Difference between revisions of "SNORT: packet logger mode"
Onnowpurbo (talk | contribs) |
Onnowpurbo (talk | contribs) |
||
| Line 12: | Line 12: | ||
snort -dev -l /var/log/snort -h 192.168.0.0/24 | snort -dev -l /var/log/snort -h 192.168.0.0/24 | ||
| − | + | Perintah ini memberitahu Snort bahwa anda ingin mencetak data link dan TCP/IP header serta data aplikasi ke dalam direktori /var/log/snort, dan anda ingin log paket relatif terhadap jaringan kelas C 192.168.1.0. Semua paket yang masuk akan disimpan ke subdirektori dari direktori log, dengan nama direktori yang berbasis pada alamat remote host (non-192.168.1). | |
| − | + | Catatan: | |
| − | + | Perhatikan bahwa jika kedua sumber dan tujuan host di jaringan lokal yang sama, mereka akan di catat ke direktori dengan nama berdasarkan nomor port yang lebih tinggi lebih dulu, jika sama, maka digunakan alamat sumber. | |
| − | + | Jika anda berada di jaringan kecepatan tinggi atau Anda ingin log paket ke bentuk yang lebih kompak untuk analisis nanti, anda harus mempertimbangkan logging dalam mode biner. Log paket dalam mode biner dalam format tcpdump ke file biner tunggal dalam direktori logging: | |
| − | + | snort -l /var/log/snort -b | |
Note the command line changes here. We don't need to specify a home network any longer because binary mode logs everything into a single file, which eliminates the need to tell it how to format the output directory structure. Additionally, you don't need to run in verbose mode or specify the -d or -e switches because in binary mode the entire packet is logged, not just sections of it. All you really need to do to place Snort into logger mode is to specify a logging directory at the command line using the -l switch--the -b binary logging switch merely provides a modifier that tells Snort to log the packets in something other than the default output format of plain ASCII text. | Note the command line changes here. We don't need to specify a home network any longer because binary mode logs everything into a single file, which eliminates the need to tell it how to format the output directory structure. Additionally, you don't need to run in verbose mode or specify the -d or -e switches because in binary mode the entire packet is logged, not just sections of it. All you really need to do to place Snort into logger mode is to specify a logging directory at the command line using the -l switch--the -b binary logging switch merely provides a modifier that tells Snort to log the packets in something other than the default output format of plain ASCII text. | ||
Revision as of 02:56, 16 March 2017
SUmber: http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node5.html
Jika kita ingin merekam paket ke disk, kita perlu memberitahukan directory untuk menyimpan paket, maka snort akan langsugn switch ke packet logger mode,
snort -dev -l ./log snort -dev -l /var/log/snort
Ketika Snort berjalan dalam mode ini, ia mengumpulkan setiap paket yang dilihatnya dan menempatkannya dalam hirarki direktori berdasarkan alamat IP dari salah satu host di datagram
Jika anda hanya menggunakan switch -l saja, akan melihat snort kadang kala menggunakan alamat remote komputer sebagai directory di mana ia menempatkan paket dan kadang-kadang menggunakan alamat host lokal. Agar menyimpan log relatif ke jaringan lokal, anda perlu memberitahukan snort mana yang home network / jaringan lokal:
snort -dev -l /var/log/snort -h 192.168.0.0/24
Perintah ini memberitahu Snort bahwa anda ingin mencetak data link dan TCP/IP header serta data aplikasi ke dalam direktori /var/log/snort, dan anda ingin log paket relatif terhadap jaringan kelas C 192.168.1.0. Semua paket yang masuk akan disimpan ke subdirektori dari direktori log, dengan nama direktori yang berbasis pada alamat remote host (non-192.168.1).
Catatan:
Perhatikan bahwa jika kedua sumber dan tujuan host di jaringan lokal yang sama, mereka akan di catat ke direktori dengan nama berdasarkan nomor port yang lebih tinggi lebih dulu, jika sama, maka digunakan alamat sumber.
Jika anda berada di jaringan kecepatan tinggi atau Anda ingin log paket ke bentuk yang lebih kompak untuk analisis nanti, anda harus mempertimbangkan logging dalam mode biner. Log paket dalam mode biner dalam format tcpdump ke file biner tunggal dalam direktori logging:
snort -l /var/log/snort -b
Note the command line changes here. We don't need to specify a home network any longer because binary mode logs everything into a single file, which eliminates the need to tell it how to format the output directory structure. Additionally, you don't need to run in verbose mode or specify the -d or -e switches because in binary mode the entire packet is logged, not just sections of it. All you really need to do to place Snort into logger mode is to specify a logging directory at the command line using the -l switch--the -b binary logging switch merely provides a modifier that tells Snort to log the packets in something other than the default output format of plain ASCII text.
Once the packets have been logged to the binary file, you can read the packets back out of the file with any sniffer that supports the tcpdump binary format (such as tcpdump or Ethereal). Snort can also read the packets back by using the -r switch, which puts it into playback mode. Packets from any tcpdump formatted file can be processed through Snort in any of its run modes. For example, if you wanted to run a binary log file through Snort in sniffer mode to dump the packets to the screen, you can try something like this:
./snort -dv -r packet.log
You can manipulate the data in the file in a number of ways through Snort's packet logging and intrusion detection modes, as well as with the BPF interface that's available from the command line. For example, if you only wanted to see the ICMP packets from the log file, simply specify a BPF filter at the command line and Snort will only see the ICMP packets in the file:
./snort -dvr packet.log icmp
For more info on how to use the BPF interface, read the Snort and tcpdump man pages.