Difference between revisions of "SNORT-RULES: DROP packet"

From OnnoWiki
Jump to: navigation, search
(Created page with "Edit /etc/snort/snort.conf Pastikan ################################################### # Step #5: Configure preprocessors # Inline packet normalization. For more informa...")
 
 
Line 1: Line 1:
 +
Sumber: http://sublimerobots.com/2016/02/snort-ips-inline-mode-on-ubuntu/
 +
 
Edit /etc/snort/snort.conf
 
Edit /etc/snort/snort.conf
  
Line 29: Line 31:
  
 
  https://github.com/shirkdog/pulledpork
 
  https://github.com/shirkdog/pulledpork
 +
 +
Cek
 +
 +
/usr/local/src/pulledpork-master# ./pulledpork.pl -V
  
  
Line 58: Line 64:
  
 
  snort -c /etc/snort/rules/icmp-sementara.rules -l /var/log/snort/ -K ascii -D
 
  snort -c /etc/snort/rules/icmp-sementara.rules -l /var/log/snort/ -K ascii -D
 +
 +
 +
 +
==Referensi==
 +
 +
* http://sublimerobots.com/2016/02/snort-ips-inline-mode-on-ubuntu/

Latest revision as of 21:01, 10 October 2019

Sumber: http://sublimerobots.com/2016/02/snort-ips-inline-mode-on-ubuntu/

Edit /etc/snort/snort.conf

Pastikan

###################################################
# Step #5: Configure preprocessors
# Inline packet normalization. For more information, see README.normalize
preprocessor normalize_ip4
preprocessor normalize_tcp: ips ecn stream
preprocessor normalize_icmp4
preprocessor normalize_ip6
preprocessor normalize_icmp6


###################################################
# Step #2: Configure the decoder.  For more information, see README.decode
###################################################
config policy_mode:inline
## Configure DAQ variables for AFPacket 
config daq: afpacket 
config daq_mode: inline 
config daq_var: buffer_size_mb=1024



Download pullpork dari

https://github.com/shirkdog/pulledpork

Cek

/usr/local/src/pulledpork-master# ./pulledpork.pl -V



Jalankan snort

snort -c /etc/snort/snort.conf -l /var/log/snort/ -K ascii -D


Format aturan snort

action protocol address port direction address port (rule option)

Edit file, misalnya,

/etc/snort/rules/icmp-sementara.rules

Isi dengan

drop icmp any any <> 192.168.8.104 any

dari client

ping 192.168.8.104

Jalankan snort di server, pastikan ping mati

snort -c /etc/snort/rules/icmp-sementara.rules -l /var/log/snort/ -K ascii -D


Referensi