snort3安装教程

系统：ubuntu14.04.1
系统：centos7

一、安装前准备

ubuntu

apt-get autoremove cmake
tar xf cmake-3.12.0.tar.gz && cd cmake-3.12.0
./configure && make && make install
cmake -version
apt install zlib1g libpcre3 libdnet tcpdump libpcap-dev libdumbnet-dev hwloc libhwloc-dev libluajit-5.1-dev -y

centos

默认版本就是cmake 3.12.0，无需卸载重装

yum install libdnet-devel hwloc-devel openssl-devel zlib-devel pkgconfig luajit-devel pcre-devel libpcap-devel libnfnetlink-devel libnetfilter_queue-devel -y
sudo autoreconf -ivf

二、安装daq

tar xf daq-2.2.2.tar.gz && daq-2.2.2
./configure && make && make install && ldconfig

三、安装可选依赖

省略

四、安装snort

进入snort源码目录

cd /home/snort3 && ./configure_cmake.sh --prefix=/home/snort 
cd /home/snort3/build && make -j8 && make install

报错：lua_wrap.sh的permission denied，去修改该文件夹下所有文件权限为可执行

chmod 775 snort3/src/managers/*  
chmod 775 snort3/doc/scripts/*  

五、使用snort

在官网下载snort规则库：

https://www.snort.org/downloads/snortplus/snort3-3.0.3-1.tar.gz

解压到当前目录

tar -xvf snort3-3.0.3-1.tar.gz -C /home/snortrules

在snort.lua中修改输出模块，如

alert_full = { 
    file = true
}

使用规则库中的配置文件即可

/home/snort--daq pcap -c /home/snortrules/etc/snort.lua -l /home/bob/

六、卸载

cd /home/snort/build && make uninstall && make distclean
cd /home/daq-2.2.2 && make uninstall && make distclean