snort的安装、配置和使用

Snort

在1998年，Marty Roesch先生用C语言开发了开放源代码(Open Source)的入侵检测系统Snort.直至今天，Snort已发展成为一个多平台(Multi-Platform),实时(Real-Time)流量分析，网络IP数据包(Pocket)记录等特性的强大的网络入侵检测/防御系统(Network Intrusion Detection/Prevention System),即NIDS/NIPS.Snort符合通用公共许可(GPL——GNU General Pubic License),在网上可以通过免费下载获得Snort,并且只需要几分钟就可以安装并开始使用它。snort基于libpcap。

原理：基于特征的入侵检测技术

从技术上，入侵检测也可分为两类：一种基于特征（误用检测）（signature-based），另一种基于异常情况(anomaly-based)。

对于基于标识的检测技术来说，首先要定义违背安全策略的事件的特征，如网络数据包的某些头信息。检测主要判别这类特征是否在所收集到的数据中出现。此方法非常类似杀毒软件。

而基于异常的检测技术则是先定义一组系统“正常”情况的数值，如CPU利用率、内存利用率、文件校验和等（这类数据可以人为定义，也可以通过观察系统、并用统计的办法得出），然后将系统运行时的数值与所定义的“正常”情况比较，得出是否有被攻击的迹象。这种检测方式的核心在于如何定义所谓的“正常”情况。

SNORT是一个强大的轻量级的网络入侵检测系统,它具有实时数据流量分析和日志IP网络数据包的能力，能够进行协议分析，对内容搜索或者匹配。它是一个基于特征检测的入侵检测系统。 

Snort简介

snort有三种工作模式：嗅探器、数据包记录器、网络入侵检测系统。嗅探器模式仅仅是从网络上读取数据包并作为连续不断的流显示在终端上。数据包记录器模式把数据包记录到硬盘上。网路入侵检测模式是最复杂的，而且是可配置的。我们可以让snort分析网络数据流以匹配用户定义的一些规则，并根据检测结果采取一定的动作。

编写Snort规则文件：Snort.conf

基础

snort使用一种简单的，轻量级的规则描述语言，这种语言灵活而强大。在开发snort规则时要记住几个简单的原则。

第一，大多数snort规则都写在一个单行上，或者在多行之间的行尾用/分隔。Snort规则被分成两个逻辑部分：规则头和规则选项。规则头包含规则的动作，协议，源和目标ip地址与网络掩码，以及源和目标端口信息；规则选项部分包含报警消息内容和要检查的包的具体部分。

下面是一个规则范例：

alert tcp any any -> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msg: "mountd access";)

第一个括号前的部分是规则头（rule header），包含的括号内的部分是规则选项（rule options）。规则选项部分中冒号前的单词称为选项关键字（option keywords）。注意，不是所有规则都必须包含规则选项部分，选项部分只是为了使对要收集或报警，或丢弃的包的定义更加严格。组成一个规则的所有元素对于指定的要采取的行动都必须是真的。当多个元素放在一起时，可以认为它们组成了一个逻辑与（AND）语句。同时，snort规则库文件中的不同规则可以认为组成了一个大的逻辑或（OR）语句。

规则高级概念

Includes:

include允许由命令行指定的规则文件包含其他的规则文件。

格式：

include:

   注意在该行结尾处没有分号。被包含的文件会把任何预先定义的变量值替换为自己的变量引用。参见变量（Variables）一节以获取关于在SNORT规则文件中定义和使用变量的更多信息。

 

Variables :

变量可能在snort中定义。

格式：

var:

例子：

var MY_NET 192.168.1.0/24

alert tcp any any -> $MY_NET any (flags: S; msg: "SYN packet";)

规则变量名可以用多种方法修改。可以在"$"操作符之后定义变量。"?" 和 "-"可用于变量修改操作符。

$var - 定义变量。

$(var) - 用变量"var"的值替换。

$(var:-default) - 用变量"var"的值替换，如果"var"没有定义用"default"替换。

$(var:?message) - 用变量"var"的值替换或打印出错误消息"message"然后出。

例子：

var MY_NET $(MY_NET:-192.168.1.0/24)

log tcp any any -> $(MY_NET:?MY_NET is undefined!) 23

 

规则头

规则动作：

规则的头包含了定义一个包的who，where和what信息，以及当满足规则定义的所有属性的包出现时要采取的行动。规则的第一项是"规则动作"（rule action），"规则动作"告诉snort在发现匹配规则的包时要干什么。在snort中有五种动作：alert、log、pass、activate和dynamic.

1、Alert-使用选择的报警方法生成一个警报，然后记录（log）这个包。

2、Log-记录这个包。

3、Pass-丢弃（忽略）这个包。

4、activate-报警并且激活另一条dynamic规则。

5、dynamic-保持空闲直到被一条activate规则激活，被激活后就作为一条log规则执行。

你可以定义你自己的规则类型并且附加一条或者更多的输出模块给它，然后你就可以使用这些规则类型作为snort规则的一个动作。

下面这个例子创建一条规则，记录到tcpdump。

ruletype suspicious

{

type log output

log_tcpdump: suspicious.log

}

下面这个例子创建一条规则，记录到系统日志和MySQL数据库

ruletype redalert

{

type alert output

alert_syslog: LOG_AUTH LOG_ALERT

output database: log, mysql, user=snort dbname=snort host=localhost

}

 

协议

规则的下一部分是协议。Snort当前分析可疑包的ip协议有四种：tcp 、udp、icmp和ip。将来可能会更多，例如ARP、IGRP、GRE、OSPF、RIP、IPX等。

Ip地址

规则头的下一个部分处理一个给定规则的ip地址和端口号信息。关键字"any"可以被用来定义任何地址。Snort没有提供根据ip地址查询域名的机制。地址就是由直接的数字型ip地址和一个cidr块组成的。Cidr块指示作用在规则地址和需要检查的进入的任何包的网络掩码。/24表示c类网络，/16表示b类网络，/32表示一个特定的机器的地址。例如，192.168.1.0/24代表从192.168.1.1到192.168.1.255的地址块。在这个地址范围的任何地址都匹配使用这个192.168.1.0/24标志的规则。这种记法给我们提供了一个很好的方法来表示一个很大的地址空间。

有一个操作符可以应用在ip地址上，它是否定运算符（negation operator）。这个操作符告诉snort匹配除了列出的ip地址以外的所有ip地址。否定操作符用"！"表示。下面这条规则对任何来自本地网络以外的流都进行报警。

alert tcp !192.168.1.0/24 any -> 192.168.1.0/24 111 (content: "|00 01 86 a5|"; msg: "external mountd access";)

这个规则的ip地址代表"任何源ip地址不是来自内部网络而目标地址是内部网络的tcp包"。

也可以指定ip地址列表，一个ip地址列表由逗号分割的ip地址和CIDR块组成，并且要放在方括号内“[”，“]”。此时，ip列表可以不包含空格在ip地址之间。下面是一个包含ip地址列表的规则的例子。

alert tcp ![192.168.1.0/24,10.1.1.0/24] any -> [192.168.1.0/24,10.1.1.0/24] 111 (content: "|00 01 86 a5|"; msg: "external mountd access";)

端口号

端口号可以用几种方法表示，包括"any"端口、静态端口定义、范围、以及通过否定操作符。"any"端口是一个通配符，表示任何端口。静态端口定义表示一个单个端口号，例如111表示portmapper，23表示telnet，80表示http等等。端口范围用范围操作符"："表示。范围操作符可以有数种使用方法，如下所示：

log udp any any -> 192.168.1.0/24 1:1024

记录来自任何端口的，目标端口范围在1到1024的udp流

log tcp any any -> 192.168.1.0/24 :6000

记录来自任何端口，目标端口小于等于6000的tcp流

log tcp any :1024 -> 192.168.1.0/24 500:

记录来自任何小于等于1024的特权端口，目标端口大于等于500的tcp流

 

端口否定操作符用"！"表示。它可以用于任何规则类型（除了any，这表示没有，呵呵）。例如，由于某个古怪的原因你需要记录除x windows端口以外的所有一切，你可以使用类似下面的规则：

 

log tcp any any -> 192.168.1.0/24 !6000:6010

方向操作符

方向操作符"->"表示规则所施加的流的方向。方向操作符左边的ip地址和端口号被认为是流来自的源主机，方向操作符右边的ip地址和端口信息是目标主机，还有一个双向操作符"<>"。它告诉snort把地址/端口号对既作为源，又作为目标来考虑。这对于记录/分析双向对话很方便，例如telnet或者pop3会话。用来记录一个telnet会话的两侧的流的范例如下：

log !192.168.1.0/24 any <> 192.168.1.0/24 23

Activate 和 dynamic 规则：

注：Activate 和 dynamic 规则将被tagging 所代替。在snort的将来版本，Activate 和 dynamic 规则将完全被功能增强的tagging所代替。

Activate 和 dynamic 规则对给了snort更强大的能力。你现在可以用一条规则来激活另一条规则，当这条规则适用于一些数据包时。在一些情况下这是非常有用的，例如你想设置一条规则：当一条规则结束后来完成记录。Activate规则除了包含一个选择域：activates外就和一条alert规则一样。Dynamic规则除了包含一个不同的选择域：activated_by 外就和log规则一样，dynamic规则还包含一个count域。

Actevate规则除了类似一条alert规则外，当一个特定的网络事件发生时还能告诉snort加载一条规则。Dynamic规则和log规则类似，但它是当一个activate规则发生后被动态加载的。把他们放在一起如下图所示：

activate tcp !$HOME_NET any -> $HOME_NET 143 (flags: PA; content: "|E8C0FFFFFF|/bin"; activates: 1; msg: "IMAP buffer overflow!";)

dynamic tcp !$HOME_NET any -> $HOME_NET 143 (activated_by: 1; count: 50;)

三种模式的使用

 

嗅探器

所谓的嗅探器模式就是snort从网络上读出数据包然后显示在你的控制台上。首先，我们从最基本的用法入手。如果你只要把TCP/IP包头信息打印在屏幕上，只需要输入下面的命令：

./snort -v

使用这个命令将使snort只输出IP和TCP/UDP/ICMP的包头信息。如果你要看到应用层的数据，可以使用：

./snort -vd

这条命令使snort在输出包头信息的同时显示包的数据信息。如果你还要显示数据链路层的信息，就使用下面的命令：

./snort -vde

注意这些选项开关还可以分开写或者任意结合在一块。例如：下面的命令就和上面最后的一条命令等价：

./snort -d -v –e

数据包记录器

如果要把所有的包记录到硬盘上，你需要指定一个日志目录，snort就会自动记录数据包：

./snort -dev -l ./log

当然，./log目录必须存在，否则snort就会报告错误信息并退出。当snort在这种模式下运行，它会记录所有看到的包将其放到一个目录中，这个目录以数据包目的主机的IP地址命名，例如：192.168.10.1

　　如果你只指定了-l命令开关，而没有设置目录名，snort有时会使用远程主机的IP地址作为目录，有时会使用本地主机IP地址作为目录名。为了只对本地网络进行日志，你需要给出本地网络：

./snort -dev -l ./log -h 192.168.1.0/24

这个命令告诉snort把进入C类网络192.168.1的所有包的数据链路、TCP/IP以及应用层的数据记录到目录./log中。

如果你的网络速度很快，或者你想使日志更加紧凑以便以后的分析，那么应该使用二进制的日志文件格式。所谓的二进制日志文件格式就是tcpdump程序使用的格式。使用下面的命令可以把所有的包记录到一个单一的二进制文件中：

./snort -l ./log -b

注意此处的命令行和上面的有很大的不同。我们勿需指定本地网络，因为所有的东西都被记录到一个单一的文件。你也不必冗余模式或者使用-d、-e功能选项，因为数据包中的所有内容都会被记录到日志文件中。

你可以使用任何支持tcpdump二进制格式的嗅探器程序从这个文件中读出数据包，例如：tcpdump或者Ethereal。使用-r功能开关，也能使snort读出包的数据。snort在所有运行模式下都能够处理tcpdump格式的文件。例如：如果你想在嗅探器模式下把一个tcpdump格式的二进制文件中的包打印到屏幕上，可以输入下面的命令：

./snort -dv -r packet.log

在日志包和入侵检测模式下，通过BPF(BSD Packet Filter)接口，你可以使用许多方式维护日志文件中的数据。例如，你只想从日志文件中提取ICMP包，只需要输入下面的命令行：

./snort -dvr packet.log icmp

网络入侵检测系统

snort最重要的用途还是作为网络入侵检测系统(NIDS)，使用下面命令行可以启动这种模式：

./snort -dev -l ./log -h 192.168.1.0/24 -c snort.conf

snort.conf是规则集文件。snort会对每个包和规则集进行匹配，发现这样的包就采取相应的行动。如果你不指定输出目录，snort就输出到/var/log/snort目录。

注意：如果你想长期使用snort作为自己的入侵检测系统，最好不要使用-v选项。因为使用这个选项，使snort向屏幕上输出一些信息，会大大降低snort的处理速度，从而在向显示器输出的过程中丢弃一些包。

此外，在绝大多数情况下，也没有必要记录数据链路层的包头，所以-e选项也可以不用：

./snort -d -h 192.168.1.0/24 -l ./log -c snort.conf

这是使用snort作为网络入侵检测系统最基本的形式，日志符合规则的包，以ASCII形式保存在有层次的目录结构中。

网络入侵检测模式下的输出选项

在NIDS模式下，有很多的方式来配置snort的输出。在默认情况下，snort以ASCII格式记录日志，使用full报警机制。如果使用full报警机制，snort会在包头之后打印报警消息。如果你不需

要日志包，可以使用-N选项。

snort有6种报警机制：full、fast、socket、syslog、smb(winpopup)和none。其中有4个可以在命令行状态下使用-A选项设置。这4个是：

-A fast：报警信息包括：一个时间戳(timestamp)、报警消息、源/目的IP地址和端口。

-A full：是默认的报警模式。

-A unsock：把报警发送到一个UNIX套接字，需要有一个程序进行监听，这样可以实现实时报警。

-A none：关闭报警机制。 

使用-s选项可以使snort把报警消息发送到syslog，默认的设备是LOG_AUTHPRIV和LOG_ALERT。可以修改snort.conf文件修改其配置。

snort还可以使用SMB报警机制，通过SAMBA把报警消息发送到Windows主机。为了使用这个报警机制，在运行./configure脚本时，必须使用--enable-smbalerts选项。

下面是一些输出配置的例子：

使用默认的日志方式(以解码的ASCII格式)并且把报警发给syslog：

./snort -c snort.conf -l ./log -s -h 192.168.1.0/24

使用二进制日志格式和SMB报警机制：　　

./snort -c snort.conf -b -M WORKSTATIONS

实验内容与步骤

在Windows 环境下安装和使用Snort:

1.首先从http://www.winpcap.org/install/default.htm下载winpcap并安装

2.从http://www.snort.org 下载snort规则，解压后，将规则文件（.rules）复制到Snort安装目录的rules/目录下

3.从http://www.snort.org 下载snort并安装

4.从“命令提示符”进入Snort安装目录，找到\bin目录并运行snort.exe。例如：

   C:\snort\bin>snort -V

注意：使用-i选项，以选择正确的网卡。使用-l选项，选择正确的日志记录目录。

B.嗅探模式：snort -v

C.记录模式

mkdir log

snort -dev -l ./log

D.网络入侵检测模式

mkdir log

snort -dev -l ./log -h 192.168.1.0/24 -c /etc/snort/snort.conf

5.修改并使用Snort的默认配置文件(snort.conf)运行Snort，snort.conf是规则集文件。snort会对每个包和规则集进行匹配，发现这样的包就采取相应的行动。如果不指定输出目录，snort就输出到/var/log/snort目录。注意Snort的语法。使用时，将其复制到Snort的/etc/目录，使用命令：

C:\snort\bin>snort –i 2 –c ../etc/snort.conf –l ../log/ 

注：-i 2 表示系统里面的第2块网卡，根据自己的电脑网卡情况决定，需要使用 snort –W显示网卡接口。不要复制上面命令，手动输入，字符存在差异。

如需停止snort，使用“ctrl+c”

博主使用的snort.conf，复制可用：

#--------------------------------------------------
#   http://www.snort.org     Snort 2.8.2 Ruleset
#     Contact: [email protected]
#--------------------------------------------------
# $Id$
#
###################################################
# This file contains a sample snort configuration. 
# You can take the following steps to create your own custom configuration:
#
#  1) Set the variables for your network
#  2) Configure dynamic loaded libraries
#  3) Configure preprocessors
#  4) Configure output plugins
#  5) Add any runtime config directives
#  6) Customize your rule set
#
###################################################
# Step #1: Set the network variables:
#
# You must change the following variables to reflect your local network. The
# variable is currently setup for an RFC 1918 address space.
#
# You can specify it explicitly as: 
#
# var HOME_NET 10.1.1.0/24
#
# or use global variable $_ADDRESS which will be always
# initialized to IP address and netmask of the network interface which you run
# snort at.  Under Windows, this must be specified as
# $(_ADDRESS), such as:
# $(\Device\Packet_{12345678-90AB-CDEF-1234567890AB}_ADDRESS)
#
# var HOME_NET $eth0_ADDRESS
#
# You can specify lists of IP addresses for HOME_NET
# by separating the IPs with commas like this:
#
# var HOME_NET [10.1.1.0/24,192.168.1.0/24]
#
# MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST!
#
# or you can specify the variable to be any IP address
# like this:

var HOME_NET any

# Set up the external network addresses as well.  A good start may be "any"
var EXTERNAL_NET any

# Configure your server lists.  This allows snort to only look for attacks to
# systems that have a service up.  Why look for HTTP attacks if you are not
# running a web server?  This allows quick filtering based on IP addresses
# These configurations MUST follow the same configuration scheme as defined
# above for $HOME_NET.  

# List of DNS servers on your network 
var DNS_SERVERS $HOME_NET

# List of SMTP servers on your network
var SMTP_SERVERS $HOME_NET

# List of web servers on your network
var HTTP_SERVERS $HOME_NET

# List of sql servers on your network 
var SQL_SERVERS $HOME_NET

# List of telnet servers on your network
var TELNET_SERVERS $HOME_NET

# List of snmp servers on your network
var SNMP_SERVERS $HOME_NET

# Configure your service ports.  This allows snort to look for attacks destined
# to a specific application only on the ports that application runs on.  For
# example, if you run a web server on port 8081, set your HTTP_PORTS variable
# like this:
#
# portvar HTTP_PORTS 8081
#
# Ports you run web servers on
portvar HTTP_PORTS 80

# NOTE:  If you wish to define multiple HTTP ports, use the portvar
# syntax to represent lists of ports and port ranges.  Examples:
## portvar HTTP_PORTS [80,8080]
## portvar HTTP_PORTS [80,8000:8080]
# And only include the rule that uses $HTTP_PORTS once.
#
# The pre-2.8.0 approach of redefining the variable to a different port and
# including the rules file twice is obsolete.  See README.variables for more
# details.

# Ports you want to look for SHELLCODE on.
portvar SHELLCODE_PORTS !80

# Ports you might see oracle attacks on
portvar ORACLE_PORTS 1521

# other variables
# 
# AIM servers.  AOL has a habit of adding new AIM servers, so instead of
# modifying the signatures when they do, we add them to this list of servers.
var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]

# Path to your rules files (this can be a relative path)
# Note for Windows users:  You are advised to make this an absolute path,
# such as:  c:\snort\rules
var RULE_PATH ../rules
var PREPROC_RULE_PATH ../preproc_rules

# Configure the snort decoder
# ============================
#
# Snort's decoder will alert on lots of things such as header
# truncation or options of unusual length or infrequently used tcp options
#
#
# Stop generic decode events:
#
# config disable_decode_alerts
#
# Stop Alerts on experimental TCP options
#
# config disable_tcpopt_experimental_alerts
#
# Stop Alerts on obsolete TCP options
#
# config disable_tcpopt_obsolete_alerts
#
# Stop Alerts on T/TCP alerts
#
# In snort 2.0.1 and above, this only alerts when a TCP option is detected
# that shows T/TCP being actively used on the network.  If this is normal
# behavior for your network, disable the next option.
#
# config disable_tcpopt_ttcp_alerts
#
# Stop Alerts on all other TCPOption type events:
#
# config disable_tcpopt_alerts
#
# Stop Alerts on invalid ip options
#
# config disable_ipopt_alerts
#
# Alert if value in length field (IP, TCP, UDP) is greater than the
# actual length of the captured portion of the packet that the length
# is supposed to represent:
#
# config enable_decode_oversized_alerts
#
# Same as above, but drop packet if in Inline mode -
# enable_decode_oversized_alerts must be enabled for this to work:
#
# config enable_decode_oversized_drops
#

# Configure the detection engine
# ===============================
#
# Use a different pattern matcher in case you have a machine with very limited
# resources:
#
# config detection: search-method lowmem

# Configure Inline Resets
# ========================
# 
# If running an iptables firewall with snort in InlineMode() we can now
# perform resets via a physical device. We grab the indev from iptables
# and use this for the interface on which to send resets. This config
# option takes an argument for the src mac address you want to use in the
# reset packet.  This way the bridge can remain stealthy. If the src mac
# option is not set we use the mac address of the indev device. If we
# don't set this option we will default to sending resets via raw socket,
# which needs an ipaddress to be assigned to the int.
#
# config layer2resets: 00:06:76:DD:5F:E3

###################################################
# Step #2: Configure dynamic loaded libraries
#
# If snort was configured to use dynamically loaded libraries,
# those libraries can be loaded here.
#
# Each of the following configuration options can be done via
# the command line as well.
#
# Load all dynamic preprocessors from the install path
# (same as command line option --dynamic-preprocessor-lib-dir)
#
#dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
dynamicpreprocessor directory c:\Snort\lib\snort_dynamicpreprocessor 
#
# Load a specific dynamic preprocessor library from the install path
# (same as command line option --dynamic-preprocessor-lib)
#
# dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libdynamicexample.so
#
# Load a dynamic engine from the install path
# (same as command line option --dynamic-engine-lib)
#
#dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
dynamicengine c:\Snort\lib\snort_dynamicengine\sf_engine.dll 
#
# Load all dynamic rules libraries from the install path
# (same as command line option --dynamic-detection-lib-dir)
#
# dynamicdetection directory /usr/local/lib/snort_dynamicrule/
#
# Load a specific dynamic rule library from the install path
# (same as command line option --dynamic-detection-lib)
#
# dynamicdetection file /usr/local/lib/snort_dynamicrule/libdynamicexamplerule.so
#

###################################################
# Step #3: Configure preprocessors
#
# General configuration for preprocessors is of 
# the form
# preprocessor : 

# Configure Flow tracking module
# -------------------------------
#
# The Flow tracking module is meant to start unifying the state keeping
# mechanisms of snort into a single place. Right now, only a portscan detector
# is implemented but in the long term,  many of the stateful subsystems of
# snort will be migrated over to becoming flow plugins. This must be enabled
# for flow-portscan to work correctly.
#
# See README.flow for additional information
#
#preprocessor flow: stats_interval 0 hash 2

# frag3: Target-based IP defragmentation 
# --------------------------------------
#
# Frag3 is a brand new IP defragmentation preprocessor that is capable of
# performing "target-based" processing of IP fragments.  Check out the
# README.frag3 file in the doc directory for more background and configuration
# information.
# 
# Frag3 configuration is a two step process, a global initialization phase 
# followed by the definition of a set of defragmentation engines.  
# 
# Global configuration defines the number of fragmented packets that Snort can
# track at the same time and gives you options regarding the memory cap for the
# subsystem or, optionally, allows you to preallocate all the memory for the 
# entire frag3 system.
#
# frag3_global options:
#   max_frags: Maximum number of frag trackers that may be active at once.  
#              Default value is 8192.
#   memcap: Maximum amount of memory that frag3 may access at any given time.
#           Default value is 4MB.
#   prealloc_frags: Maximum number of individual fragments that may be processed
#                   at once.  This is instead of the memcap system, uses static 
#                   allocation to increase performance.  No default value.  Each
#                   preallocated fragment typically eats ~1550 bytes.  However,
#                   the exact amount is determined by the snaplen, and this can
#                   go as high as 64K so beware!
#
# Target-based behavior is attached to an engine as a "policy" for handling 
# overlaps and retransmissions as enumerated in the Paxson paper.  There are
# currently five policy types available: "BSD", "BSD-right", "First", "Linux" 
# and "Last".  Engines can be bound to standard Snort CIDR blocks or
# IP lists.
#
# frag3_engine options:
#   timeout: Amount of time a fragmented packet may be active before expiring.
#            Default value is 60 seconds.
#   ttl_limit: Limit of delta allowable for TTLs of packets in the fragments. 
#              Based on the initial received fragment TTL.
#   min_ttl: Minimum acceptable TTL for a fragment, frags with TTLs below this
#            value will be discarded.  Default value is 0.
#   detect_anomalies: Activates frag3's anomaly detection mechanisms.
#   policy: Target-based policy to assign to this engine.  Default is BSD.
#   bind_to: IP address set to bind this engine to.  Default is all hosts.
#
# Frag3 configuration example:
#preprocessor frag3_global: max_frags 65536, prealloc_frags 65536
#preprocessor frag3_engine: policy linux \
#                           bind_to [10.1.1.12/32,10.1.1.13/32] \
#                           detect_anomalies
#preprocessor frag3_engine: policy first \
#                           bind_to 10.2.1.0/24 \
#                           detect_anomalies
#preprocessor frag3_engine: policy last \
#                           bind_to 10.3.1.0/24
#preprocessor frag3_engine: policy bsd

preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: policy first detect_anomalies


# stream4: stateful inspection/stream reassembly for Snort
#----------------------------------------------------------------------
# Use in concert with the -z [all|est] command line switch to defeat stick/snot
# against TCP rules.  Also performs full TCP stream reassembly, stateful
# inspection of TCP streams, etc.  Can statefully detect various portscan
# types, fingerprinting, ECN, etc.

# stateful inspection directive
# no arguments loads the defaults (timeout 30, memcap 8388608)
# options (options are comma delimited):
#   detect_scans - stream4 will detect stealth portscans and generate alerts
#                  when it sees them when this option is set
#   detect_state_problems - detect TCP state problems, this tends to be very
#                           noisy because there are a lot of crappy ip stack
#                           implementations out there
#
#   disable_evasion_alerts - turn off the possibly noisy mitigation of
#                            overlapping sequences.
#
#   ttl_limit [number]     - differential of the initial ttl on a session versus
#                             the normal that someone may be playing games.
#                             Routing flap may cause lots of false positives.
# 
#   keepstats [machine|binary] - keep session statistics, add "machine" to 
#                         get them in a flat format for machine reading, add
#                         "binary" to get them in a unified binary output 
#                         format
#   noinspect - turn off stateful inspection only
#   timeout [number] - set the session timeout counter to [number] seconds,
#                      default is 30 seconds
#   max_sessions [number] - limit the number of sessions stream4 keeps
#                         track of
#   memcap [number] - limit stream4 memory usage to [number] bytes (does
#                     not include session tracking, which is set by the
#                     max_sessions option)
#   log_flushed_streams - if an event is detected on a stream this option will
#                         cause all packets that are stored in the stream4
#                         packet buffers to be flushed to disk.  This only 
#                         works when logging in pcap mode!
#   server_inspect_limit [bytes] - Byte limit on server side inspection.
#   enable_udp_sessions - turn on tracking of "sessions" over UDP.  Requires
#                         configure --enable-stream4udp.  UDP sessions are
#                         only created when there is a rule for the sender or
#                         responder that has a flow or flowbits keyword.
#   max_udp_sessions [number] - limit the number of simultaneous UDP sessions
#                               to track
#   udp_ignore_any - Do not inspect UDP packets unless there is a port specific
#                    rule for a given port.  This is a performance improvement
#                    and turns off inspection for udp xxx any -> xxx any rules
#   cache_clean_sessions [number] - Cleanup the session cache by number sessions
#                                   at a time.  The larger the value, the
#                                   more sessions are purged from the cache when
#                                   the session limit or memcap is reached.
#                                   Defaults to 5.
#   
#   
#
# Stream4 uses Generator ID 111 and uses the following SIDS 
# for that GID:
#  SID     Event description
# -----   -------------------
#   1       Stealth activity
#   2       Evasive RST packet
#   3       Evasive TCP packet retransmission
#   4       TCP Window violation
#   5       Data on SYN packet
#   6       Stealth scan: full XMAS
#   7       Stealth scan: SYN-ACK-PSH-URG
#   8       Stealth scan: FIN scan
#   9       Stealth scan: NULL scan
#   10      Stealth scan: NMAP XMAS scan
#   11      Stealth scan: Vecna scan
#   12      Stealth scan: NMAP fingerprint scan stateful detect
#   13      Stealth scan: SYN-FIN scan
#   14      TCP forward overlap

#preprocessor stream4: disable_evasion_alerts

# tcp stream reassembly directive
# no arguments loads the default configuration 
#   Only reassemble the client,
#   Only reassemble the default list of ports (See below),  
#   Give alerts for "bad" streams
#
# Available options (comma delimited):
#   clientonly - reassemble traffic for the client side of a connection only
#   serveronly - reassemble traffic for the server side of a connection only
#   both - reassemble both sides of a session
#   noalerts - turn off alerts from the stream reassembly stage of stream4
#   ports [list] - use the space separated list of ports in [list], "all" 
#                  will turn on reassembly for all ports, "default" will turn
#                  on reassembly for ports 21, 23, 25, 42, 53, 80, 110,
#                  111, 135, 136, 137, 139, 143, 445, 513, 514, 1433, 1521,
#                  2401, and 3306
#   favor_old - favor an old segment (based on sequence number) over a new one.
#               This is the default.
#   favor_new - favor an new segment (based on sequence number) over an old one.
#   overlap_limit [number] - limit on overlaping segments for a session.
#   flush_on_alert - flushes stream when an alert is generated for a session.
#   flush_behavior [mode] -
#           default      - use old static flushpoints (default)
#           large_window - use new larger static flushpoints
#           random       - use random flushpoints defined by flush_base, 
#                          flush_seed and flush_range
#   flush_base [number] - lowest allowed random flushpoint (512 by default)
#   flush_range [number] - number is the space within which random flushpoints
#                          are generated (default 1213)
#   flush_seed [number] - seed for the random number generator, defaults to 
#                         Snort PID + time
#
# Using the default random flushpoints, the smallest flushpoint is 512,
# and the largest is 1725 bytes.
#preprocessor stream4_reassemble

# stream5: Target Based stateful inspection/stream reassembly for Snort
# ---------------------------------------------------------------------
# Stream5 is a target-based stream engine for Snort.  Its functionality
# replaces that of Stream4.  Consequently, BOTH Stream4 and Stream5
# cannot be used simultaneously.  Comment out the stream4 configurations
# above to use Stream5.
# 
# See README.stream5 for details on the configuration options.
#
# Example config (that emulates Stream4 with UDP support compiled in)
preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
                              track_udp no
preprocessor stream5_tcp: policy first, use_static_footprint_sizes
# preprocessor stream5_udp: ignore_any_rules


# Performance Statistics
# ----------------------
# Documentation for this is provided in the Snort Manual.  You should read it.
# It is included in the release distribution as doc/snort_manual.pdf
# 
# preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000

# http_inspect: normalize and detect HTTP traffic and protocol anomalies
#
# lots of options available here. See doc/README.http_inspect.
# unicode.map should be wherever your snort.conf lives, or given
# a full path to where snort can find it.
preprocessor http_inspect: global \
    iis_unicode_map unicode.map 1252 

preprocessor http_inspect_server: server default \
    profile all ports { 80 8080 8180 } oversize_dir_length 500

#
#  Example unique server configuration
#
#preprocessor http_inspect_server: server 1.1.1.1 \
#    ports { 80 3128 8080 } \
#    flow_depth 0 \
#    ascii no \
#    double_decode yes \
#    non_rfc_char { 0x00 } \
#    chunk_length 500000 \
#    non_strict \
#    oversize_dir_length 300 \
#    no_alerts


# rpc_decode: normalize RPC traffic
# ---------------------------------
# RPC may be sent in alternate encodings besides the usual 4-byte encoding
# that is used by default. This plugin takes the port numbers that RPC
# services are running on as arguments - it is assumed that the given ports
# are actually running this type of service. If not, change the ports or turn
# it off.
# The RPC decode preprocessor uses generator ID 106
#
# arguments: space separated list
# alert_fragments - alert on any rpc fragmented TCP data
# no_alert_multiple_requests - don't alert when >1 rpc query is in a packet
# no_alert_large_fragments - don't alert when the fragmented
#                            sizes exceed the current packet size
# no_alert_incomplete - don't alert when a single segment
#                       exceeds the current packet size

preprocessor rpc_decode: 111 32771

# bo: Back Orifice detector
# -------------------------
# Detects Back Orifice traffic on the network.
#
# arguments:  
#   syntax:
#     preprocessor bo: noalert { client | server | general | snort_attack } \
#                      drop    { client | server | general | snort_attack }
#   example:
#     preprocessor bo: noalert { general server } drop { snort_attack }

# 
# The Back Orifice detector uses Generator ID 105 and uses the 
# following SIDS for that GID:
#  SID     Event description
# -----   -------------------
#   1       Back Orifice traffic detected
#   2       Back Orifice Client Traffic Detected
#   3       Back Orifice Server Traffic Detected
#   4       Back Orifice Snort Buffer Attack

preprocessor bo

# telnet_decode: Telnet negotiation string normalizer
# ---------------------------------------------------
# This preprocessor "normalizes" telnet negotiation strings from telnet and ftp
# traffic.  It works in much the same way as the http_decode preprocessor,
# searching for traffic that breaks up the normal data stream of a protocol and
# replacing it with a normalized representation of that traffic so that the
# "content" pattern matching keyword can work without requiring modifications.
# This preprocessor requires no arguments.
#
# DEPRECATED in favor of ftp_telnet dynamic preprocessor
#preprocessor telnet_decode
#
# ftp_telnet: FTP & Telnet normalizer, protocol enforcement and buff overflow
# ---------------------------------------------------------------------------
# This preprocessor normalizes telnet negotiation strings from telnet and
# ftp traffic.  It looks for traffic that breaks the normal data stream
# of the protocol, replacing it with a normalized representation of that
# traffic so that the "content" pattern matching keyword can work without
# requiring modifications.
#
# It also performs protocol correctness checks for the FTP command channel,
# and identifies open FTP data transfers.
#
# FTPTelnet has numerous options available, please read
# README.ftptelnet for help configuring the options for the global
# telnet, ftp server, and ftp client sections for the protocol.

#####
# Per Step #2, set the following to load the ftptelnet preprocessor
# dynamicpreprocessor file 
# or use commandline option
# --dynamic-preprocessor-lib 

preprocessor ftp_telnet: global \
   encrypted_traffic yes \
   inspection_type stateful

preprocessor ftp_telnet_protocol: telnet \
   normalize \
   ayt_attack_thresh 200

# This is consistent with the FTP rules as of 18 Sept 2004.
# CWD can have param length of 200
# MODE has an additional mode of Z (compressed)
# Check for string formats in USER & PASS commands
# Check nDTM commands that set modification time on the file.
preprocessor ftp_telnet_protocol: ftp server default \
   def_max_param_len 100 \
   alt_max_param_len 200 { CWD } \
   cmd_validity MODE < char ASBCZ > \
   cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
   chk_str_fmt { USER PASS RNFR RNTO SITE MKD } \
   telnet_cmds yes \
   data_chan

preprocessor ftp_telnet_protocol: ftp client default \
   max_resp_len 256 \
   bounce yes \
   telnet_cmds yes

# smtp: SMTP normalizer, protocol enforcement and buffer overflow
# ---------------------------------------------------------------------------
# This preprocessor normalizes SMTP commands by removing extraneous spaces.
# It looks for overly long command lines, response lines, and data header lines.
# It can alert on invalid commands, or specific valid commands.  It can optionally
# ignore mail data, and can ignore TLS encrypted data.
#
# SMTP has numerous options available, please read README.SMTP for help
# configuring options.

#####
# Per Step #2, set the following to load the smtp preprocessor
# dynamicpreprocessor file 
# or use commandline option
# --dynamic-preprocessor-lib 

preprocessor smtp: \
  ports { 25 587 691 } \
  inspection_type stateful \
  normalize cmds \
  normalize_cmds { EXPN VRFY RCPT } \
  alt_max_command_line_len 260 { MAIL } \
  alt_max_command_line_len 300 { RCPT } \
  alt_max_command_line_len 500 { HELP HELO ETRN } \
  alt_max_command_line_len 255 { EXPN VRFY }

# sfPortscan
# ----------
# Portscan detection module.  Detects various types of portscans and
# portsweeps.  For more information on detection philosophy, alert types,
# and detailed portscan information, please refer to the README.sfportscan.
#
# -configuration options-
#     proto { tcp udp icmp ip all }
#       The arguments to the proto option are the types of protocol scans that
#       the user wants to detect.  Arguments should be separated by spaces and
#       not commas.
#     scan_type { portscan portsweep decoy_portscan distributed_portscan all }
#       The arguments to the scan_type option are the scan types that the
#       user wants to detect.  Arguments should be separated by spaces and not
#       commas.
#     sense_level { low|medium|high }
#       There is only one argument to this option and it is the level of
#       sensitivity in which to detect portscans.  The 'low' sensitivity
#       detects scans by the common method of looking for response errors, such
#       as TCP RSTs or ICMP unreachables.  This level requires the least
#       tuning.  The 'medium' sensitivity level detects portscans and 
#       filtered portscans (portscans that receive no response).  This
#       sensitivity level usually requires tuning out scan events from NATed
#       IPs, DNS cache servers, etc.  The 'high' sensitivity level has
#       lower thresholds for portscan detection and a longer time window than
#       the 'medium' sensitivity level.  Requires more tuning and may be noisy
#       on very active networks.  However, this sensitivity levels catches the
#       most scans.
#     memcap { positive integer }
#       The maximum number of bytes to allocate for portscan detection.  The
#       higher this number the more nodes that can be tracked.
#     logfile { filename }
#       This option specifies the file to log portscan and detailed portscan
#       values to.  If there is not a leading /, then snort logs to the
#       configured log directory.  Refer to README.sfportscan for details on
#       the logged values in the logfile.
#     watch_ip { Snort IP List }
#     ignore_scanners { Snort IP List }
#     ignore_scanned { Snort IP List }
#       These options take a snort IP list as the argument.  The 'watch_ip'
#       option specifies the IP(s) to watch for portscan.  The 
#       'ignore_scanners' option specifies the IP(s) to ignore as scanners.
#       Note that these hosts are still watched as scanned hosts.  The
#       'ignore_scanners' option is used to tune alerts from very active
#       hosts such as NAT, nessus hosts, etc.  The 'ignore_scanned' option 
#       specifies the IP(s) to ignore as scanned hosts.  Note that these hosts
#       are still watched as scanner hosts.  The 'ignore_scanned' option is
#       used to tune alerts from very active hosts such as syslog servers, etc.
#     detect_ack_scans
#       This option will include sessions picked up in midstream by the stream
#       module, which is necessary to detect ACK scans.  However, this can lead to
#       false alerts, especially under heavy load with dropped packets; which is why
#       the option is off by default.
#
preprocessor sfportscan: proto  { all } \
                         memcap { 10000000 } \
                         sense_level { low }

# arpspoof
#----------------------------------------
# Experimental ARP detection code from Jeff Nathan, detects ARP attacks,
# unicast ARP requests, and specific ARP mapping monitoring.  To make use of
# this preprocessor you must specify the IP and hardware address of hosts on
# the same layer 2 segment as you.  Specify one host IP MAC combo per line.
# Also takes a "-unicast" option to turn on unicast ARP request detection. 
# Arpspoof uses Generator ID 112 and uses the following SIDS for that GID:

#  SID     Event description
# -----   -------------------
#   1       Unicast ARP request
#   2       Etherframe ARP mismatch (src)
#   3       Etherframe ARP mismatch (dst)
#   4       ARP cache overwrite attack

#preprocessor arpspoof
#preprocessor arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00

# ssh
#----------------------------------------
# EXPERIMENTAL CODE!!!
#
# THIS CODE IS STILL EXPERIMENTAL AND MAY OR MAY NOT BE STABLE!
# USE AT YOUR OWN RISK!  DO NOT USE IN PRODUCTION ENVIRONMENTS.
# YOU HAVE BEEN WARNED.
#
# The SSH preprocessor detects the following exploits: Gobbles, CRC 32,
# Secure CRT, and the Protocol Mismatch exploit.
#
# Both Gobbles and CRC 32 attacks occur after the key exchange, and are
# therefore encrypted.  Both attacks involve sending a large payload
# (20kb+) to the server immediately after the authentication challenge.
# To detect the attacks, the SSH preprocessor counts the number of bytes
# transmitted to the server.  If those bytes exceed a pre-defined limit
# within a pre-define number of packets, an alert is generated.  Since
# Gobbles only effects SSHv2 and CRC 32 only effects SSHv1, the SSH
# version string exchange is used to distinguish the attacks.
#
# The Secure CRT and protocol mismatch exploits are observable before
# the key exchange.
#
# SSH has numerous options available, please read README.ssh for help
# configuring options.

#####
# Per Step #2, set the following to load the ssh preprocessor
# dynamicpreprocessor file 
# or use commandline option
# --dynamic-preprocessor-lib 
#
#preprocessor ssh: server_ports { 22 } \
#                  max_client_bytes 19600 \
#                  max_encrypted_packets 20

# DCE/RPC
#----------------------------------------
#
# The dcerpc preprocessor detects and decodes SMB and DCE/RPC traffic.
# It is primarily interested in DCE/RPC data, and only decodes SMB
# to get at the DCE/RPC data carried by the SMB layer.
# 
# Currently, the preprocessor only handles reassembly of fragmentation
# at both the SMB and DCE/RPC layer.  Snort rules can be evaded by
# using both types of fragmentation; with the preprocessor enabled
# the rules are given a buffer with a reassembled SMB or DCE/RPC
# packet to examine.
# 
# At the SMB layer, only fragmentation using WriteAndX is currently
# reassembled.  Other methods will be handled in future versions of
# the preprocessor.
# 
# Autodetection of SMB is done by looking for "\xFFSMB" at the start of
# the SMB data, as well as checking the NetBIOS header (which is always
# present for SMB) for the type "SMB Session".
# 
# Autodetection of DCE/RPC is not as reliable.  Currently, two bytes are
# checked in the packet.  Assuming that the data is a DCE/RPC header,
# one byte is checked for DCE/RPC version (5) and another for the type
# "DCE/RPC Request".  If both match, the preprocessor proceeds with that
# assumption that it is looking at DCE/RPC data.  If subsequent checks
# are nonsensical, it ends processing.
#
# DCERPC has numerous options available, please read README.dcerpc for help
# configuring options.

#####
# Per Step #2, set the following to load the dcerpc preprocessor
# dynamicpreprocessor file 
# or use commandline option
# --dynamic-preprocessor-lib 

preprocessor dcerpc: \
    autodetect \
    max_frag_size 3000 \
    memcap 100000

# DNS
#----------------------------------------
# The dns preprocessor (currently) decodes DNS Response traffic
# and detects a few vulnerabilities.
#
# DNS has a few options available, please read README.dns for
# help configuring options.

#####
# Per Step #2, set the following to load the dns preprocessor
# dynamicpreprocessor file 
# or use commandline option
# --dynamic-preprocessor-lib 

preprocessor dns: \
    ports { 53 } \
    enable_rdata_overflow

# SSL
#----------------------------------------
# Encrypted traffic should be ignored by Snort for both performance reasons
# and to reduce false positives.  The SSL Dynamic Preprocessor (SSLPP) 
# inspects SSL traffic and optionally determines if and when to stop 
# inspection of it.
#
# Typically, SSL is used over port 443 as HTTPS.  By enabling the SSLPP to
# inspect port 443, only the SSL handshake of each connection will be
# inspected.  Once the traffic is determined to be encrypted, no further
# inspection of the data on the connection is made.
#
#   Important note: Stream4 or Stream5 should be explicitly told to reassemble
#                   traffic on the ports that you intend to inspect SSL
#                   encrypted traffic on.
#
#   To add reassembly on port 443 to Stream5, use 'port both 443' in the 
#   Stream5 configuration.

preprocessor ssl: noinspect_encrypted


####################################################################
# Step #4: Configure output plugins
#
# Uncomment and configure the output plugins you decide to use.  General
# configuration for output plugins is of the form:
#
# output : 
#
# alert_syslog: log alerts to syslog
# ----------------------------------
# Use one or more syslog facilities as arguments.  Win32 can also optionally
# specify a particular hostname/port.  Under Win32, the default hostname is
# '127.0.0.1', and the default port is 514.
#
# [Unix flavours should use this format...]
# output alert_syslog: LOG_AUTH LOG_ALERT
#
# [Win32 can use any of these formats...]
# output alert_syslog: LOG_AUTH LOG_ALERT
# output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT
# output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT

# log_tcpdump: log packets in binary tcpdump format
# -------------------------------------------------
# The only argument is the output file name.
#
# output log_tcpdump: tcpdump.log

# database: log to a variety of databases
# ---------------------------------------
# See the README.database file for more information about configuring
# and using this plugin.
#
# output database: log, mysql, user=root password=test dbname=db host=localhost
# output database: alert, postgresql, user=snort dbname=snort
# output database: log, odbc, user=snort dbname=snort
# output database: log, mssql, dbname=snort user=snort password=test
# output database: log, oracle, dbname=snort user=snort password=test

# unified: Snort unified binary format alerting and logging
# -------------------------------------------------------------
# The unified output plugin provides two new formats for logging and generating
# alerts from Snort, the "unified" format.  The unified format is a straight
# binary format for logging data out of Snort that is designed to be fast and
# efficient.  Used with barnyard (the new alert/log processor), most of the
# overhead for logging and alerting to various slow storage mechanisms such as
# databases or the network can now be avoided.  
#
# Check out the spo_unified.h file for the data formats.
#
# Two arguments are supported.
#    filename - base filename to write to (current time_t is appended)
#    limit    - maximum size of spool file in MB (default: 128)
#
# output alert_unified: filename snort.alert, limit 128
# output log_unified: filename snort.log, limit 128


# prelude: log to the Prelude Hybrid IDS system
# ---------------------------------------------
#
# profile = Name of the Prelude profile to use (default is snort).
#
# Snort priority to IDMEF severity mappings:
# high < medium < low < info
#
# These are the default mapped from classification.config:
# info   = 4
# low    = 3
# medium = 2
# high   = anything below medium
#
# output alert_prelude
# output alert_prelude: profile=snort-profile-name


# You can optionally define new rule types and associate one or more output
# plugins specifically to that type.
#
# This example will create a type that will log to just tcpdump.
# ruletype suspicious
# {
#   type log
#   output log_tcpdump: suspicious.log
# }
#
# EXAMPLE RULE FOR SUSPICIOUS RULETYPE:
# suspicious tcp $HOME_NET any -> $HOME_NET 6667 (msg:"Internal IRC Server";)
#
# This example will create a rule type that will log to syslog and a mysql
# database:
# ruletype redalert
# {
#   type alert
#   output alert_syslog: LOG_AUTH LOG_ALERT
#   output database: log, mysql, user=snort dbname=snort host=localhost
# }
#
# EXAMPLE RULE FOR REDALERT RULETYPE:
# redalert tcp $HOME_NET any -> $EXTERNAL_NET 31337 \
#   (msg:"Someone is being LEET"; flags:A+;)

#
# Include classification & priority settings
# Note for Windows users:  You are advised to make this an absolute path,
# such as:  c:\snort\etc\classification.config
#

include classification.config

#
# Include reference systems
# Note for Windows users:  You are advised to make this an absolute path,
# such as:  c:\snort\etc\reference.config
#

include reference.config

####################################################################
# Step #5: Configure snort with config statements
#
# See the snort manual for a full set of configuration references
#
# config flowbits_size: 64
#
# New global ignore_ports config option from Andy Mullican
#
# config ignore_ports:  
# config ignore_ports: tcp 21 6667:6671 1356
# config ignore_ports: udp 1:17 53


####################################################################
# Step #6: Customize your rule set
#
# Up to date snort rules are available at http://www.snort.org
#
# The snort web site has documentation about how to write your own custom snort
# rules.

#=========================================
# Include all relevant rulesets here 
# 
# The following rulesets are disabled by default:
#
#   web-attacks, backdoor, shellcode, policy, porn, info, icmp-info, virus,
#   chat, multimedia, and p2p
#            
# These rules are either site policy specific or require tuning in order to not
# generate false positive alerts in most enviornments.
# 
# Please read the specific include file for more information and
# README.alert_order for how rule ordering affects how alerts are triggered.
#=========================================

include $RULE_PATH/local.rules
include $RULE_PATH/bad-traffic.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
include $RULE_PATH/ftp.rules
include $RULE_PATH/telnet.rules
include $RULE_PATH/rpc.rules
include $RULE_PATH/rservices.rules
include $RULE_PATH/dos.rules
include $RULE_PATH/ddos.rules
include $RULE_PATH/dns.rules
include $RULE_PATH/tftp.rules

include $RULE_PATH/web-cgi.rules
include $RULE_PATH/web-coldfusion.rules
include $RULE_PATH/web-iis.rules
include $RULE_PATH/web-frontpage.rules
#include $RULE_PATH/web-misc.rules
include $RULE_PATH/web-client.rules
include $RULE_PATH/web-php.rules

include $RULE_PATH/sql.rules
include $RULE_PATH/x11.rules
include $RULE_PATH/icmp.rules
include $RULE_PATH/netbios.rules
include $RULE_PATH/misc.rules
include $RULE_PATH/attack-responses.rules
include $RULE_PATH/oracle.rules
include $RULE_PATH/mysql.rules
include $RULE_PATH/snmp.rules

include $RULE_PATH/smtp.rules
include $RULE_PATH/imap.rules
include $RULE_PATH/pop2.rules
include $RULE_PATH/pop3.rules

include $RULE_PATH/nntp.rules
include $RULE_PATH/other-ids.rules
# include $RULE_PATH/web-attacks.rules
# include $RULE_PATH/backdoor.rules
# include $RULE_PATH/shellcode.rules
# include $RULE_PATH/policy.rules
# include $RULE_PATH/porn.rules
# include $RULE_PATH/info.rules
# include $RULE_PATH/icmp-info.rules
# include $RULE_PATH/virus.rules
# include $RULE_PATH/chat.rules
# include $RULE_PATH/multimedia.rules
# include $RULE_PATH/p2p.rules
# include $RULE_PATH/spyware-put.rules
# include $RULE_PATH/specific-threats.rules
include $RULE_PATH/experimental.rules

# include $PREPROC_RULE_PATH/preprocessor.rules
# include $PREPROC_RULE_PATH/decoder.rules

# Include any thresholding or suppression commands. See threshold.conf in the
# /etc directory for details. Commands don't necessarily need to be
# contained in this conf, but a separate conf makes it easier to maintain them. 
# Note for Windows users:  You are advised to make this an absolute path,
# such as:  c:\snort\etc\threshold.conf
# Uncomment if needed.
# include threshold.conf

 

入侵与检测

安装完毕后，开启入侵检测系统模式：

C:\Users\zhanglipeng>cd C:\Snort\bin

C:\Snort\bin>mkdir log

C:\Snort\bin>snort -d -h 10.163.0.0/24 -l ./log -c ../etc/snort.conf

解释：本次的局域网环境是由我的Mac OS下parelles desktop中多台虚拟机共同组建而成，其中win10主机10.163.0.6:

入侵机为Kali Linux，ip为10.163.0.5

因此第三条命令中，将子网范围定为10.163.0.0/24

（1）关闭windows10 的防火墙，打开snort的入侵检测模式；

（2）打开Kali Linux上的Zenmap，对Windows 10进行端口扫描：

1. 停止扫描后，在window 10命令行下，Ctrl+C停止检测；
2. 查看检测结果：

C:\Snort\bin>snort -d -h 10.163.0.0/24 -l ./log -c ../etc/snort.conf

Running in IDS mode

 

        --== Initializing Snort ==--

Initializing Output Plugins!

Initializing Preprocessors!

Initializing Plug-ins!

Parsing Rules file ../etc/snort.conf

PortVar 'HTTP_PORTS' defined :  [ 80 ]

PortVar 'SHELLCODE_PORTS' defined :  [ 0:79 81:65535 ]

PortVar 'ORACLE_PORTS' defined :  [ 1521 ]

Frag3 global config:

    Max frags: 65536

    Fragment memory cap: 4194304 bytes

Frag3 engine config:

    Target-based policy: FIRST

    Fragment timeout: 60 seconds

    Fragment min_ttl:   1

    Fragment ttl_limit (not used): 5

    Fragment Problems: 1

Stream5 global config:

    Track TCP sessions: ACTIVE

    Max TCP sessions: 8192

    Memcap (for reassembly packet storage): 8388608

    Track UDP sessions: INACTIVE

    Track ICMP sessions: INACTIVE

Stream5 TCP Policy config:

    Reassembly Policy: FIRST

    Timeout: 30 seconds

    Min ttl:  1

    Options:

        Static Flushpoint Sizes: YES

    Reassembly Ports:

      21 client (Footprint)

      23 client (Footprint)

      25 client (Footprint)

      42 client (Footprint)

      53 client (Footprint)

      80 client (Footprint)

      110 client (Footprint)

      111 client (Footprint)

      135 client (Footprint)

      136 client (Footprint)

      137 client (Footprint)

      139 client (Footprint)

      143 client (Footprint)

      445 client (Footprint)

      513 client (Footprint)

      514 client (Footprint)

      1433 client (Footprint)

      1521 client (Footprint)

      2401 client (Footprint)

      3306 client (Footprint)

HttpInspect Config:

    GLOBAL CONFIG

      Max Pipeline Requests:    0

      Inspection Type:          STATELESS

      Detect Proxy Usage:       NO

      IIS Unicode Map Filename: ../etc/unicode.map

      IIS Unicode Map Codepage: 1252

    DEFAULT SERVER CONFIG:

      Server profile: All

      Ports: 80 8080 8180

      Flow Depth: 300

      Max Chunk Length: 500000

      Max Header Field Length: 0

      Inspect Pipeline Requests: YES

      URI Discovery Strict Mode: NO

      Allow Proxy Usage: NO

      Disable Alerting: NO

      Oversize Dir Length: 500

      Only inspect URI: NO

      Ascii: YES alert: NO

      Double Decoding: YES alert: YES

      %U Encoding: YES alert: YES

      Bare Byte: YES alert: YES

      Base36: OFF

      UTF 8: OFF

      IIS Unicode: YES alert: YES

      Multiple Slash: YES alert: NO

      IIS Backslash: YES alert: NO

      Directory Traversal: YES alert: NO

      Web Root Traversal: YES alert: YES

      Apache WhiteSpace: YES alert: NO

      IIS Delimiter: YES alert: NO

      IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG

      Non-RFC Compliant Characters: NONE

      Whitespace Characters: 0x09 0x0b 0x0c 0x0d

rpc_decode arguments:

    Ports to decode RPC on: 111 32771

    alert_fragments: INACTIVE

    alert_large_fragments: ACTIVE

    alert_incomplete: ACTIVE

    alert_multiple_requests: ACTIVE

Portscan Detection Config:

    Detect Protocols:  TCP UDP ICMP IP

    Detect Scan Type:  portscan portsweep decoy_portscan distributed_portscan

    Sensitivity Level: Low

    Memcap (in bytes): 10000000

    Number of Nodes:   36900

 

Tagged Packet Limit: 256

Loading dynamic engine c:\Snort\lib\snort_dynamicengine\sf_engine.dll... done

Loading all dynamic preprocessor libs from c:\Snort\lib\snort_dynamicpreprocessor...

  Loading dynamic preprocessor library c:\Snort\lib\snort_dynamicpreprocessor\sf_dcerpc.dll... done

  Loading dynamic preprocessor library c:\Snort\lib\snort_dynamicpreprocessor\sf_dns.dll... done

  Loading dynamic preprocessor library c:\Snort\lib\snort_dynamicpreprocessor\sf_ftptelnet.dll... done

  Loading dynamic preprocessor library c:\Snort\lib\snort_dynamicpreprocessor\sf_smtp.dll... done

  Loading dynamic preprocessor library c:\Snort\lib\snort_dynamicpreprocessor\sf_ssh.dll... done

  Loading dynamic preprocessor library c:\Snort\lib\snort_dynamicpreprocessor\sf_ssl.dll... done

  Finished Loading all dynamic preprocessor libs from c:\Snort\lib\snort_dynamicpreprocessor

FTPTelnet Config:

    GLOBAL CONFIG

      Inspection Type: stateful

      Check for Encrypted Traffic: YES alert: YES

      Continue to check encrypted data: NO

    TELNET CONFIG:

      Ports: 23

      Are You There Threshold: 200

      Normalize: YES

      Detect Anomalies: NO

    FTP CONFIG:

      FTP Server: default

        Ports: 21

        Check for Telnet Cmds: YES alert: YES

        Identify open data channels: YES

      FTP Client: default

        Check for Bounce Attacks: YES alert: YES

        Check for Telnet Cmds: YES alert: YES

        Max Response Length: 256

 

SMTP Config:

    Ports: 25 587 691

    Inspection Type: Stateful

    Normalize: EXPN RCPT VRFY

    Ignore Data: No

    Ignore TLS Data: No

    Ignore SMTP Alerts: No

    Max Command Line Length: Unlimited

    Max Specific Command Line Length:

       ETRN:500 EXPN:255 HELO:500 HELP:500 MAIL:260

       RCPT:300 VRFY:255

    Max Header Line Length: Unlimited

    Max Response Line Length: Unlimited

    X-Link2State Alert: Yes

    Drop on X-Link2State Alert: No

    Alert on commands: None

 

DCE/RPC Decoder config:

    Autodetect ports ENABLED

    SMB fragmentation ENABLED

    DCE/RPC fragmentation ENABLED

    Max Frag Size: 3000 bytes

    Memcap: 100000 KB

    Alert if memcap exceeded DISABLED

 

DNS config:

    DNS Client rdata txt Overflow Alert: ACTIVE

    Obsolete DNS RR Types Alert: INACTIVE

    Experimental DNS RR Types Alert: INACTIVE

    Ports: 53

SSLPP config:

    Encrypted packets: not inspected

    Ports:

      443      465      563      636      989

      992      993      994      995

 

+++++++++++++++++++++++++++++++++++++++++++++++++++

Initializing rule chains...

2485 Snort rules read

    2485 detection rules

    0 decoder rules

    0 preprocessor rules

2485 Option Chains linked into 184 Chain Headers

0 Dynamic rules

+++++++++++++++++++++++++++++++++++++++++++++++++++

 

+-------------------[Rule Port Counts]---------------------------------------

|             tcp     udp    icmp      ip

|     src     117      12       0       0

|     dst    2042     163       0       0

|     any      68      50      50      20

|      nc      22       8      15      18

|     s+d       3       3       0       0

+----------------------------------------------------------------------------

 

+-----------------------[thresholding-config]----------------------------------

| memory-cap : 1048576 bytes

+-----------------------[thresholding-global]----------------------------------

| none

+-----------------------[thresholding-local]-----------------------------------

| gen-id=1      sig-id=2494       type=Both      tracking=dst count=20  seconds=60

| gen-id=1      sig-id=2923       type=Threshold tracking=dst count=10  seconds=60

| gen-id=1      sig-id=3152       type=Threshold tracking=src count=5   seconds=2

| gen-id=1      sig-id=2496       type=Both      tracking=dst count=20  seconds=60

| gen-id=1      sig-id=2495       type=Both      tracking=dst count=20  seconds=60

| gen-id=1      sig-id=3543       type=Threshold tracking=src count=5   seconds=2

| gen-id=1      sig-id=2275       type=Threshold tracking=dst count=5   seconds=60

| gen-id=1      sig-id=3542       type=Threshold tracking=src count=5   seconds=2

| gen-id=1      sig-id=2523       type=Both      tracking=dst count=10  seconds=10

| gen-id=1      sig-id=3527       type=Limit     tracking=dst count=5   seconds=60

| gen-id=1      sig-id=3273       type=Threshold tracking=src count=5   seconds=2

| gen-id=1      sig-id=2924       type=Threshold tracking=dst count=10  seconds=60

+-----------------------[suppression]------------------------------------------

| none

-------------------------------------------------------------------------------

Rule application order: activation->dynamic->pass->drop->alert->log

Log directory = ./log

Verifying Preprocessor Configurations!

Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked.

Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.

Warning: flowbits key 'realplayer.playlist' is checked but not ever set.

Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.

33 out of 512 flowbits in use.

***

*** interface device lookup found: \

***

Initializing Network Interface \Device\NPF_{235B43F1-FEB4-4C4A-96BD-EFB2E713364F}

Decoding Ethernet on interface \Device\NPF_{235B43F1-FEB4-4C4A-96BD-EFB2E713364F}

[ Port Based Pattern Matching Memory ]

+-[AC-BNFA Search Info Summary]------------------------------

| Instances        : 174

| Patterns         : 10404

| Pattern Chars    : 89504

| Num States       : 46595

| Num Match States : 6741

| Memory           :   1.32Mbytes

|   Patterns       :   0.28M

|   Match Lists    :   0.31M

|   Transitions    :   0.69M

+-------------------------------------------------

[ Port and Service Based Pattern Matching Memory ]

+-[AC-BNFA Search Info Summary]------------------------------

| Instances        : 174

| Patterns         : 10404

| Pattern Chars    : 89504

| Num States       : 46595

| Num Match States : 6741

| Memory           :   1.32Mbytes

|   Patterns       :   0.28M

|   Match Lists    :   0.31M

|   Transitions    :   0.69M

+-------------------------------------------------

 

        --== Initialization Complete ==--

 

   ,,_     -*> Snort! <*-

  o"  )~   Version 2.8.2-ODBC-MySQL-FlexRESP-WIN32 GRE (Build 13)

   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html

           (C) Copyright 1998-2008 Sourcefire Inc., et al.

           Using PCRE version: 7.4 2007-09-21

 

           Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 1.8  

           Preprocessor Object: SF_SSLPP  Version 1.0  

           Preprocessor Object: SF_SSH  Version 1.1  

           Preprocessor Object: SF_SMTP  Version 1.1  

           Preprocessor Object: SF_FTPTELNET  Version 1.1  

           Preprocessor Object: SF_DNS  Version 1.1  

           Preprocessor Object: SF_DCERPC  Version 1.1  

Not Using PCAP_FRAMES

*** Caught Int-Signal

Run time prior to being shutdown was 152.920000 seconds

===============================================================================

Packet Wire Totals:

   Received:        34575

   Analyzed:        34575 (100.000%)

    Dropped:            0 (0.000%)

Outstanding:            0 (0.000%)

===============================================================================

Breakdown by protocol (includes rebuilt packets):

      ETH: 34576      (100.000%)

  ETHdisc: 0          (0.000%)

     VLAN: 0          (0.000%)

     IPV6: 109        (0.315%)

  IP6 EXT: 0          (0.000%)

  IP6opts: 0          (0.000%)

  IP6disc: 0          (0.000%)

      IP4: 34457      (99.656%)

  IP4disc: 0          (0.000%)

    TCP 6: 0          (0.000%)

    UDP 6: 0          (0.000%)

    ICMP6: 0          (0.000%)

  ICMP-IP: 0          (0.000%)

      TCP: 34261      (99.089%)

      UDP: 43         (0.124%)

     ICMP: 147        (0.425%)

  TCPdisc: 0          (0.000%)

  UDPdisc: 0          (0.000%)

  ICMPdis: 0          (0.000%)

     FRAG: 0          (0.000%)

   FRAG 6: 0          (0.000%)

      ARP: 10         (0.029%)

    EAPOL: 0          (0.000%)

  ETHLOOP: 0          (0.000%)

      IPX: 0          (0.000%)

IPv4/IPv4: 0          (0.000%)

IPv4/IPv6: 0          (0.000%)

IPv6/IPv4: 0          (0.000%)

IPv6/IPv6: 0          (0.000%)

      GRE: 0          (0.000%)

  GRE ETH: 0          (0.000%)

 GRE VLAN: 0          (0.000%)

 GRE IPv4: 0          (0.000%)

 GRE IPv6: 0          (0.000%)

GRE IP6 E: 0          (0.000%)

 GRE PPTP: 0          (0.000%)

  GRE ARP: 0          (0.000%)

  GRE IPX: 0          (0.000%)

 GRE LOOP: 0          (0.000%)

    OTHER: 5          (0.014%)

  DISCARD: 0          (0.000%)

InvChkSum: 1758       (5.084%)

   S5 G 1: 0          (0.000%)

   S5 G 2: 1          (0.003%)

    Total: 34576

===============================================================================

Action Stats:

ALERTS: 8

LOGGED: 8

PASSED: 0

===============================================================================

Attribute Table Stats:

    Number Entries: 0

    Table Reloaded: 0

===============================================================================

Frag3 statistics:

        Total Fragments: 0

      Frags Reassembled: 0

               Discards: 0

          Memory Faults: 0

               Timeouts: 0

               Overlaps: 0

              Anomalies: 0

                 Alerts: 0

     FragTrackers Added: 0

    FragTrackers Dumped: 0

FragTrackers Auto Freed: 0

    Frag Nodes Inserted: 0

     Frag Nodes Deleted: 0

===============================================================================

Stream5 statistics:

            Total sessions: 113

              TCP sessions: 113

              UDP sessions: 0

             ICMP sessions: 0

                TCP Prunes: 0

                UDP Prunes: 0

               ICMP Prunes: 0

TCP StreamTrackers Created: 133

TCP StreamTrackers Deleted: 133

              TCP Timeouts: 1

              TCP Overlaps: 0

       TCP Segments Queued: 7

     TCP Segments Released: 7

       TCP Rebuilt Packets: 4

         TCP Segments Used: 7

              TCP Discards: 204

      UDP Sessions Created: 0

      UDP Sessions Deleted: 0

              UDP Timeouts: 0

              UDP Discards: 0

                    Events: 0

===============================================================================

HTTP Inspect - encodings (Note: stream-reassembled packets included):

    POST methods:                   0

    GET methods:                    18

    Post parameters extracted:      0

    Unicode:                        0

    Double unicode:                 0

    Non-ASCII representable:        0

    Base 36:                        0

    Directory traversals:           0

    Extra slashes ("//"):           0

    Self-referencing paths ("./"):  0

    Total packets processed:        21568

===============================================================================

SSL Preprocessor:

   SSL packets decoded: 54

         Alert records: 1

   Application records: 0

 Change cipher records: 1

  Unrecognized records: 39

     Handshake records: 5

  Completed handshakes: 0

        Bad handshakes: 0

      Sessions ignored: 0

    Detection disabled: 0

===============================================================================

Snort exiting

 

 

打开log文件夹，可以看到：

打开alert文件：

snort的讲解就到这里，感谢阅读，喜欢的可以关注哦，欢迎评论～