不多说，直接上干货！

　　snort的规则啊，是基于文本的，它通常存在于snort程序目录中或者子目录中，规则文件按照不同的组，进行分类存放的。

　　snort的安装目录

[root@datatest snort]# pwd

/etc/snort

[root@datatest snort]# ll

total

-rw-r--r--.  root root     Aug   : barnyard2.conf

-rw-r--r--.  root root     Aug   : classification.config

drwxr-xr-x.        Jan    etc

-rw-r--r--.  root root    Aug   : gen-msg.map

drwxr-xr-x.        Jan    preproc_rules

-rw-r--r--.  root root      Aug   : reference.config

drwxr-xr-x.        Aug   : rules

-rw-r--r--.  root root  Aug   : sid-msg.map

-rw-r--r--.  root root    Aug   : snort.conf

drwxr-xr-x.        Jan    so_rules

-rw-r--r--.  root root     Aug   : threshold.conf

-rw-r--r--.  root root   Aug   : unicode.map

[root@datatest snort]#

　　/etc/snort/rules

[root@datatest rules]# pwd

/etc/snort/rules

[root@datatest rules]# ls

app-detect.rules        dos.rules              indicator-compromise.rules   os-other.rules           protocol-nntp.rules      server-apache.rules     voip.rules

attack-responses.rules  experimental.rules     indicator-obfuscation.rules  os-solaris.rules         protocol-other.rules     server-iis.rules        VRT-License.txt

backdoor.rules          exploit-kit.rules      indicator-scan.rules         os-windows.rules         protocol-pop.rules       server-mail.rules       web-activex.rules

bad-traffic.rules       exploit.rules          indicator-shellcode.rules    other-ids.rules          protocol-rpc.rules       server-mssql.rules      web-attacks.rules

black_list.rules        file-executable.rules  info.rules                   p2p.rules                protocol-scada.rules     server-mysql.rules      web-cgi.rules

blacklist.rules         file-flash.rules       local.rules                  phishing-spam.rules      protocol-services.rules  server-oracle.rules     web-client.rules

botnet-cnc.rules        file-identify.rules    malware-backdoor.rules       policy-multimedia.rules  protocol-snmp.rules      server-other.rules      web-coldfusion.rules

browser-chrome.rules    file-image.rules       malware-cnc.rules            policy-other.rules       protocol-telnet.rules    server-samba.rules      web-frontpage.rules

browser-firefox.rules   file-java.rules        malware-other.rules          policy.rules             protocol-tftp.rules      server-webapp.rules     web-iis.rules

browser-ie.rules        file-multimedia.rules  malware-tools.rules          policy-social.rules      protocol-voip.rules      shellcode.rules         web-misc.rules

browser-other.rules     file-office.rules      misc.rules                   policy-spam.rules        pua-adware.rules         smtp.rules              web-php.rules

browser-plugins.rules   file-other.rules       multimedia.rules             pop2.rules               pua-other.rules          snmp.rules              white_list.rules

browser-webkit.rules    file-pdf.rules         mysql.rules                  pop3.rules               pua-p2p.rules            specific-threats.rules  x11.rules

chat.rules              finger.rules           netbios.rules                protocol-dns.rules       pua-toolbars.rules       spyware-put.rules

content-replace.rules   ftp.rules              nntp.rules                   protocol-finger.rules    rpc.rules                sql.rules

ddos.rules              icmp-info.rules        oracle.rules                 protocol-ftp.rules       rservices.rules          telnet.rules

deleted.rules           icmp.rules             os-linux.rules               protocol-icmp.rules      scada.rules              tftp.rules

dns.rules               imap.rules             os-mobile.rules              protocol-imap.rules      scan.rules               virus.rules

[root@datatest rules]#

　　比如，文件ftp.rules所包含了FTP攻击内容。

　　在启动的时候，snort会读取所有的规则文件，并且建立一个三维的链表。

　　/etc/snort/so_rules

[root@datatest so_rules]# pwd

/etc/snort/so_rules

[root@datatest so_rules]# ls

browser-ie.rules     file-java.rules        indicator-shellcode.rules  os-other.rules       protocol-nntp.rules   pua-p2p.rules        server-oracle.rules

browser-other.rules  file-multimedia.rules  malware-cnc.rules          os-windows.rules     protocol-other.rules  server-apache.rules  server-other.rules

exploit-kit.rules    file-office.rules      malware-other.rules        policy-social.rules  protocol-snmp.rules   server-iis.rules     server-webapp.rules

file-flash.rules     file-other.rules       netbios.rules              precompiled          protocol-tftp.rules   server-mail.rules    src

file-image.rules     file-pdf.rules         os-linux.rules             protocol-dns.rules   protocol-voip.rules   server-mysql.rules

[root@datatest so_rules]#

最新文章

  1. android Can't bind to local 86XX for debugger
  2. POJ2104 K-th Number[主席树]【学习笔记】
  3. Linux json解析jq
  4. 自动化部署教程(一) redhat安装jenkins
  5. Windows下Nginx+Mysql+Php(wnmp)环境搭建
  6. 【java】[转]标记接口和标记注解注解
  7. 在php中需要用到的mysql数据库的简单操作
  8. ManagementFactory （一） getClassLoadingMXBean
  9. jquery判断表单提交是否为空
  10. 从零開始开发Android版2048 （四） 分数、重置、结束
  11. 【Unity 3D】学习笔记三十五：游戏实例——摄像机切换镜头
  12. java 集合大家族
  13. Gist - ES6 Promise
  14. linkin大话设计模式--观察者模式
  15. linux下 mysql5.7.20安装（精华）
  16. Errors occurred during the build. Errors running builder 'JavaScript Validator' on project '项目名'.
  17. C#动态操作DataTable(新增行、列、查询行、列等)
  18. Android屏幕适配框架-(今日头条终极适配方案)
  19. 01-HTML介绍
  20. [POI2011]Śmieci

热门文章

  1. Codeforces 344B Simple Molecules
  2. Windows server 2003 + IIS6 搭建Asp.net MVC执行环境
  3. ZrcListView
  4. 不同节点 IP 时间同步 分布式时间同步系统的参考时间获取技术分析
  5. CXF+Spring+Tomcat 案例
  6. Facebook Flux 分析
  7. Error: Target id 'android-5' is not valid. Use 'android list targets' to get the target ids.
  8. I.MX6Q MfgTool2 ucl2.xml eMMC
  9. UVA11722概率问题之线性规划
  10. Java并发思考