[DPI][suricata] suricata 配置使用
至此, 我们已经拥有了suricata可以运行的环境了.
接下来,我们来研究一下它的功能, 首先,分析一下配置文件:
/suricata/etc/suricata/suricata.yaml
可以结合着默认配置文件的内容,同时读它的描述文档: http://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html
这样更好理解.
快速浏览一遍配置之后, 基本上也就了解了suricata的主要功能. 配置项很丰富, 能力也很强大, 最简单快速的可以提供一个主管感受的方法,就是先打开http记录功能.
然后重启,会发现, 多个一个日志文件 /suricata/var/log/suricata/http.log
然后试着访问一个网页,
[root@suricata ~]# wget -q www.baidu.com
[root@suricata ~]#
该日志中,便记录下了这条http访问日志:
[root@suricata suricata]# cat /suricata/var/log/suricata/http.log
//-::02.035401 www.baidu.com[**]/[**]Wget/1.14 (linux-gnu)[**]192.168.7.8: -> 61.135.169.125:
//-::05.893547 www.baidu.com[**]/[**]Wget/1.14 (linux-gnu)[**]192.168.7.8: -> 61.135.169.121:
[root@suricata suricata]#
其他高级用法,可以结合文档, 尝试着进行修改测试, 慢慢熟悉.
另外, suricata有非常多的运行模式, 详见文档, 不做赘述
[root@suricata ~]# /suricata/usr/bin/suricata --list-runmodes
------------------------------------- Runmodes ------------------------------------------
| RunMode Type | Custom Mode | Description
|----------------------------------------------------------------------------------------
| PCAP_DEV | single | Single threaded pcap live mode
| ---------------------------------------------------------------------
| | autofp | Multi threaded pcap live mode. Packets from each flow are assigned to a single detect thread, unlike "pcap_live_auto" where packets from the same flow can be processed by any detect thread
| ---------------------------------------------------------------------
| | workers | Workers pcap live mode, each thread does all tasks from acquisition to logging
|----------------------------------------------------------------------------------------
| PCAP_FILE | single | Single threaded pcap file mode
| ---------------------------------------------------------------------
| | autofp | Multi threaded pcap file mode. Packets from each flow are assigned to a single detect thread, unlike "pcap-file-auto" where packets from the same flow can be processed by any detect thread
|----------------------------------------------------------------------------------------
| PFRING(DISABLED) | autofp | Multi threaded pfring mode. Packets from each flow are assigned to a single detect thread, unlike "pfring_auto" where packets from the same flow can be processed by any detect thread
| ---------------------------------------------------------------------
| | single | Single threaded pfring mode
| ---------------------------------------------------------------------
| | workers | Workers pfring mode, each thread does all tasks from acquisition to logging
|----------------------------------------------------------------------------------------
| NFQ | autofp | Multi threaded NFQ IPS mode with respect to flow
| ---------------------------------------------------------------------
| | workers | Multi queue NFQ IPS mode with one thread per queue
|----------------------------------------------------------------------------------------
| NFLOG | autofp | Multi threaded nflog mode
| ---------------------------------------------------------------------
| | single | Single threaded nflog mode
| ---------------------------------------------------------------------
| | workers | Workers nflog mode
|----------------------------------------------------------------------------------------
| IPFW | autofp | Multi threaded IPFW IPS mode with respect to flow
| ---------------------------------------------------------------------
| | workers | Multi queue IPFW IPS mode with one thread per queue
|----------------------------------------------------------------------------------------
| ERF_FILE | single | Single threaded ERF file mode
| ---------------------------------------------------------------------
| | autofp | Multi threaded ERF file mode. Packets from each flow are assigned to a single detect thread
|----------------------------------------------------------------------------------------
| ERF_DAG | autofp | Multi threaded DAG mode. Packets from each flow are assigned to a single detect thread, unlike "dag_auto" where packets from the same flow can be processed by any detect thread
| ---------------------------------------------------------------------
| | single | Singled threaded DAG mode
| ---------------------------------------------------------------------
| | workers | Workers DAG mode, each thread does all tasks from acquisition to logging
|----------------------------------------------------------------------------------------
| AF_PACKET_DEV | single | Single threaded af-packet mode
| ---------------------------------------------------------------------
| | workers | Workers af-packet mode, each thread does all tasks from acquisition to logging
| ---------------------------------------------------------------------
| | autofp | Multi socket AF_PACKET mode. Packets from each flow are assigned to a single detect thread.
|----------------------------------------------------------------------------------------
| NETMAP(DISABLED) | single | Single threaded netmap mode
| ---------------------------------------------------------------------
| | workers | Workers netmap mode, each thread does all tasks from acquisition to logging
| ---------------------------------------------------------------------
| | autofp | Multi threaded netmap mode. Packets from each flow are assigned to a single detect thread.
|----------------------------------------------------------------------------------------
[root@suricata ~]#
Detection-engine部分对规则引擎相关部分的讲解,值得详细的读一下, 可以帮助理解规则组织结构的内部实现.
http://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html#detection-engine
做一个自定义规则的配置测试:
修改配置文件,增加一个规则文件 my.rules
[root@suricata suricata]# grep -A rule-files suricata.yaml
rule-files:
- my.rules
[root@suricata suricata]# cat rules/my.rules
alert tcp any any -> any 80 (msg: "http test";)
[root@suricata suricata]#
重启suricata之后,做一条http访问, 将能在fast.log中,看见这条规则被命中.
[root@suricata suricata]# tailf /suricata/var/log/suricata/fast.log
//-::48.265375 [**] [::] http test [**] [Classification: (null)] [Priority: ] {TCP} 192.168.7.8: -> 66.102.251.33:
至此,基本前期准备已经完成, 接下来就是去读源码了.....
题外: 装个splunk看一下, 结合suricata做分析,看一下.
安装手册: http://docs.splunk.com/Documentation/SplunkLight/7.0.2/Installation/InstallonLinux
说起了很简单,只有三步
To follow these installation instructions, replace splunk_package_name.tgz with the name of the installer package you downloaded. . Move the .tgz file to the directory you want to install Splunk Light. For example, to install it into /opt/splunk, use: mv splunk_package_name.tgz /opt/splunk
. In the installation directory, use the tar command to expand the file. tar xvzf splunk_package_name.tgz
. Start Splunk Light. splunk start --accept-license
登录: http://suricata:8000
配置也很简单,都是图像化操作, data input设置成 fast.log就好了.
然后,就是酱紫:
我想说, 这不就是个日志分析工具么?
我更喜欢,grep+sed+bash+awk --!!!!
[DPI][suricata] suricata 配置使用的更多相关文章
- Suricata规则配置
Suricata 规则配置 IDS/IPS/WAF IPS.IDS和WAF分别是入侵防御系统和入侵检测系统以及WEB应用防火墙的简称,很多人说这些玩意不就是盒子吗已经过时了,其实不是,SIEM其实是有 ...
- [development][security][suricata] suricata 使用与调研
0: OISF:https://oisf.net/ 1: suricata是什么 https://suricata-ids.org/ 2:安装 https://redmine.openinfosecf ...
- Suricata的配置
见官网 https://suricata.readthedocs.io/en/latest/configuration/index.html# Docs » 8. Configuration Edit ...
- [DPI][suricata] suricata-4.0.3 安装部署
suricata 很值得借鉴.但是首先还是要安装使用,作为第一步的熟悉. 安装文档:https://redmine.openinfosecfoundation.org/projects/suricat ...
- 配置suricata
yum -y install libpcap libpcap-devel libnet libnet-devel pcre \ pcre-devel gcc gcc-c++ automake auto ...
- Suricata开源IDS安装与配置
开源IDS Suricata安装 Linux下的依赖问题的解决 在Debian,Ubuntu或者Linux Mint系列 $ sudo apt-get install wget build-essen ...
- Suricata 之IPS模式
IPS 1.Suricata 本身是不具有拦截功能的,想要让它拦截包需要配合 iptables 使用. 首先要确定安装的suricata是否支持IPS模式,如果在安装编译的时候没有启用IPS模式,NF ...
- 构建基于Suricata+Splunk的IDS入侵检测系统
一.什么是IDS和IPS? IDS(Intrusion Detection Systems):入侵检测系统,是一种网络安全设备或应用软件,可以依照一定的安全策略,对网络.系统的运行状况进行监视,尽可能 ...
- Suricata在ubuntu14.04环境下安装
简介 Suricata是一款高性能的网络IDS.IPS和网络安全监控引擎.它是由the Open Information Security Foundation开发,是一款开源的系统,现在的NIDS领 ...
随机推荐
- 译: 4. RabbitMQ Spring AMQP 之 Routing 路由
在上一个教程中,我们构建了一个简单的fanout(扇出)交换.我们能够向许多接收者广播消息. 在本教程中,我们将为其添加一个功能 - 我们将只能订阅一部分消息.例如,我们将只能将消息指向感兴趣的特定颜 ...
- slf4j-api、slf4j-log4j12、log4j之间关系
1. slf4j-api slf4j:Simple Logging Facade for Java,为java提供的简单日志Facade.Facade门面,更底层一点说就是接口.它允许用户以自己的喜好 ...
- GSSAPIAuthentication=no
GSSAPI ( Generic Security Services Application Programming Interface) 是一套类似Kerberos 5的通用网络安全系统接口.该接口 ...
- rocketmq 源码
https://github.com/YunaiV/incubator-rocketmq
- 本地搭建Wooyun漏洞库环境
众所周知,wooyun上有太多含金量的漏洞了,虽然互联网上也有相关的漏洞资源分享,但是万一有朝一日也被和谐了就又麻烦了,最放心的方式就是漏洞库放在本地,在本地搭建一套环境最好不过了,以下操作演示了如何 ...
- Clustered Shading架构实现步骤
最终决定越过Forward+,一步到位,直接调整至更先进的Clustered架构.步骤如下: 里程碑1:以CPU方式实现Light Culling,旨在理念验证,并与D3D10兼容里程碑2:以GPU ...
- 编译错误 ld: cannot find -lz
[时间:2017-04] [状态:Open] [关键词:makefile,gcc,linux,ld,libz.so] 在新安装的centos上编译程序遇到上述问题,找了半天,原来是没有安装 需要安装z ...
- C++:重载全局new/delete实现跨平台多线程内存检测
Reference: https://blog.csdn.net/u014023615/article/details/39551191 Reference: https://blog.csdn.ne ...
- Node入门教程(9)第七章:NodeJs的文件处理
Node的文件处理涉及到前面说的ptah模块,以及fs文件系统.stream流处理.Buffer缓冲器等模块.内容可能比较多,相关内容请以官网文档为主,此处主要以案例讲解为主,分享给大家一些常用的经典 ...
- left join、right join、inner join的区别
left join(左联接) 返回包括左表中的所有记录和右表中联结字段相等的记录 right join(右联接) 返回包括右表中的所有记录和左表中联结字段相等的记录inner join(等值连接) 只 ...