Difference between revisions of "SNORT-RULES: DROP packet"

From OnnoWiki
Jump to: navigation, search
(Created page with "Edit /etc/snort/snort.conf Pastikan ################################################### # Step #5: Configure preprocessors # Inline packet normalization. For more informa...")
(No difference)

Revision as of 20:50, 10 October 2019

Edit /etc/snort/snort.conf

Pastikan

###################################################
# Step #5: Configure preprocessors
# Inline packet normalization. For more information, see README.normalize
preprocessor normalize_ip4
preprocessor normalize_tcp: ips ecn stream
preprocessor normalize_icmp4
preprocessor normalize_ip6
preprocessor normalize_icmp6


###################################################
# Step #2: Configure the decoder.  For more information, see README.decode
###################################################
config policy_mode:inline
## Configure DAQ variables for AFPacket 
config daq: afpacket 
config daq_mode: inline 
config daq_var: buffer_size_mb=1024



Download pullpork dari

https://github.com/shirkdog/pulledpork



Jalankan snort

snort -c /etc/snort/snort.conf -l /var/log/snort/ -K ascii -D


Format aturan snort

action protocol address port direction address port (rule option)

Edit file, misalnya,

/etc/snort/rules/icmp-sementara.rules

Isi dengan

drop icmp any any <> 192.168.8.104 any

dari client

ping 192.168.8.104

Jalankan snort di server, pastikan ping mati

snort -c /etc/snort/rules/icmp-sementara.rules -l /var/log/snort/ -K ascii -D