Snort里的规则目录文件解读（图文详解）

　　不多说，直接上干货！

　　snort的规则啊，是基于文本的，它通常存在于snort程序目录中或者子目录中，规则文件按照不同的组，进行分类存放的。

　　snort的安装目录

[root@datatest snort]# pwd
/etc/snort
[root@datatest snort]# ll
total
-rw-r--r--.  root root     Aug   : barnyard2.conf
-rw-r--r--.  root root     Aug   : classification.config
drwxr-xr-x.        Jan    etc
-rw-r--r--.  root root    Aug   : gen-msg.map
drwxr-xr-x.        Jan    preproc_rules
-rw-r--r--.  root root      Aug   : reference.config
drwxr-xr-x.        Aug   : rules
-rw-r--r--.  root root  Aug   : sid-msg.map
-rw-r--r--.  root root    Aug   : snort.conf
drwxr-xr-x.        Jan    so_rules
-rw-r--r--.  root root     Aug   : threshold.conf
-rw-r--r--.  root root   Aug   : unicode.map
[root@datatest snort]# 

　　/etc/snort/rules

[root@datatest rules]# pwd
/etc/snort/rules
[root@datatest rules]# ls
app-detect.rules        dos.rules              indicator-compromise.rules   os-other.rules           protocol-nntp.rules      server-apache.rules     voip.rules
attack-responses.rules  experimental.rules     indicator-obfuscation.rules  os-solaris.rules         protocol-other.rules     server-iis.rules        VRT-License.txt
backdoor.rules          exploit-kit.rules      indicator-scan.rules         os-windows.rules         protocol-pop.rules       server-mail.rules       web-activex.rules
bad-traffic.rules       exploit.rules          indicator-shellcode.rules    other-ids.rules          protocol-rpc.rules       server-mssql.rules      web-attacks.rules
black_list.rules        file-executable.rules  info.rules                   p2p.rules                protocol-scada.rules     server-mysql.rules      web-cgi.rules
blacklist.rules         file-flash.rules       local.rules                  phishing-spam.rules      protocol-services.rules  server-oracle.rules     web-client.rules
botnet-cnc.rules        file-identify.rules    malware-backdoor.rules       policy-multimedia.rules  protocol-snmp.rules      server-other.rules      web-coldfusion.rules
browser-chrome.rules    file-image.rules       malware-cnc.rules            policy-other.rules       protocol-telnet.rules    server-samba.rules      web-frontpage.rules
browser-firefox.rules   file-java.rules        malware-other.rules          policy.rules             protocol-tftp.rules      server-webapp.rules     web-iis.rules
browser-ie.rules        file-multimedia.rules  malware-tools.rules          policy-social.rules      protocol-voip.rules      shellcode.rules         web-misc.rules
browser-other.rules     file-office.rules      misc.rules                   policy-spam.rules        pua-adware.rules         smtp.rules              web-php.rules
browser-plugins.rules   file-other.rules       multimedia.rules             pop2.rules               pua-other.rules          snmp.rules              white_list.rules
browser-webkit.rules    file-pdf.rules         mysql.rules                  pop3.rules               pua-p2p.rules            specific-threats.rules  x11.rules
chat.rules              finger.rules           netbios.rules                protocol-dns.rules       pua-toolbars.rules       spyware-put.rules
content-replace.rules   ftp.rules              nntp.rules                   protocol-finger.rules    rpc.rules                sql.rules
ddos.rules              icmp-info.rules        oracle.rules                 protocol-ftp.rules       rservices.rules          telnet.rules
deleted.rules           icmp.rules             os-linux.rules               protocol-icmp.rules      scada.rules              tftp.rules
dns.rules               imap.rules             os-mobile.rules              protocol-imap.rules      scan.rules               virus.rules
[root@datatest rules]# 

　　比如，文件ftp.rules所包含了FTP攻击内容。

　　在启动的时候，snort会读取所有的规则文件，并且建立一个三维的链表。

　　/etc/snort/so_rules

[root@datatest so_rules]# pwd
/etc/snort/so_rules
[root@datatest so_rules]# ls
browser-ie.rules     file-java.rules        indicator-shellcode.rules  os-other.rules       protocol-nntp.rules   pua-p2p.rules        server-oracle.rules
browser-other.rules  file-multimedia.rules  malware-cnc.rules          os-windows.rules     protocol-other.rules  server-apache.rules  server-other.rules
exploit-kit.rules    file-office.rules      malware-other.rules        policy-social.rules  protocol-snmp.rules   server-iis.rules     server-webapp.rules
file-flash.rules     file-other.rules       netbios.rules              precompiled          protocol-tftp.rules   server-mail.rules    src
file-image.rules     file-pdf.rules         os-linux.rules             protocol-dns.rules   protocol-voip.rules   server-mysql.rules
[root@datatest so_rules]#