CentOS部署Snort
操作系统：CentOS6.3 x86_64
只需按照以下网址依次下载软件包，然后安装即可
需要安装的组件：
1.Libpcap：http://www.tcpdump.org/
wget http://www.tcpdump.org/release/libpcap-1.2.1.tar.gz
tar xvf libpcap-1.2.1.tar.gz
cd libpcap-1.2.1
./configure –prefix=/usr && make && make install
2.PCRE:http://www.pcre.org/
yum -y install pcre-devel.x86_64 pcre.x86_64
也可以使用源码安装
3.Libdnet:http://libdnet.sourceforge.net/
wget http://prdownloads.sourceforge.net/libdnet/libdnet-1.11.tar.gz?download
tar xvf libdnet-1.12.tgz
cd libdnet-1.12
./configure && make && make install
4.Barnyard2:http://www.securixlive.com/barnyard2/download.php
wget http://www.securixlive.com/download/barnyard2/barnyard2-1.9.tar.gz
tar xvf barnyard2-1.9.tar.gz
cd barnyard2-1.9
./configure && make && make install
5.DAQ：http://www.snort.org/snort-downloads
tar xvf daq-0.6.2.tar.gz
cd daq-0.6.2
./configure && make && make install
6.Snort安装：http://www.snort.org/snort-downloads
tar xvf snort-2.9.2.3.tar.gz
cd snort-2.9.2.3
./configure –prefix=/usr/local/snort && make && make install
7.安装过程中的一些问题
(1)：在安装snort时出错，按照上面第一步安装libpcap解决。
tar xvf snort-2.9.2.3.tar.gz
cd snort-2.9.2.3
./configure –prefix=/usr/local/snort
………
ERROR! Libpcap library/headers (libpcap.a (or .so)/pcap.h)
not found, go get it from http://www.tcpdump.org
or use the –with-libpcap-* options, if you have it installed
in unusual place. Also check if your libpcap depends on another
shared library that may be installed in an unusual place
使用rpm包安装libpcap是不行的，因为安装的daq需要libpcap版本大于1.0
[root@monitor snort-2.9.2.3]# yum list|grep -i Libpcap
libpcap.x86_64 14:0.9.4-15.el5 installed
libpcap.i386 14:0.9.4-15.el5 base
libpcap-devel.i386 14:0.9.4-15.el5 base
libpcap-devel.x86_64 14:0.9.4-15.el5 base
[root@monitor snort-2.9.2.3]# yum -y install libpcap-devel.x86_64
(2)：在安装snort时出错，按照上面第二步安装PCRE解决。
ERROR! Libpcre header not found.
Get it from http://www.pcre.org
[root@monitor snort-2.9.2.3]# yum list|grep -i pcre
pcre.x86_64 6.6-2.el5_1.7 installed
pcre.i386 6.6-6.el5_6.1 base
pcre.x86_64 6.6-6.el5_6.1 base
pcre-devel.i386 6.6-6.el5_6.1 base
pcre-devel.x86_64 6.6-6.el5_6.1 base
[root@monitor snort-2.9.2.3]# yum -y install pcre-devel.x86_64
(3):在安装snort时出错，按照上面第三步安装Libdnet解决。
ERROR! dnet header not found, go get it from
http://code.google.com/p/libdnet/ or use the –with-dnet-*
options, if you have it installed in an unusual place
(4)：在安装snort时出错，按照上面第五步安装DAQ解决。
./configure: line 15188: daq-modules-config: command not found
checking for daq_load_modules in -ldaq_static… no
ERROR! daq_static library not found, go get it from
http://www.snort.org/.
(5):在安装DAQ时出错，安装上面第一步正确安装Libpcap解决。
ERROR! Libpcap library version >= 1.0.0 not found.
Get it from http://www.tcpdump.org
安装Libpcap时，使用./configure默认安装到/usr/local目录下是不行的，总是出现以上错误(在编译DAQ时指定libpcap的路径也同样[./configure —with-libpcap-includes=/usr/local/include —with-libpcap-libraries=/usr/local/lib])，通过在编译时指定安装路径./configure –prefix=/usr解决。