{"id":18039,"date":"2013-09-08T10:13:30","date_gmt":"2013-09-08T02:13:30","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2013\/09\/08\/snort-rule-%e6%9b%b4%e6%96%b0\/"},"modified":"2021-03-18T17:23:43","modified_gmt":"2021-03-18T09:23:43","slug":"snort-rule-%e6%9b%b4%e6%96%b0","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2013\/09\/08\/snort-rule-%e6%9b%b4%e6%96%b0\/","title":{"rendered":"Snort Rule \u66f4\u65b0"},"content":{"rendered":"

\u539f\u672c\u7528\u4f86\u64d4\u4efb\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71\u7684\u4e3b\u6a5f\uff0c\u662f\u900f\u904e oinkmaster\u00a0\u4f86\u66f4\u65b0 Snort Rule\uff0c\u4e0d\u904e\u6700\u8fd1(\u5176\u5be6\u61c9\u8a72\u6709\u4e00\u6bb5\u6642\u9593\u4e86\uff0c\u53ea\u662f\u81ea\u5df1\u61f6\u60f0\uff0c\u6c92\u6709\u7a4d\u6975\u8655\u7406)\uff0c\u5e38\u5e38\u6703\u5728\u4fe1\u7bb1\u6536\u5230\u5982\u4e0b\u7684\u932f\u8aa4\u8a0a\u606f\uff1a<\/p>\n

\u00a0http:\/\/www.snort.org\/pub-bin\/oinkmaster.cgi\/*oinkcode*\/snortrules-snapshot-2860.tar.gzResolving www.snort.org… 23.23.143.164<\/span>
Connecting to www.snort.org|23.23.143.164|:80… connected.<\/span>
HTTP request sent, awaiting response… 403 Forbidden<\/span>
2013-09-07 23:30:03 ERROR 403: Forbidden.<\/span><\/p>\n

\u731c\u60f3\u53ef\u80fd\u662f Snort Rule\u00a0\u4e0b\u8f09\u7684\u8def\u5f91\u5df2\u7d93\u505a\u4e86\u66f4\u6539\uff0c\u6240\u4ee5\u767b\u5165 Snort\u00a0\u5b98\u65b9\u7db2\u7ad9<\/a>\uff0c\u7d42\u65bc\u627e\u5230\u4e86\u89e3\u6c7a\u65b9\u5f0f\uff1a[@more@]\"\"<\/a><\/p>\n

\u4fee\u6539 \/etc\/snort\/oinkmaster.conf(\u8def\u5f91\u53ef\u80fd\u6703\u4f9d\u5b89\u88dd\u7684\u65b9\u5f0f\u800c\u6709\u4e0d\u540c)
# vim \/etc\/snort\/oinkmaster.conf<\/span>
url = http:\/\/www.snort.org\/pub-bin\/oinkmaster.cgi\/<oinkcode here><\/span>\/snortrules-snapshot-2931.tar.gz<\/span><\/p>\n

\u7d05\u5b57<\/span>\u7684\u90e8\u5206\u5c31\u662f oinkcode\u00a0\u78bc<\/p>\n

\u9032\u884c\u6e2c\u8a66
# \/usr\/local\/bin\/oinkmaster.pl -C \/etc\/snort\/oinkmaster.conf -o \/etc\/snort\/rules\/<\/span>
Loading \/etc\/snort\/oinkmaster.conf<\/span>
Downloading file from http:\/\/www.snort.org\/pub-bin\/oinkmaster.cgi\/*oinkcode*\/snortrules-snapshot-2931.tar.gz…<\/span>
…<\/span>
…<\/span>
…<\/span>
\u00a0 -> protocol-ftp.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-icmp.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-imap.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-nntp.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-pop.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-rpc.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-scada.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-services.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-snmp.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-telnet.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-tftp.rules<\/span>
\u00a0\u00a0\u00a0 -> protocol-voip.rules<\/span>
\u00a0\u00a0\u00a0 -> pua-adware.rules<\/span>
\u00a0\u00a0\u00a0 -> pua-other.rules<\/span>
\u00a0\u00a0\u00a0 -> pua-p2p.rules<\/span>
\u00a0\u00a0\u00a0 -> pua-toolbars.rules<\/span>
\u00a0\u00a0\u00a0 -> server-apache.rules<\/span>
\u00a0\u00a0\u00a0 -> server-iis.rules<\/span>
\u00a0\u00a0\u00a0 -> server-mail.rules<\/span>
\u00a0\u00a0\u00a0 -> server-mssql.rules<\/span>
\u00a0\u00a0\u00a0 -> server-mysql.rules<\/span>
\u00a0\u00a0\u00a0 -> server-oracle.rules<\/span>
\u00a0\u00a0\u00a0 -> server-other.rules<\/span>
\u00a0\u00a0\u00a0 -> server-samba.rules<\/span>
\u00a0\u00a0\u00a0 -> server-webapp.rules<\/span><\/p>\n

OK\uff0c\u6536\u5de5\u4e86\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"

\u539f\u672c\u7528\u4f86\u64d4\u4efb\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71\u7684\u4e3b\u6a5f\uff0c\u662f\u900f\u904e oinkmaster\u00a0\u4f86\u66f4\u65b0 Snort Rule\uff0c\u4e0d\u904e\u6700\u8fd1(\u5176\u5be6\u61c9\u8a72 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008Snort Rule \u66f4\u65b0\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[146,107],"tags":[],"class_list":["post-18039","post","type-post","status-publish","format-standard","hentry","category-c-78491","category-c-72382"],"meta_key":{"_encloseme":["1"],"lt_post_id":["420881"],"_pingme":["1"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18039"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18039"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18039\/revisions"}],"predecessor-version":[{"id":19749,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18039\/revisions\/19749"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}