[DPI][suricata] suricata 配置使用

 

前文: [DPI] suricata-4.0.3 安装部署

 

至此, 我们已经拥有了suricata可以运行的环境了.

接下来,我们来研究一下它的功能, 首先,分析一下配置文件: 

/suricata/etc/suricata/suricata.yaml

可以结合着默认配置文件的内容,同时读它的描述文档: http://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html

这样更好理解.

快速浏览一遍配置之后, 基本上也就了解了suricata的主要功能. 配置项很丰富, 能力也很强大, 最简单快速的可以提供一个主管感受的方法,就是先打开http记录功能.

 

然后重启,会发现, 多个一个日志文件   /suricata/var/log/suricata/http.log

然后试着访问一个网页,

[root@suricata ~]# wget -q www.baidu.com
[root@suricata ~]# 

 

该日志中,便记录下了这条http访问日志:

[root@suricata suricata]# cat /suricata/var/log/suricata/http.log 
02/08/2018-10:23:02.035401 www.baidu.com[**]/[**]Wget/1.14 (linux-gnu)[**]192.168.7.8:40578 -> 61.135.169.125:80
02/08/2018-10:23:05.893547 www.baidu.com[**]/[**]Wget/1.14 (linux-gnu)[**]192.168.7.8:38082 -> 61.135.169.121:80
[root@suricata suricata]# 

 

其他高级用法,可以结合文档, 尝试着进行修改测试, 慢慢熟悉.

 

另外, suricata有非常多的运行模式, 详见文档, 不做赘述

[root@suricata ~]# /suricata/usr/bin/suricata --list-runmodes                                                                                                                                
------------------------------------- Runmodes ------------------------------------------                                                                                                    
| RunMode Type      | Custom Mode       | Description                                                                                                                                        
|----------------------------------------------------------------------------------------                                                                                                    
| PCAP_DEV          | single            | Single threaded pcap live mode                                                                                                                     
|                   ---------------------------------------------------------------------                                                                                                    
|                   | autofp            | Multi threaded pcap live mode.  Packets from each flow are assigned to a single detect thread, unlike "pcap_live_auto" where packets from the same flow can be processed by any detect thread                                                                                                                                                   
|                   ---------------------------------------------------------------------                                                                                                    
|                   | workers           | Workers pcap live mode, each thread does all tasks from acquisition to logging                                                                     
|----------------------------------------------------------------------------------------                                                                                                    
| PCAP_FILE         | single            | Single threaded pcap file mode                                                                                                                     
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi threaded pcap file mode.  Packets from each flow are assigned to a single detect thread, unlike "pcap-file-auto" where packets from the same flow can be processed by any detect thread 
|----------------------------------------------------------------------------------------
| PFRING(DISABLED)  | autofp            | Multi threaded pfring mode.  Packets from each flow are assigned to a single detect thread, unlike "pfring_auto" where packets from the same flow can be processed by any detect thread 
|                   ---------------------------------------------------------------------
|                   | single            | Single threaded pfring mode 
|                   ---------------------------------------------------------------------
|                   | workers           | Workers pfring mode, each thread does all tasks from acquisition to logging 
|----------------------------------------------------------------------------------------
| NFQ               | autofp            | Multi threaded NFQ IPS mode with respect to flow 
|                   ---------------------------------------------------------------------
|                   | workers           | Multi queue NFQ IPS mode with one thread per queue 
|----------------------------------------------------------------------------------------
| NFLOG             | autofp            | Multi threaded nflog mode   
|                   ---------------------------------------------------------------------
|                   | single            | Single threaded nflog mode  
|                   ---------------------------------------------------------------------
|                   | workers           | Workers nflog mode          
|----------------------------------------------------------------------------------------
| IPFW              | autofp            | Multi threaded IPFW IPS mode with respect to flow 
|                   ---------------------------------------------------------------------
|                   | workers           | Multi queue IPFW IPS mode with one thread per queue 
|----------------------------------------------------------------------------------------
| ERF_FILE          | single            | Single threaded ERF file mode 
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi threaded ERF file mode.  Packets from each flow are assigned to a single detect thread 
|----------------------------------------------------------------------------------------
| ERF_DAG           | autofp            | Multi threaded DAG mode.  Packets from each flow are assigned to a single detect thread, unlike "dag_auto" where packets from the same flow can be processed by any detect thread 
|                   ---------------------------------------------------------------------
|                   | single            | Singled threaded DAG mode   
|                   ---------------------------------------------------------------------
|                   | workers           | Workers DAG mode, each thread does all  tasks from acquisition to logging 
|----------------------------------------------------------------------------------------
| AF_PACKET_DEV     | single            | Single threaded af-packet mode 
|                   ---------------------------------------------------------------------
|                   | workers           | Workers af-packet mode, each thread does all tasks from acquisition to logging 
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi socket AF_PACKET mode.  Packets from each flow are assigned to a single detect thread. 
|----------------------------------------------------------------------------------------
| NETMAP(DISABLED)  | single            | Single threaded netmap mode 
|                   ---------------------------------------------------------------------
|                   | workers           | Workers netmap mode, each thread does all tasks from acquisition to logging 
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi threaded netmap mode.  Packets from each flow are assigned to a single detect thread. 
|----------------------------------------------------------------------------------------
[root@suricata ~]# 

 

Detection-engine部分对规则引擎相关部分的讲解,值得详细的读一下, 可以帮助理解规则组织结构的内部实现.

http://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html#detection-engine

 

做一个自定义规则的配置测试:

修改配置文件,增加一个规则文件 my.rules

[root@suricata suricata]# grep -A 1 rule-files suricata.yaml 
rule-files:
 - my.rules
[root@suricata suricata]# cat rules/my.rules  
alert tcp any any -> any 80 (msg: "http test";)
[root@suricata suricata]# 

 

重启suricata之后,做一条http访问, 将能在fast.log中,看见这条规则被命中.

[root@suricata suricata]# tailf /suricata/var/log/suricata/fast.log 
02/08/2018-15:48:48.265375  [**] [1:0:0] http test [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.7.8:38274 -> 66.102.251.33:80

 

至此,基本前期准备已经完成, 接下来就是去读源码了.....

 

题外: 装个splunk看一下, 结合suricata做分析,看一下.

安装手册: http://docs.splunk.com/Documentation/SplunkLight/7.0.2/Installation/InstallonLinux

说起了很简单,只有三步

To follow these installation instructions, replace splunk_package_name.tgz with the name of the installer package you downloaded.

1. Move the .tgz file to the directory you want to install Splunk Light.

For example, to install it into /opt/splunk, use:

 mv splunk_package_name.tgz /opt/splunk
2. In the installation directory, use the tar command to expand the file.

 tar xvzf splunk_package_name.tgz
3. Start Splunk Light.

 splunk start --accept-license

 

登录: http://suricata:8000

配置也很简单,都是图像化操作, data input设置成 fast.log就好了.

然后,就是酱紫:

 

我想说, 这不就是个日志分析工具么?

我更喜欢,grep+sed+bash+awk  --!!!! 

 

转载于:https://www.cnblogs.com/hugetong/p/8430158.html