coen252computerforensics-全文預(yù)覽
【正文】 ? Specifies offset of content ? Depth option ? Specifies how far into packet to search for content ? Nocase option ? Makes content searches case insensitive ? Regex Option ? Allows wildcards in content searches Snort Rules ? Rule Options ? Session Options ? Allows to capture TCP session. ? Rest Option ? Allows an automatic active response ? Tag Option ? Allows to dynamically capture additional packages after a rule triggers. 。 \ content: “|00 FA 00 FF|”。 icode: 3。 flags: A。 dsize: 1024。) Snort Rules ? Rule Options ? ID option ? 16bit value found in the IP header of each datagram. alert udp any any / 24 33000。) [**] Back Orifice [**] 05/1008:44: :60256 :31337 UDP TTL:41 TOS:0x0 ID:49951 Len: 8 Rule: Log: Snort Rules ? Rule Options ? Logto Option ? Specifies filename to which to log the activity. ? Allows to separate the annoyances from the truly dangerous. alert udp any any / 24 31335 \ (msg: “trinoo port”。 All rules are part of a revision process to limit false positives and detect new attacks. Snort Rules ? Activation: Alert and then turn on another dynamic rule. ? Dynamic: Log the traffic when called by the above activation rule. ? Pass: Ignore the traffic. ? Log: Log the traffic, but do not alert. Snort Rules ? TCP: TCP protocol, for example SMTP, HTTP, FTP ? UDP: For example DNS traffic ? ICMP: For example ping, traceroute. ? IP: For example IPSec, IGMP Snort Rules ? Content: Content checked by the Boyer Moore pattern matching algorithm. ? Flow: Link to the detection plugins. Using Snort ? Install with libcap / wincap. ? Move config / rule files to correct directory and alter them. ? Use Snort from the mandline. ? Snort can be used to sniff or to decode. Using Snort Sniffer Mode ? Runtime switches: ? v verbose ? d dump package payloads ? x dump entire package in hex ? a display arp packages //does not work on your version. ? e display link layer data ? snort dvae Using Snort Packet Logger Mode ? Tell snort to output packages to a log file. ? Command line options: ? l dump packages into log directory
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號-1