Windows XP下安装Snort.doc

Windows XP下安装：/docs/setup_guides/Snort%20Windows%20XP%20Guide.txt第1步 安装WinPCap第2步 安装Snort第3步 安装规则库/文件1） 在c:Snort下建立temp子目录2）register at Snort: /pub-bin/register.cgi下载规则文件snortrules-snapshot-2.8.tar.gz2） 把规则文件拷贝至C:snort目录下。3） 把C:snort目录下的规则文件snortrules-snapshot-2.8.tar.gz解压到当前目录下，覆盖原有文件和目录。解压过程：第4步 配置Snort1）备份配置文件 cmd 中 COPY c:snortetcsnort.conf C:snorttemp2)用 写字板 打开配置文件c:snortetcsnort.conf，进行修改（1）Change line 194 to read var RULE_PATH ./rules 改为：var RULE_PATH c:snortrules（2）Change lines 289-293 to read dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.sodynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_dns_preproc.sodynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.sodynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.sodynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.so改为：dynamicpreprocessor file c:snortlibsnort_dynamicpreprocessorsf_dcerpc.dll dynamicpreprocessor file c:snortlibsnort_dynamicpreprocessorsf_dns.dlldynamicpreprocessor file c:snortlibsnort_dynamicpreprocessorsf_ftptelnet.dlldynamicpreprocessor file c:snortlibsnort_dynamicpreprocessorsf_smtp.dlldynamicpreprocessor file c:snortlibsnort_dynamicpreprocessorsf_ssh.dll（3）Change line 312 to read dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so改为： dynamicengine c:snortlibsnort_dynamicenginesf_engine.dll（4）Change line 816 to read # output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT改为：output alert_syslog: host=:514, LOG_AUTH LOG_ALERT第5步 简单测试Snort1） 查看安装情况，Open a Command Prompt and run c:snortbinsnort -W2）Now run c:snortbinsnort -v -iX (replace X with your adapter number discovered from running the previous line) c:snortbinsnort v -i2 注意 -i和2之间没有空格，嗅探模式屏幕一直在滚动。有数据被捕获。4） 运行日志模式，使用bat批文件。SnortStart-l.batc:snortbinsnort -i2 -s -l c:snortlog -c c:snortetcsnort.conf5）运行OK标志6）做一个扫描，查看日志c:snortlog目录上的文件。第