Taller de Sistemas de detección de intrusiones SNORT - Snort en linea de comandos

Introducción

Ya adelantamos algo sobre usar Snort en línea de comando en el capítulo I de esta serie. Ahora nos adentraremos en el uso de Snort de esta forma, abandonando por completo IDSCenter y cualquier GUI intermedia.

Aprenderemos también a configurar:

• Reglas
• Preprocesadores
• y otras opciones

desde el archivo de configuaciones de snort: snort.conf.

Todos los ejemplos, mientras no se indique lo contrario, serán válidos para win32 y Linux / UNIX.

C:\Snort20\bin>snort

-*> Snort! <*-

Version 2.0.0-ODBC-MySQL-FlexRESP-WIN32 (Build 72)

By Martin Roesch (roesch@sourcefire.com, www.snort.org)

1.7-WIN32 Port By Michael Davis (mike@datanerds.net, www.datanerds.net/~mike)

1.8 - 2.0 WIN32 Port By Chris Reid (chris.reid@codecraftconsultants.com)

USAGE: snort [-options] <filter options>

snort /SERVICE /INSTALL [-options] <filter options>

snort /SERVICE /UNINSTALL

snort /SERVICE /SHOW

Options:

-A Set alert mode: fast, full, console, or none (alert file alerts only)

-b Log packets in tcpdump format (much faster!)

-c <rules> Use Rules File <rules>

-C Print out payloads with character data only (no hex)

-d Dump the Application Layer

-e Display the second layer header info

-E Log alert messages to NT Eventlog. (Win32 only)

-f Turn off fflush() calls after binary log writes

-F <bpf> Read BPF filters from file <bpf>

-h <hn> Home network = <hn>

-i <if> Listen on interface <if>

-I Add Interface name to alert output

-k <mode> Checksum mode (all,noip,notcp,noudp,noicmp,none)

-l <ld> Log to directory <ld>

-L <file> Log to this tcpdump file

-n <cnt> Exit after receiving <cnt> packets

-N Turn off logging (alerts still work)

-o Change the rule testing order to Pass|Alert|Log

-O Obfuscate the logged IP addresses

-p Disable promiscuous mode sniffing

-P <snap> Set explicit snaplen of packet (default: 1514)

-q Quiet. Don't show banner and status report

-r <tf> Read and process tcpdump file <tf>

-R <id> Include 'id' in snort_intf<id>.pid file name

-s Log alert messages to syslog

-S <n=v> Set rules file variable n equal to value v

-T Test and report on the current Snort configuration

-U Use UTC for timestamps

-v Be verbose

-V Show version number

-W Lists available interfaces. (Win32 only)

-w Dump 802.11 management and control frames

-X Dump the raw packet data starting at the link layer

-y Include year in timestamp in the alert and log files

-z Set assurance mode, match on established sesions (for TCP)

-? Show this information

<Filter Options> are standard BPF options, as seen in TCPDump

Uh, you need to tell me to do something...

: No such file or directory