Snort 구동 확인 rule 정하기

Snort 구동 확인하기 1

Ubuntu

$ vi /etc/snort/rules/local.rules
$ alert icmp any any -> any any (sid:1000001;)

Kali Linux

hping3 ubuntu_ip -a kali_ip --icmp

- ICMP source 위조하기

Ubuntu

$ snort -A console -q -u snort - g snort -c /etc/snort/snort.conf

- snort 구동하기

Snort 구동 확인하기 2

Ubuntu

$ vi /etc/snort/rules/local.rules
$ alert icmp any any -> ubuntu_ip any (msg: "Detect ICMP"; sid:1000001;)

Kali Linux

$ hping3 ubuntu_ip -a kali_ip --icmp

- icmp source 위조하기

Ubuntu

$ snort -A console -q -u snort -g snort -c /etc/snort/snort.conf

- snort 구동하기