https://wiki.ixheim.de/index.php?action=history&feed=atom&title=Snort_Install_Linux_Ubuntu
Snort Install Linux Ubuntu - Versionsgeschichte
2026-06-29T06:11:32Z
Versionsgeschichte dieser Seite in Xinux Wiki
MediaWiki 1.35.1
https://wiki.ixheim.de/index.php?title=Snort_Install_Linux_Ubuntu&diff=15368&oldid=prev
Thomas: Die Seite wurde neu angelegt: „=Install= *apt-get install snort Datei:snort-linux-1.png =Test= *snort -T -i eth0 -c /etc/snort/snort.conf =Local Rules= *cat /etc/snort/rules/local.rules…“
2017-11-10T18:36:30Z
<p>Die Seite wurde neu angelegt: „=Install= *apt-get install snort <a href="/index.php/Datei:Snort-linux-1.png" title="Datei:Snort-linux-1.png">Datei:snort-linux-1.png</a> =Test= *snort -T -i eth0 -c /etc/snort/snort.conf =Local Rules= *cat /etc/snort/rules/local.rules…“</p>
<p><b>Neue Seite</b></p><div>=Install=<br />
*apt-get install snort<br />
[[Datei:snort-linux-1.png]]<br />
=Test=<br />
*snort -T -i eth0 -c /etc/snort/snort.conf<br />
=Local Rules=<br />
*cat /etc/snort/rules/local.rules <br />
Alert icmp any any -> any any (msg:"Snort Test"; sid:1000000001;)<br />
#Alert udp any any -> any any (msg:"Snort Test UDP"; sid:1000000002;)<br />
#Alert tcp any any -> any any (msg:"Snort Test TCP"; sid:1000000003;)<br />
<br />
=Snort Test mit Ping von 192.168.244.2 auf 192.168.244.213=<br />
*snort -i eth0 -c /etc/snort/snort.conf -A console<br />
<pre><br />
08/24-10:07:20.917072 [**] [1:1000000001:0] Snort Test [**] [Priority: 0] {ICMP} 192.168.244.2 -> 192.168.244.213<br />
08/24-10:07:20.917072 [**] [1:384:5] ICMP PING [**] [Classification: Misc activity] [Priority: 3] {ICMP} 192.168.244.2 -> 192.168.244.213<br />
08/24-10:07:20.917097 [**] [1:1000000001:0] Snort Test [**] [Priority: 0] {ICMP} 192.168.244.213 -> 192.168.244.2<br />
08/24-10:07:20.917097 [**] [1:408:5] ICMP Echo Reply [**] [Classification: Misc activity] [Priority: 3] {ICMP} 192.168.244.213 -> 192.168.244.2<br />
08/24-10:07:21.917091 [**] [1:366:7] ICMP PING *NIX [**] [Classification: Misc activity] [Priority: 3] {ICMP} 192.168.244.2 -> 192.168.244.213<br />
08/24-10:07:21.917091 [**] [1:1000000001:0] Snort Test [**] [Priority: 0] {ICMP} 192.168.244.2 -> 192.168.244.213<br />
08/24-10:07:21.917091 [**] [1:384:5] ICMP PING [**] [Classification: Misc activity] [Priority: 3] {ICMP} 192.168.244.2 -> 192.168.244.213<br />
</pre></div>
Thomas