprocessor libraries
dynamicpreprocessor directory /usr/lib64/snort-2.9.8.3_dynamicpreprocessor/# 预处理引擎路径 path to base preprocessor engine
dynamicengine /usr/lib64/snort-2.9.8.3_dynamicengine/libsf_engine.so# 打破迷关条规则库引擎路径 path to dynamic rules libraries
dynamicdetection directory /usr/local/lib/snort_dynamicrules
5) Configure preprocessors配置预处理器
# GTP控制通道预处理器。GTP Control Channle Preprocessor. For more information, see README.GTP
# preprocessor gtp: ports { 2123 3386 2152 }# 内联数据包规范化. For more information, see README.normalize
# IDS 模式不工作
preprocessor normalize_ip4
preprocessor normalize_tcp: block, rsv, pad, urp, req_urg, req_pay, req_urp, ips, ecn stream
preprocessor normalize_icmp4
preprocessor normalize_ip6
preprocessor normalize_icmp6# 基于目标的IP碎片整理. For more inforation, see README.frag3
preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: policy windows detect_anomalies overlap_limit 10 min_fragment_length 100 timeout 180# Target-Based stateful inspection/stream reassembly. For more inforation, see README.stream5
preprocessor stream5_global: track_tcp yes, \track_udp yes, \track_icmp no, \ max_tcp 262144, \max_udp 131072, \max_active_responses 2, \min_response_seconds 5
preprocessor stream5_tcp: policy windows, detect_anomalies, require_3whs 180, \overlap_limit 10, small_segments 3 bytes 150, timeout 180, \ports client 21 22 23 25 42 53 70 79 109 110 111 113 119 135 136 137 139 143 161 445 513 514 587 593 691 1433 1521 1741 2100 3306 6070 6665 6666 6667 6668 6669 7000 8181 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779, \ports both 36 80 81 82 83 84 85 86 87 88 89 90 110 311 383 443 465 555 563 591 593 623 631 636 664 801 808 818 901 972 989 992 993 994 995 1158 1220 1270 1414 1533 1581 1719 1720 1741 1801 1812 1830 1942 2231 2301 2375 2381 2578 2809 2869 2980 3000 3001 3029 3037 3057 3128 3300 3443 3702 3901 4000 4343 4592 4848 5000 5054 5060 5061 5117 5222 5250 5416 5443 5450 5480 5555 5600 5814 5894 5984 5985 5986 6080 6173 6988 7000 7001 7005 7070 7071 7080 7144 7145 7180 7181 7510 7770 7777 7778 7779 7801 7802 7900 7901 7902 7903 7904 7905 7906 7907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 8000 8001 8008 8014 8015 8020 8028 8040 8080 8081 8082 8085 8088 8090 8095 8118 8123 8161 8180 8181 8182 8222 8243 8280 8300 8333 8344 8393 8400 8443 8484 8500 8509 8694 8787 8800 8852 8880 8888 8899 8983 9000 9001 9002 9050 9060 9080 9090 9091 9111 9200 9201 9290 9443 9447 9700 9710 9788 9830 9850 9999 10000 10080 10100 10250 10255 10297 10443 11371 12601 13014 14592 15489 15672 16000 16992 16993 16994 16995 17000 18081 19980 29991 30007 30018 30888 33300 34412 34443 34444 36099 40007 41080 44449 49152 49153 50000 50002 50452 51423 53331 54444 55252 55555 56712
preprocessor stream5_udp: timeout 180# performance statistics. For more information, see the Snort Manual, Configuring Snort - Preprocessors - Performance Monitor
# preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000# HTTP规范化和异常检测. For more information, see README.http_inspect
preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535 decompress_depth 65535
preprocessor http_inspect_server: server default \http_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA RPC_ECHO_DATA } \chunk_length 500000 \server_flow_depth 0 \client_flow_depth 0 \post_depth 65495 \oversize_dir_length 500 \max_header_length 750 \max_headers 100 \max_spaces 200 \small_chunk_length { 10 5 } \ports { 36 80 81 82 83 84 85 86 87 88 89 90 311 383 443 555 591 593 623 631 664 801 808 818 901 972 1158 1220 1270 1414 1533 1581 1719 1720 1741 1801 1812 1830 1942 2231 2301 2375 2381 2578 2809 2869 2980 3000 3029 3037 3057 3128 3443 3702 4000 4343 4592 4848 5000 5054 5060 5061 5117 5222 5250 5416 5443 5450 5480 5555 5600 5814 5894 5984 5985 5986 6080 6173 6988 7000 7001 7005 7070 7071 7080 7144 7145 7180 7181 7510 7770 7777 7778 7779 8000 8001 8008 8014 8015 8020 8028 8040 8080 8081 8082 8085 8088 8090 8095 8118 8123 8161 8180 8181 8182 8222 8243 8280 8300 8333 8344 8393 8400 8443 8484 8500 8509 8694 8787 8800 8852 8880 8888 8899 8983 9000 9001 9002 9050 9060 9080 9090 9091 9111 9200 9201 9290 9443 9447 9700 9710 9788 9830 9850 9999 10000 10080 10100 10250 10255 10297 10443 11371 12601 13014 14592 15489 15672 16000 16992 16993 16994 16995 17000 18081 19980 29991 30007 30018 30888 33300 34412 34443 34444 36099 40007 41080 44449 49152 49153 50000 50002 50452 51423 53331 54444 55252 55555 56712 } \non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \enable_cookie \extended_response_inspection \inspect_gzip \normalize_utf \unlimited_decompress \normalize_javascript \apache_whitespace no \ascii no \bare_byte no \directory no \double_decode no \iis_backslash no \iis_delimiter no \iis_unicode no \multi_slash no \utf_8 no \u_encode yes \webroot no \decompress_swf { deflate lzma } \decompress_pdf { deflate }# ONC-RPC规范化和异常检测. For more information, see the Snort Manual, Configuring Snort - Preprocessors - RPC Decode
preprocessor rpc_decode: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779 no_alert_multiple_requests no_alert_large_fragments no_alert_incomplete# Back Orifice 检测，类似于一种远程管理软件.
preprocessor bo# FTP/Telnet规范化和异常检测. For more information, see README.ftptelnet
preprocessor ftp_telnet: global inspection_type stateful encrypted_traffic no check_encrypted
preprocessor ftp_telnet_protocol: telnet \ayt_attack_thresh 20 \normalize ports { 23 } \detect_anomalies
preprocessor ftp_telnet_protocol: ftp server default \def_max_param_len 100 \ports { 21 2100 3535 } \telnet_cmds yes \ignore_telnet_erase_cmds yes \ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \ftp_cmds { LPSV MACB MAIL MDTM MIC MKD MLSD MLST } \ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \ftp_cmds { XSEN XSHA1 XSHA256 } \alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \alt_max_param_len 256 { CWD RNTO } \alt_max_param_len 400 { PORT } \alt_max_param_len 512 { SIZE } \chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \ chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \cmd_validity ALLO < int [ char R int ] > \ cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \cmd_validity MACB < string > \cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \cmd_validity MODE < char ASBCZ > \cmd_validity PORT < host_port > \cmd_validity PROT < char CSEP > \cmd_validity STRU < char FRPO [ string ] > \ cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } >
preprocessor ftp_telnet_protocol: ftp client default \max_resp_len 256 \bounce yes \ignore_telnet_erase_cmds yes \telnet_cmds yes# SMTP规范化和异常检测. For more information, see README.SMTP
preprocessor smtp: ports { 25 465 587 691 } \inspection_type stateful \b64_decode_depth 0 \qp_decode_depth 0 \bitenc_decode_depth 0 \uu_decode_depth 0 \log_mailfrom \log_rcptto \log_filename \log_email_hdrs \normalize cmds \normalize_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY } \normalize_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SOML } \normalize_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT X-DRCP X-ERCP X-EXCH50 } \normalize_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \max_command_line_len 512 \max_header_line_len 1000 \max_response_line_len 512 \alt_max_command_line_len 260 { MAIL } \alt_max_command_line_len 300 { RCPT } \alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN DATA RSET QUIT ONEX QUEU STARTTLS TICK TIME TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \valid_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY } \ valid_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SOML } \valid_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT X-DRCP X-ERCP X-EXCH50 } \valid_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \xlink2state { enabled }# 端口扫描检测. For more information, see README.sfportscan
# preprocessor sfportscan: proto { all } memcap { 10000000 } sense_level { low }# ARP欺骗检测. For more information, see the Snort Manual - Configuring Snort - Preprocessors - ARP Spoof Preprocessor
# preprocessor arpspoof
# preprocessor arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00# SSH异常检测. For more information, see README.ssh
preprocessor ssh: server_ports { 22 } \autodetect \max_client_bytes 19600 \max_encrypted_packets 20 \max_server_version_len 100 \enable_respoverflow enable_ssh1crc32 \enable_srvoverflow enable_protomismatch# SMB/DCE-RPC规范化和异常检测. For more information, see README.dcerpc2
preprocessor dcerpc2: memcap 102400, events [co ]
preprocessor dcerpc2_server: default, policy WinXP, \detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \smb_max_chain 3, smb_invalid_shares ["C$", "D$", "ADMIN$"]# DNS欺骗检测. For more information, see README.dns
preprocessor dns: ports { 53 } enable_rdata_overflow# SSL异常检测和流量旁路. For more information, see README.ssl
preprocessor ssl: ports { 443 465 563 636 989 992 993 994 995 5061 7801 7802 7900 7901 7902 7903 7904 7905 7906 7907 7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 }, trustservers, noinspect_encrypted# SDF 敏感数据预处理器. For more information see README.sensitive_data
preprocessor sensitive_data: alert_threshold 25# SIP会话启动协议预处理器. For more information see README.sip
preprocessor sip: max_sessions 40000, \ports { 5060 5061 5600 }, \methods { invite \cancel \ack \bye \register \options \refer \subscribe \update \join \info \message \notify \benotify \do \qauth \sprack \publish \service \unsubscribe \prack }, \max_uri_len 512, \max_call_id_len 80, \max_requestName_len 20, \max_from_len 256, \max_to_len 256, \max_via_len 1024, \max_contact_len 512, \max_content_len 2048 # IMAP 预处理器. For more information see README.imap
preprocessor imap: \ports { 143 } \b64_decode_depth 0 \qp_decode_depth 0 \bitenc_decode_depth 0 \uu_decode_depth 0# POP 预处理器. For more information see README.pop
preprocessor pop: \ports { 110 } \b64_decode_depth 0 \qp_decode_depth 0 \bitenc_decode_depth 0 \uu_decode_depth 0# Modbus 预处理器. For more information see README.modbus
preprocessor modbus: ports { 502 }# DNP3 预处理器. For more information see README.dnp3
preprocessor dnp3: ports { 20000 } \memcap 262144 \check_crc# 黑白名单预处理器. For more information see README.reputation
preprocessor reputation: \memcap 500, \priority whitelist, \nested_ip inner, \whitelist $WHITE_LIST_PATH/white_list.rules, \blacklist $BLACK_LIST_PATH/black_list.rules
这里能够开启多重预处理器，然后方便增加规则文件
6) Configure output plugins配置输出插件
如果您想让Snort运行得更快（比如保持1000 Mbps的连接），您需要使用unified2日志和unified2日志读取器，比如barnyard2。这允许Snort以二进制形式尽可能快地记录警报，而另一个程序执行缓慢的操作，例如写入数据库。
# unified2
# 建议大多数安装使用
# output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types# 特定安装类型的附加配置
# output alert_unified2: filename snort.alert, limit 128, nostamp
# output log_unified2: filename snort.log, limit 128, nostamp # 配置syslog
# output alert_syslog: LOG_AUTH LOG_ALERT# pcap
# output log_tcpdump: tcpdump.log# 元数据参考数据。不要修改这些行
include classification.config
include reference.config
7) Customize your rule set定制自己的规则
# 现场特定规则
include $RULE_PATH/local.rules
include $RULE_PATH/app-detect.rules
#include $RULE_PATH/attack-responses.rules
#include $RULE_PATH/backdoor.rules
#include $RULE_PATH/bad-traffic.rules
#include $RULE_PATH/blacklist.rules
#include $RULE_PATH/botnet-cnc.rules
#include $RULE_PATH/browser-chrome.rules
#include $RULE_PATH/browser-firefox.rules
#include $RULE_PATH/browser-ie.rules
#include $RULE_PATH/browser-other.rules
#include $RULE_PATH/browser-plugins.rules
#include $RULE_PATH/browser-webkit.rules
#include $RULE_PATH/chat.rules
#include $RULE_PATH/content-replace.rules
#include $RULE_PATH/ddos.rules
#include $RULE_PATH/dns.rules
#include $RULE_PATH/dos.rules
#include $RULE_PATH/experimental.rules
#include $RULE_PATH/exploit-kit.rules
#include $RULE_PATH/exploit.rules
#include $RULE_PATH/file-executable.rules
#nclude $RULE_PATH/file-flash.rules
#include $RULE_PATH/file-identify.rules
#include $RULE_PATH/file-image.rules
#include $RULE_PATH/file-java.rules
#include $RULE_PATH/file-multimedia.rules
#include $RULE_PATH/file-office.rules
#include $RULE_PATH/file-other.rules
#include $RULE_PATH/file-pdf.rules
#include $RULE_PATH/finger.rules
#include $RULE_PATH/ftp.rules
#include $RULE_PATH/icmp-info.rules
#include $RULE_PATH/icmp.rules
#include $RULE_PATH/imap.rules
#include $RULE_PATH/indicator-compromise.rules
#include $RULE_PATH/indicator-obfuscation.rules
#include $RULE_PATH/indicator-scan.rules
#include $RULE_PATH/indicator-shellcode.rules
#include $RULE_PATH/info.rules
#include $RULE_PATH/malware-backdoor.rules
#include $RULE_PATH/malware-cnc.rules
#include $RULE_PATH/malware-other.rules
#include $RULE_PATH/malware-tools.rules
#include $RULE_PATH/misc.rules
#include $RULE_PATH/multimedia.rules
#include $RULE_PATH/mysql.rules
#include $RULE_PATH/netbios.rules
#include $RULE_PATH/nntp.rules
#include $RULE_PATH/oracle.rules
#include $RULE_PATH/os-linux.rules
#include $RULE_PATH/os-mobile.rules
#include $RULE_PATH/os-other.rules
#include $RULE_PATH/os-solaris.rules
#include $RULE_PATH/os-windows.rules
#include $RULE_PATH/other-ids.rules
#include $RULE_PATH/p2p.rules
#include $RULE_PATH/phishing-spam.rules
#include $RULE_PATH/policy-multimedia.rules
#include $RULE_PATH/policy-other.rules
#include $RULE_PATH/policy.rules
#include $RULE_PATH/policy-social.rules
#include $RULE_PATH/policy-spam.rules
#include $RULE_PATH/pop2.rules
#include $RULE_PATH/pop3.rules
#include $RULE_PATH/protocol-dns.rules
#include $RULE_PATH/protocol-finger.rules
include $RULE_PATH/protocol-ftp.rules
#include $RULE_PATH/protocol-icmp.rules
#include $RULE_PATH/protocol-imap.rules
#include $RULE_PATH/protocol-nntp.rules
#include $RULE_PATH/protocol-other.rules
#include $RULE_PATH/protocol-pop.rules
#include $RULE_PATH/protocol-rpc.rules
include $RULE_PATH/protocol-scada.rules
#include $RULE_PATH/protocol-services.rules
#include $RULE_PATH/protocol-snmp.rules
#include $RULE_PATH/protocol-telnet.rules
#include $RULE_PATH/protocol-tftp.rules
#include $RULE_PATH/protocol-voip.rules
#include $RULE_PATH/pua-adware.rules
#include $RULE_PATH/pua-other.rules
#include $RULE_PATH/pua-p2p.rules
#include $RULE_PATH/pua-toolbars.rules
#include $RULE_PATH/rpc.rules
#include $RULE_PATH/rservices.rules
#include $RULE_PATH/scada.rules
include $RULE_PATH/scan.rules
#include $RULE_PATH/server-apache.rules
#include $RULE_PATH/server-iis.rules
#include $RULE_PATH/server-mail.rules
#include $RULE_PATH/server-mssql.rules
include $RULE_PATH/server-mysql.rules
#include $RULE_PATH/server-oracle.rules
#include $RULE_PATH/server-other.rules
#include $RULE_PATH/server-samba.rules
#include $RULE_PATH/server-webapp.rules
#include $RULE_PATH/shellcode.rules
#include $RULE_PATH/smtp.rules
#include $RULE_PATH/snmp.rules
#include $RULE_PATH/specific-threats.rules
#include $RULE_PATH/spyware-put.rules
#include $RULE_PATH/sql.rules
#include $RULE_PATH/telnet.rules
#include $RULE_PATH/tftp.rules
#include $RULE_PATH/virus.rules
#include $RULE_PATH/voip.rules
#include $RULE_PATH/web-activex.rules
#include $RULE_PATH/web-attacks.rules
#include $RULE_PATH/web-cgi.rules
#include $RULE_PATH/web-client.rules
#include $RULE_PATH/web-coldfusion.rules
#include $RULE_PATH/web-frontpage.rules
#include $RULE_PATH/web-iis.rules
#include $RULE_PATH/web-misc.rules
#include $RULE_PATH/web-php.rules
#include $RULE_PATH/x11.rules
配合前面定义变量，这里增加属于你的规则文件
8) Customize preprocessor and decoder rule set定制预处理器和解码器规则集
# 解码器和预处理器事件规则
# include $PREPROC_RULE_PATH/preprocessor.rules
# include $PREPROC_RULE_PATH/decoder.rules
# include $PREPROC_RULE_PATH/sensitive-data.rules9) Customize shared object rule set自定义共享对象规则集
# 动态库规则
# include $SO_RULE_PATH/browser-chrome.rules
# include $SO_RULE_PATH/browser-ie.rules
# include $SO_RULE_PATH/browser-other.rules
# include $SO_RULE_PATH/exploit-kit.rules
# include $SO_RULE_PATH/file-executable.rules
# include $SO_RULE_PATH/file-flash.rules
# include $SO_RULE_PATH/file-image.rules
# include $SO_RULE_PATH/file-java.rules
# include $SO_RULE_PATH/file-multimedia.rules
# include $SO_RULE_PATH/file-office.rules
# include $SO_RULE_PATH/file-other.rules
# include $SO_RULE_PATH/file-pdf.rules
# include $SO_RULE_PATH/indicator-shellcode.rules
# include $SO_RULE_PATH/malware-cnc.rules
# include $SO_RULE_PATH/malware-other.rules
# include $SO_RULE_PATH/netbios.rules
# include $SO_RULE_PATH/os-linux.rules
# include $SO_RULE_PATH/os-other.rules
# include $SO_RULE_PATH/os-windows.rules
# include $SO_RULE_PATH/policy-other.rules
# include $SO_RULE_PATH/policy-social.rules
# include $SO_RULE_PATH/protocol-dns.rules
# include $SO_RULE_PATH/protocol-nntp.rules
# include $SO_RULE_PATH/protocol-other.rules
# include $SO_RULE_PATH/protocol-scada.rules
# include $SO_RULE_PATH/protocol-snmp.rules
# include $SO_RULE_PATH/protocol-tftp.rules
# include $SO_RULE_PATH/protocol-voip.rules
# include $SO_RULE_PATH/pua-p2p.rules
# include $SO_RULE_PATH/server-apache.rules
# include $SO_RULE_PATH/server-iis.rules
# include $SO_RULE_PATH/server-mail.rules
# include $SO_RULE_PATH/server-mysql.rules
# include $SO_RULE_PATH/server-oracle.rules
# include $SO_RULE_PATH/server-other.rules
# include $SO_RULE_PATH/server-webapp.rules# 事件阈值或抑制命令. See threshold.conf
include threshold.conf
补充
还有一大部分没有列出来的配置参数，都可以在snort_manual.pdf中找到，在2.1章节。
举几个常用的配置
##配置监听接口，与snort -i 效果一样
config interface:enp1s0##守护进程运行，与snort -D效果一样
config daemon
目测执行的参数，都可以在配置文件中进行配置。
也是刚开始阅读这些配置文件，哪里有理解错的，翻译错的，感谢指出。
网络入侵检测--Snort软件配置文件snort.conf详解相关推荐
- Apache配置文件httpd.conf详解
转自:http://www.jianshu.com/p/c36dd3946e74 Apache配置文件httpd.conf详解 Apache的配置由httpd.conf文件配置,因此下面的配置指令都是 ...
- yum的配置文件yum.conf详解
转自:https://blog.csdn.net/im5437/article/details/53445142 说明:经过网上抄袭和自己的总结加实验,非常详细,可留作参考. yum的配置一般有两种方 ...
- keepalived配置文件keepalived.conf详解
keepalived.conf详解 一个功能比较完整的常用的 keepalived 配置文件,主要包含以下三块 第2行全局定义块是必须配置项, 一,全局定义块 这部分主要用来设置Keepalived的 ...
- Nginx的配置文件nginx.conf详解
Nginx的配置文件nginx.conf配置详解如下: user nginx nginx ; Nginx用户及组:用户 组.window下不指定 worker_processes 8; 工作进程:数目 ...
- Redis高可用方案哨兵机制------ 配置文件sentinel.conf详解
Redis的哨兵机制是官方推荐的一种高可用(HA)方案,我们在使用Redis的主从结构时,如果主节点挂掉,这时是不能自动进行主备切换和通知客户端主节点下线的. Redis-Sentinel机制主要用三 ...
- Redis-6.2.* 版本配置文件redis.conf详解
# Redis configuration file example. # # Note that in order to read the configuration file, Redis mus ...
- 配置文件keepalived.conf详解
Keepalived的配置文件可以分为三块: 全局定义块:对整个 Keepalive 配置生效的,不管是否使用 LVS: VRRP 实例定义块:是 Keepalived 的核心: 虚拟服务器(LVS) ...
- Linux中vsftpd配置文件vsftpd.conf详解
vsftpd配置文件采用"#"作为注释符,以"#"开头的行和空白行在解析时将被忽略,其余的行被视为配置命令行,每个配置命令的"＝"两边不要留 ...
- Nginx配置文件nginx.conf详解
Nginx 总的 配置文件 位置 /usr/local/nginx/conf/nginx.conf nginx 正则匹配 一．正则表达式匹配,其中: 为区分大小写匹配 ~* 为不区分大小写匹配 ! 和 ...
最新文章
- tushare获取 保存_TuShare（2）：使用TuShare，抓取股票数据并存储到数据库
- 第一个hibernate程序HelloWorldHibernate
- sql和python的区别_数据处理简单对比：Excel，SQL，Python
- 二分法求解方程的根java_C语言二分法求解方程根的两种方法
- 设计模式：各个模式间的对比
- Asp.net 文件上传的 FileUpload FileName 和 FileUpload PostedFile.FileName的细节问题
- 判断iframe是否加载完成的方法[转]
- logistics回归分析+代码详解
- 苹果今年秋季或发布史上最多新品
- python打印不同颜色的字_Python 根据日志级别打印不同颜色的日志的方法示例
- CSDN总部落户长沙，共建中国开发者产业中心城市！
- 百度课程——基于深度学习的自然语言处理
- 基于Python/Flask框架的双色球数据采集(爬虫)及大数据可视化平台设计与实现
- 一句话知道handler有啥ruan用
- FileZilla连接ubuntu主机时选择21端口无法连接
- 安全狗陈荣有：打造“即开即用”的云原生安全能力
- XCTF simple-unpacked
- tkinter教程4：控件LabelFrame和Entry
- 用Axure RP 9制作简易网易云首页
- Java学习源代码学习