0

我最近安装了 Snort，根据我使用的视频，它应该开始检测数据包。问题是即使没有错误也不是。它看起来像这样：

Decoding Ethernet

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.16-WIN64 GRE (Build 118)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
           Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using PCRE version: 8.10 2010-06-25
           Using ZLIB version: 1.2.11

           Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 3.1  <Build 1>
           Preprocessor Object: SF_SSLPP  Version 1.1  <Build 4>
           Preprocessor Object: SF_SSH  Version 1.1  <Build 3>
           Preprocessor Object: SF_SMTP  Version 1.1  <Build 9>
           Preprocessor Object: SF_SIP  Version 1.1  <Build 1>
           Preprocessor Object: SF_SDF  Version 1.1  <Build 1>
           Preprocessor Object: SF_REPUTATION  Version 1.1  <Build 1>
           Preprocessor Object: SF_POP  Version 1.0  <Build 1>
           Preprocessor Object: SF_MODBUS  Version 1.1  <Build 1>
           Preprocessor Object: SF_IMAP  Version 1.0  <Build 1>
           Preprocessor Object: SF_GTP  Version 1.1  <Build 1>
           Preprocessor Object: SF_FTPTELNET  Version 1.2  <Build 13>
           Preprocessor Object: SF_DNS  Version 1.1  <Build 4>
           Preprocessor Object: SF_DNP3  Version 1.1  <Build 1>
           Preprocessor Object: SF_DCERPC2  Version 1.0  <Build 3>
Commencing packet processing (pid=16400)

但没有其他任何东西出现。我目前在 local.rules 文件中的规则是

alert icmp any any -> any any (msg:"Testing ICMP alert"; sid:1000001;)
alert udp any any -> any any (msg:"Testing UDP alert"; sid:1000002;)
alert tcp any any -> any any (msg:"Testing TCP alert"; sid:1000003;)

我目前也在使用 Windows 10，这没有帮助，因为很多人提出了与此类似的问题，都使用了 VM。将不胜感激一些帮助。

4

1 回答 1

0

我认为您正在尝试这样的命令：

snort –i3 -c c:\Snort\etc\snort.conf -A console

其中“3”是您正在嗅探的接口的编号。尝试更改您在命令中嗅探的接口的编号，直到您得到一些东西。

您可以通过键入以下内容查看您有多少接口：

snort -W
于 2021-02-10T17:54:36.473 回答