multi-snortnotes
no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
— | multi-snortnotes [2013/01/28 04:29] (current) – created - external edit 127.0.0.1 | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== Adventures in Multi-Snort ====== | ||
+ | %ICON{" | ||
+ | |||
+ | ===== Install NIC Driver ===== | ||
+ | |**Driver** |**Hardware** |**More Info** | | ||
+ | | e1000 | Supports Legacy Intel (PCI, PCI-X**) Gigabit Network Connections. | [[http:// | ||
+ | | e1000e | Supports Intel PCI Express** Gigabit Network Connections except the 82575, 82576, 82580, and I350.| [[http:// | ||
+ | | TNAPI | 1 Gbit: Intel 82575/76/80 (Linux driver igb 3.1.x) / 10 Gbit: Intel 82598/82599 (Linux driver ixgbe 3.3.9) | [[http:// | ||
+ | |||
+ | To view what driver you're using, use the**lshw** command. | ||
+ | |||
+ | '' | ||
+ | |||
+ | You can also install and use ethtool for more info on your adapter | ||
+ | |||
+ | '' | ||
+ | '' | ||
+ | |||
+ | Download the current version of PF_RING< | ||
+ | [[http:// | ||
+ | |||
+ | Install the driver (browse to the proper directory for the desired driver under**PF_RING_aware**). | ||
+ | < | ||
+ | tar xvfz PF_RING-5.4.1.tar.gz | ||
+ | cd PF_RING-5.4.1/ | ||
+ | make clean | ||
+ | make | ||
+ | make install | ||
+ | </ | ||
+ | |||
+ | ===== Setting up PF_RING ===== | ||
+ | Adjust**vmalloc** variable so snort can load pfring. | ||
+ | * Edit**/ | ||
+ | * Change the following line:<br /> '' | ||
+ | * To:<br /> '' | ||
+ | |||
+ | '' | ||
+ | |||
+ | This will require a reboot before you try to run Snort with pfring. | ||
+ | |||
+ | Install subversion, autoconf, and libtool | ||
+ | |||
+ | '' | ||
+ | |||
+ | Download the current version of PF_RING< | ||
+ | [[http:// | ||
+ | |||
+ | < | ||
+ | tar xvfz PF_RING-5.4.1.tar.gz | ||
+ | cd PF_RING-5.4.1 | ||
+ | make clean | ||
+ | cd kernel | ||
+ | make clean | ||
+ | make | ||
+ | make install | ||
+ | cd ../ | ||
+ | export LD_LIBRARY_PATH'' | ||
+ | export LIBS''' | ||
+ | ./configure | ||
+ | make clean | ||
+ | make | ||
+ | make install | ||
+ | cd ../libpcap | ||
+ | export LIBS''' | ||
+ | ./configure | ||
+ | make clean | ||
+ | make | ||
+ | make install | ||
+ | make clean && make && make install-shared | ||
+ | ln -s / | ||
+ | </ | ||
+ | |||
+ | To check the status of PF_RING, run:<br /> | ||
+ | '' | ||
+ | |||
+ | If using as a passive IDS with e1000(e) driver: | ||
+ | < | ||
+ | rmmod pf_ring.ko | ||
+ | insmod pf_ring.ko enable_tx_capture'' | ||
+ | </ | ||
+ | |||
+ | ===== Setting up DAQ ===== | ||
+ | Download the current version of DAQ<br /> | ||
+ | [[http:// | ||
+ | |||
+ | < | ||
+ | tar xvfz daq-0.6.2.tar.gz | ||
+ | cd daq-0.6.2 | ||
+ | chmod 755 configure | ||
+ | export LD_LIBRARY_PATH'' | ||
+ | export LIBS''" | ||
+ | ./configure --disable-nfq-module --disable-ipq-module \ | ||
+ | --with-libpcap-includes''/ | ||
+ | --with-libpcap-libraries''/ | ||
+ | --with-libpfring-includes''/ | ||
+ | --with-libpfring-libraries''/ | ||
+ | make clean && make && make install | ||
+ | </ | ||
+ | |||
+ | ===== Build the DAQ Interface Module ===== | ||
+ | Go back to the PF_RING directory and build the daq interface module. | ||
+ | < | ||
+ | cd PF_RING-5.4.1/ | ||
+ | autoreconf -ivf | ||
+ | export LD_LIBRARY_PATH'' | ||
+ | export LIBS''' | ||
+ | ./configure | ||
+ | make && make install | ||
+ | </ | ||
+ | |||
+ | ===== Setting up Snort ===== | ||
+ | Download the current version of Snort<br /> | ||
+ | [[http:// | ||
+ | |||
+ | Compile and install (You can adjust some of the ' | ||
+ | < | ||
+ | tar xvfz snort-2.9.2.3.tar.gz | ||
+ | cd snort-2.9.2.3 | ||
+ | make clean | ||
+ | export LD_LIBRARY_PATH'' | ||
+ | export LIBS''' | ||
+ | ./configure --with-libpcap-includes''/ | ||
+ | --with-libpcap-libraries''/ | ||
+ | --with-libpfring-includes''/ | ||
+ | --with-libpfring-libraries''/ | ||
+ | --enable-zlib --enable-perfprofiling --enable-ipv6 \ | ||
+ | --enable-gre --enable-mpls --enable-normalizer \ | ||
+ | --enable-targetbased --enable-decoder-preprocessor-rules \ | ||
+ | | ||
+ | make | ||
+ | make install | ||
+ | </ | ||
+ | |||
+ | Verify Snort can use the PF_RING DAQ module | ||
+ | < | ||
+ | snort --daq-dir''/ | ||
+ | </ | ||
+ | You should see something similar to this: | ||
+ | < | ||
+ | Available DAQ modules: | ||
+ | pfring(v1): live inline multi unpriv | ||
+ | pcap(v3): readback live multi unpriv | ||
+ | ipfw(v2): live inline multi unpriv | ||
+ | dump(v1): readback live inline multi unpriv | ||
+ | afpacket(v4): | ||
+ | </ | ||
+ | Make sure you have the**pfring** line. | ||
+ | |||
+ | ===== Run Snort ===== | ||
+ | Here is an example of Snort running on 4 cores (2 per interface) in passive mode using pfring. | ||
+ | < | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | / | ||
+ | </ | ||
+ | |||
+ | ===== Setting up Etherchannel on Cisco ===== | ||
+ | This is a basic example of setting up a Layer 2 Etherchannel port on a Cisco device. | ||
+ | |||
+ | On the chassis after logging and enabling: | ||
+ | < | ||
+ | configure terminal | ||
+ | interface gigabitethernet1/ | ||
+ | no ip address | ||
+ | channel-group 19 mode on | ||
+ | exit | ||
+ | interface gigabitethernet1/ | ||
+ | no ip address | ||
+ | channel-group 19 mode on | ||
+ | exit | ||
+ | ... | ||
+ | etc. | ||
+ | ... | ||
+ | interface Port-channel19 | ||
+ | no shutdown | ||
+ | exit | ||
+ | end | ||
+ | </ | ||
+ | Here is how to set it as a SPAN session destination | ||
+ | < | ||
+ | monitor session 1 source tengigabitethernet2/ | ||
+ | monitor session 1 destination interface port-channel 19 | ||
+ | </ | ||
+ | |||
+ | ===== References ===== | ||
+ | * [[http:// | ||
+ | * [[http:// | ||
+ | * [[http:// | ||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | * [[http:// | ||
+ | * [[http:// | ||
+ | * [[http:// | ||
+ | |||
+ | |||
+ | -- Main.FredPettis - 2012-03-17 |
multi-snortnotes.txt · Last modified: 2013/01/28 04:29 by 127.0.0.1