网络攻防实验五

1、甘肃政法学院本科生实验报告（五）姓名: 米小莉学院: 计算机科学学院专业: 计算机科学与技术 班级 :09 计本班 实验课程名称 : 网络攻击与防御技术 实验日期 :2012 年 6 月 14 日 指导教师及职称 : 武光利 实验成绩 :开课时间： 2011-2012 学年 第二 学期甘肃政法学院实验管理中心印制实验题目Sn ort系统的安装与配置小组合作否姓名米小莉班级09计本班学号200981010123一、实验目的熟悉入侵检测工具snort在Windows操作系统中的安装和配置方法二.实验环境操作系统：wi ndows xp软件：winpcapAppServ三、实验内容与步骤Window

2、s环境下安装和配置snort(1)、安装 Snort 和 Wincap 包2.AppServ(1)安装 AppServ启动AppServ安装文件后，出现如图所示的设置服务器信息界面：在 Server Name 中输入域名 localhost:Administrator'sEmail Address 中输入邮箱地址：694046703监听端口设为8080£3 AppScrv 5_ E_ 9 弓士"tup片Hoche M¥TP 5«wer lirfcrmionilease ei ter vchlt耳 in Perns hoi.Secve htame

3、早心.app&errie tvywk. cam>| lx恥伽tAdmin s Ithb tcr's Email Address (e _as vtebTrastw grrrai sam)- | &94O467D3<5.oEmHTTTP Pat (DeiauiT r G£Q|soso| |<bLext ：=Cancel点击next，进入下一界面：在出现的界面中输入密码（123）:"Character Sets and Collations"选择"GB 2312Simplified Chinese", 下图

4、所示：Applfex v Z. £iB y 3芒孔 upMySQU Smnr CnnfigiMntmn wonflgure the MvSQL Server instance-PleiBse en tei 启.0 口 I pAss-wcrd fct" MvQl. 5 etv er.Er 1 Lei I L?Ut gwjoi clGhjraaer cio 3ncfGR231? SjiwJifir-d ： ：hwirt_| Old &dSr£!oi d Sjppon (PHP MySQL APj funcJon.) I Enaiile- ImaOBNUllso

5、Pt incteH fystt< 且mckiristalllCancel然后单击"Install",进入安装过程，出现下图:0 SdLixuXIAi>pSo：x vthti Aj>pSwv 2 b.S? JSwtijp WizardAppSW 2.5-9 liAL br«n iiliuliillvd on y&ji QOiKKJtfti.Clltk Fnlbli Luckw tl iu wkid|w*|St£rrt Apjachc；RlStal t MSQlLFrilshCar ice安装完成后将 C:Appservphp5 目

6、录下的 php.ini-dist 文件改名为 phpni，并启动 Apache和MySql。（控制面板一管理一服务确保Apache和MySql已启动）HE?>03EC丞击左益H 常I MM承爭呼W %站心HJI Ser*i c*XpjlZi C H.L L « TL Lx, 电I AfijHi 亡比 兮j换隠7 utas.fi务 AUtvnulL UpR电I*匚*AL.E 前和力讪V 卒手岂手巳I.-I禁吻动动*己 4t=fh%M£ Saliva a Sk B 响RslMtr呂料HSEQLSER'/EK%fl£SOL£<rWrJlEl

7、K"inyxq.L噹汕“wmI TjllIz . P". Isi scimI Instr . Lvc .安装完成后可以查看（MySQL启动如下图）Enter paDtw<iLhd： - h<Hp /www AppSntv%arK cornWo Icons to tli® HvSQL rnnitr a ConnidQ ond with ； or M>Vqijp HyEQB cannscl<lain id i» 1Server vbiAUTHORSe ion ： 5.0_ 45cornnuniit vn tlog IM殖Q£

8、 Conmunit y Edit Lan CGPL>Type *1 or * xlip f or ielj>. lypv * cJ lu <?L普也t】卍 liuf f bi*.卯弋!.在浏览器中输入http:/localhost :8080出现:The AppServ Open Project - 2.5,9 for Windows二E phpMyAdminii Ontnbosr iMnmqor Vorsiom S3 1 O 2PHP Information Version E .2 3Aboui.#Map!Srv聲ion 二匸 gt SA/intlo时i施H目呂戶2 ia

9、 a. mF-iQmg npAn mni w厂归 mfnzw "门阳|旧r p曰匚曲巧-仙 WimNw气i口厂怕i1尸峠« ApacKe %Veb Server Version 2_2 4* PI IP fjonpt LnriyuagiEi Vgr&icn b”星；* MiyWQ'l DtklubiJiJiLt Vehiiori 5 D 45* ptiplMyAdmin Dat-abase Mamag er Vertion 2.1 0.2J° Eay way to build Webscrver. Database Server with AppS

10、erv :表示安装成功!（2）测试 AppServ首先查看"控制面板"/"管理"/"服务"，确保Apache和MySQL已经启动，然后，在 浏览器中输入 http:/localhost :8080/phpinfo.php,（下图）PHP Version 5.2.3Wki日i口艸£ NT PC-2D19O4 11 14Q7 3,1 build ?&QaAidiM D-ateMay 31 2Q07C7t nil iijiir%- -T.b irrnaiiricilc-scrlpt /noloao 匚onfIgu rejs

11、 41 enable -snapsot-buii泊-,pv*ith-gd 9naredJ!Server AHIApa匚tiu 2.0 HardierVirtual MrBCCorr Supportenabled<Zon fig uratlon Hki (piip-mi) p-atfiC:WIHDOWSLoadted CcxiftgiuMratFileCiiWTN DOWSph p-tnlI*HIP ARI丘口口斗1Z23EMCCIKMChll20040513*bfm1 EiPfrainiMonl>abuQ SwikiTiirwid«na blediZcarud Mamar

12、v IMiainaQIQrsrab HadHRUA UPEWMtenabledRAgiwfcaHbd PiH 評 Snui m<i(3bpir Ha. dacar hreiiP rtpBRmoMhhcI Memmh flodcelL TransooritsitB* udpRjoq taElzcnMdl 壬 InraaE HMtors匚口nvort-icoiw.", strin口-ot 13P Etiring.-tOijpSFtrliri口.tolaw>srr etrrig jtrip.tsgs, Cdrtw«rta*P cori&urrtadr 2Hb

13、- *可以了解php的一些信息。最后打开浏览器，输入http:/localhost :8080/phpMyAdmi n/in dex.php,下图）输入用户名root和密码，可以浏览数据库内容IduHiomAphpMyAdmln-210.2出！£号Ikfcf gyrmjH'TWog 申 Pimt4l Ftrtni ID* WpSCL Citric IFI 5ft 训轉糾* 卯忖则& w!H曲賦妳衲 W會WftWt t<申底C*roc9吓版+ P ZEgfccgt.Hi1 RM*ilrtfl:*3 U-.SGLUTF-I UHiHdt VffT Far |il I

14、ws »ZU llfCL 毎疝ifMQife V I®Q声跡心*1 xlti讀瑚町!Wt ewMsw 3*(yt|* 1国黑-以加!停|：呵|11沼 B fTlSe3 TftiMW Mr厝 En|耶穴Kft 些如 fi：Hj .phpMyAnFn *（3）配置 AppServ第一步，编辑Apache服务器配置文件。打开Apache2.2conf文件中的httpd.conf,检查相应的 一些值mhnris目录CDkiLfjr&tLiao Senrer0亦U打开.一逢白躺.紿一（31钥他Settet Eyflj Cwlr*! trvtr by S«rvi>

15、;c«二ieri.Etf1 Server Leg： fzles HI UjQL CmiT.uJ Li?iaBLftut VI/NL Em 11 券站rd、曲眈肚 Bdi( tie bttcicad： CoiifiiratLoL fils.cb,e： I tit tBe bttf 1 cjidlE Cgfi 利“Uoe. FilN7SQL Ilii 4 ny ini CmlF;ien Fil*/P Flff ELt the lhi Cczifizuralioc Tile(予 Um a st all, AfpScrr 唸.彳日T 进入Apache服务器配置文件 需要检查一下一些值：Loa

16、dModule php5_module C:/AppServphp5php5apache2_2.dll# ServerName gives the name and port that the server uses to identify itself.# This can often be determ ined automatically, but we recomme nd you specify# it explicitly to preve nt problems duri ng startup.# If your host does n't have a register

17、ed DNS n ame, en ter its IP address here.ServerName localhost:8080# Docume ntRoot: The directory out of which you will serve your# docume nts. By default, all requests are take n from this directory, but# symbolic links and aliases may be used to point to other locations.Docume ntRoot "C:/AppSe

18、rv/www"第二步，编辑 phpMyAdmin 中的关键文件。打开C:AppServwwwphpMyAdminlibraries 目录下的 config.default.php 文件设置 phpMyadmin 的 URL , $cfg'PmaAbsoluteUri' = 'http:/localhost:8080/phpmyadmin/'*/$cf g V PmaAbsoluteUri, = * hrttp:/localhost: 8080/phpi«yadniTv/，$cfg'blowfish_secret' = '

19、;123'g ' blovrfish_3ecrert? = ' 123F : $cfg'DefaultLa ng' = 'zh-gb2312'if fC-L RL 丄-HL *L -LB."J *I j 丄 _L 淫 LL-r 'U auHLang' = ' zhgb2312?:Default language to usftj if "riot browser-defined or userHef inedDefault connect ion collat ion (use d for Ky

20、SQL laulht * ；k. 库11 uw uhai set leuud丄ili$cfg'DefaultCharset' = 'gb2312'iti 1 &Clii a t s d s? 1 t oMySQLLie .Isu tsimbled in$cfg'Servers'$i'auth_type'='cookie'Ssmts'Ji.'jiiHypt1 ='cookir； ; 5./I .一l.:'：匕,371：.-iIcfcrSunEJHijr moi1 Jcfjt&#

21、39; ienets'反'i2i>otd'=W;附貳(olIy rie?i«d第三步，为安全起见，还必须删除Mysql安装后默认的any%、anylocalhost和root%帐号。-直瞬亠曲运ti沁l餉障cfe哉巴厂userrner2-ij5f="测匚； dtleit 白臣 =rr iktri hs尹'Lotst-' I'Leinnef色廐马声丸兰览衣匸盘词出融 事血；il段丁酬 工丄'-_© 凹締棗 O(WS OJietSQL SW'pEtETE圧亡 u申 1HC h( -：無駅9代屯del

22、ete from db where user=" and host='%'delete from tables_priv where user=" and host='%'delete from colu mn s_priv where user=" and host='%'delete from user where user=" and host='localhost'delete from db where user=" and host='localhost'

23、;delete from tables_priv where user=" and host='localhost'delete from colu mn s_priv where user=" and host='localhost'delete from user where user='root' and host='%'delete from db where user='root' and 'host'='%'delete from tables_pri

24、v where user='root' and host='%'delete from colu mn s_priv where user='root' and 'host'='%'注意，上面的“是两个单引号而不是一个双引号。这样只允许root从localhost连接。垢丘irK si rricr rattiOlrT iwystj l&fj 刃L13dede Pan dbAhe-suser-" anj hosl=冒Adeiete Farwhere user' and bod-'Vd

25、eete from 协inns(Aiep user anc hsi'h(r ustp 茁乳sM st-bcJb： stdelete血 db*hef?Ufier=' ani hcsl= jcaEt'delete Item taUcs jri ita user' nd ixiot alhosi'一deete呱jttejt祐归讯沪"an:册齐氐日柬工沏fef回剖瀛煜祂鏑画第四步，配置 php.ini。打开C:WINDOWS|php.ini文件。修改后的值如下图:;cpen_basedir =C:AppServwwwmagi c_q u otes_g

26、p c = Offfile uploads = OfF第五步，对 Mysql进行修改。首先需要建立Snort运行必需的Snort库和Snort archive库:错误是因为没有启动mysql,第二次是因为）；被#,屏敝了，修改后如下图:I ±tt圧1 睢师（U' 变看rvi 刑勧世）错误直阳程炼迪理 牡世 KK1 用戶SQL脊觀：CHLAtE 1A19L£ StherTia.J veq I UNSIGNF口 NC1TWJIU £3 ctmeL NOT NULL.PRI|M/iR：V KEY vceq >MySQL©10-16 Moselec

27、tedFell oh exi«5¥ * hBrewpTXTlat zorwi. 5上 TAsnm. exb MW董盹wp K "K* svemsr 四 e rw5«ldj-at- cjec rEHL£iM.JE：t IDfriJlMB K紅>>t t jj d. «3 » jsuipi： rxcXdiT i m s a.1 orXJja i ffU C lx ului Xihlii m E lr_ £l I orKd>i i m tr a I ciir Ariir i pnofA.dir i m

28、s tar at or 扎dn im s Le ET£T 朋A. da i. nx. i Lit . I 口 r* EICTKfl5TSTETIkjjH i rki s Lt' aI-ojt K(bi>3 »4 itr diiar STSTEfl 師昱T"n Mo o u n d d _h 1 n D D n 口 u o SG o Don u oo-on 口LJEr駐 hflMfEEErrKr軋 wsl聶Eaeo篇箋eo OS h- n 1 G .M T M T _T n 弓 u z.lo垃li.-344氐 gjl-7IB孔tai tntqfjLTf

29、 TjhPJ bQnauiflUCrP KT MJ. I. mJTO JH匚f 睡T Ha_nwM .厂.訂' IJ3B ilnf ALL, PQi.ElanJd L143KX<P KIT HULLUCOGTltDQ画 UIJ3IC14EDNfLEiid LfdBOEDMjid UMEKHR PRMWH&V .auju NDFX iqnHRM- pgna-m! 20:1 *A£IEj. &lj3_diu.Jd_> |SBfl_daEd_idi册ML %Hi ®S1 fl£-4 - Yau lum an error ri your

30、 svnlai： che»:k EJie rrtaruai Iful cD-rTESjiDnd bo ynur MySQL senw wxmn fcc Hie right EHTtac Io use hev 了 33 fane 1 flI®叫程序第一次运行就生成了 eve nt表和schema表，需要删除错误的表后才能重新创建表。£i K-fc2 lxjihost t .鮭序 wioddm“»»畑話WMt»it+阳1; §I X0UjlMIpDt3jM.ja1BU «hsnj " £2 i 1

31、>1團卫掘一旳“电绝_口2M2ii1WSAN«ZJ12_chin3.0 Q仁进.旳遥M1右事 叭肝疥冏底'Op*n wh pflpkLiAmri »ha 冲对< A吝lucalhMl 卜 * #!臣齐 trertMS tt uOS JW；啊世赞*yi-snor 中它 H供S 手NUittf fffI *T_1L血；1出件fii»异>w妬喪量k HlKfw 冬岀 T >；Wjafc_Tf'LF.dLa2d叨it!1邯MJH?a«B CTT_金乞，上戸库第中氐、INIUNSIGNED NOT NULLCREATE TA

32、BLE signamre ( s:g_i(isig_name siff_classjclINTAUTO_INCREMEXT:VARCHAR(石升 NOT NULL,UNSIGNED XOT?<ULL.si5_prioriTlMUNSIGNEDsig revINTUNSIGNED.Sl_5ldINTUNSIZEDINTUNSIGNED：PRIMARY KEY isig_idINDEXsign_i±t (jig_name( 2C);-JNDEXsig_cla5 s_i d._idx( si_dissd)经过多次排错，终于运行成功:921直母TAQf 'schar'

33、HThd W.L ifrir QUHf TIE NOT DJI l =丽朗、沪计刖占韓泊.西呼甘輛去惊O*輛h HTTnTO'uhmH' (vseq <HneJVM.l£Sf1BT 皿(|序輸福t 1 CAIETAB_EnailMdMTUiBCHEDNQTMil CriIMTIMBOIEDNOTUU lase HT 刚问 NOT MIL imeflIM* DVFIWE NOT 也L畑 KETfltRH tW grflWI.ICD 徐训“:' '、. .' I!供曽;点具 * 5lT0BHH®尹i, CHBTIETJiaE(<

34、;jdlTIMaae)NOTMUNJTOLHCRDBfT 軋呻删删冋NOT IU1,和匕“I INT 曲K旧 MOTFILL jiiDfTt> t(H wrt' i autos申t>tJiM JM dMX$>X2竝 iLEnntja叭砂冋叫 BtF'FTnMilrTX3砂IFg hpMiM二IX)啊 LmiWNLdO何 iHKlW-TXJ讪田y 4h*iPHIfMtX-AMUOHn耳9伽汕 HSUnlMftai(aVX15K312_flllWJ1911舅sirJjie 曹n(1冀31何-B >0t-tonamJ*IX1-Qba31UktiKJ山叩*qww

35、aS1X3IM54II呻sfjmn肓TXJ19i9sq_LdiEK2jhi1>I址<0sq -dractM嗣3ihSMliZ3 叫 riinoDDjd14-KB第六步，使用 C:Snortschemas目录下的create_MySQL脚本建立 Snort运行必需的数据表。 在此，可以通过 MySQL提示符下运行 SQL语句show tables来检验配置的正确性 其中c:Snort为Snort的安装目录，打开命令提示符，运行以下命令：mysql -D Snort -u root -p < c:Sno rtschemascreate_mysqlmysql -D Sno rt_a

36、rchive -u root -p < c:S no rtschemascreate_Mysql每次提示输入root的密码，输入密码即可建立所需要的表。Opie-n12Fluigity tditya qf I D Kmmr-tc li-ara.E t e： r a e < 5 iChML囲吕此OF电住亡Sch- r etc t e itj； 3 三lacallw at: u la, TCVzl P gb2312 gih313yh231333W»丄橙 twui-tt 、弓 nJji 13 uwi-aatlo ca Utae tNlcp-t; xn use2 i<Hir

37、iiffic lun I tl - CurrMrii(1 dat dilia 0 Cui*F*nt； use Jr :lllcj juigi vie liiiAt-er- Jttrvwr w r h iv n>: Pika<l7<i>iqci' ¥需严鼻市<|1科 C<i nne-iz -t n ni 5 te-Wjiea-»hClinnt Co nn TCP pore Mlit丄iu s通过MySQL提示符下运行 SQL语句show tables来检验配置的正确性云 MyWL CoK*±aJ. Lxil1 CIxilI

38、l-lgxlTyipc hn=TjM oir *Sb fnr Tkclp. Typ<5to clear iEhe huffcr-pii/uq1>Det和轟hnngr d 輩孟 可1 linui It nit 1«? s;ul e yrhujtI 1 fih L芒址_丄munt>：rE data"Idie t a i_X1!HncudUjiijiIouonttIirnplwlrI；iplid: o>t：!I-£ i !ctN±riiie1Irv f vmqv百申|£|1利 tiQClhRAJEsms raif-1 !

39、63; lfl_p±«lSSH!q 左曹_moj( o iconic*tI3 irn Jtirtdi*#II phcLg*t!iuduhdi*:ny?iq >第七步，必须在 Appache服务器主机上建立 ACID和Snort用户，并且设置权限和密码(主要是根据课本步骤修改代码)代码：mysql> grant usage on *.* to "acid""localhost" identified by "acidtest"mysql> grant usage on *.* to "sn

40、ort""localhost" identified by "snorttest"mysql> grant select,i nsert,update,delete,create on *.* to "sn ort""localhost" id en tified by "sno rttest"mysql> grant select,i nsert,update,delete,create,alter on snort. * to "acid""

41、;loc alhost"mysql> grant select,i nsert on snort. * to "sno rt""localhost"mysql> grant select,i nsert,update,delete,create,alter on sno rt_archive. * to "a cid""localhost"mysql> set password for "s no rt""locahost"=password(&#

42、39;123');mysql> set password for "acid""locahost"=password('123');nysijl>usage on to 1 *acid1 "P1 plocalhust11 Ident if led byQue出y (JJKj. U rous affected (.O.3b sec>nysql> igrant usage on to snorflocalhost11 ident if led by 'norttest,p； QutFy OK,

43、 0 rous affected C8.30 sec>nysql> gpraint select insert,update, delete create on ton o r tloc a lh® st,p idEntifled 创 R,snorttest,p；jb OK 6 tcjwm of fee; ted CB.BG 生“njP£ql> arrant select,insert,update,delete.createRaltei* Gn snort, « to Hacid,O,loc kllnslHQueir OM, 0 fous af

44、fected <0J0R sec)nsql? grant selectinsert; on snort. * to snortLocalhost'*；QmeB fciuc affacted CB. SB 号曰匚、niysql>nsql> sfrninl; sc lec& inskeirl;, updtcdB Lctcicr&atc r alter on anor-t;.archive « * tc ''a. Lid'-e'-localtiost''；QtitFy OK, 0 rays affec

45、ted C093B sec>在Appache服务器主机上建立ACID和Snort用户学版务整:tocjinw尉壇IF 一駆一jaa 磴于HU 申EK? 溢* 电；it石i35a_沖*WHt 血用户一直A. B G D -Ell:CMiJ < L!MHl3FaiFl3 t U V W X T fp ra SM±M«K Q押樹口i©rw * UW3E書 Vn rod TlOCdtill 4SELECT. iiHSERT. IFW疋 KLEI?. C«f4TEI设置权限和密码* 用户'snort:嵋煩KM般B SELECTE INSERTR

46、 UPDATE0 DELETE匚怔rtfra0 CREATE0 ALTER IM3EM DROP CREATE旧巾艸計T«lES 0 CREATE VIEW SHOWVBW CREATE ROUTINE D ALTER RQUTBIE nD£.OUTEres尿诫MT SUPER PROCESS RELCMO 9H0W DATABASES LOCKTWLE3厂 REFEREMQ臂 REPUGA11DNGUENT _ ftLPUJUQNMArEI C«£A葩曲R捷测I.制W力導第拧西岔酯常JWG昶.w QUERESPORHOURaMM UPDATES PER

47、 HOUR述W COWECITO邸 HOURQMAX UXOWEGTIWS 0MJ艺细库曲定収庭ttW « ICItxAH M mim ftLfjCT. iHXRT dTV 1TTijirrlFi.F 呼vrSOL 葩'GRANT SELECT JSOn IPDATL DELHE CRATE ALTER Ol iniit 'Kh旳型已臧 GftANT SELECTUStRTUPCATIimiECltFilF乩旧UM -rwl_zTf/ : TQ iaJ： aoc MRGIWOPriUH设置结果如图所示:(3)、安装 Adodb,jpGraph 和 ACID 移动文件a

48、dodb jpgraph acid 得到： Adodb 生成目录：C:AppServphp5adodb jpgraph 生成目录： C:AppServphp5jpgraph acid 生成目录： C:AppServwwwacid 修改 C:AppServwwwacid 中的 acid-conf.php 文件f f ： '护函丄势X岭- L cJ 匚4ar ： d二 jpiiin13 £E朋MWVl xulLZ-Iu Li e-c a ii-r21 TBI <J>£Vi i tudLi a. Lire «3即1 UiXiir f 3LU/J% l

49、.-L ZlJ.flJZL3 )3钿l 1 dh的FKF ef xpt7 13aci. 1 er sph :cmoEi15 KHTi luSbtQdi*. 13&4. 14鼬屮“” I = ； h - -：! - s. I - 12 EBMid. CT 口入=41远47HD Snurijit< EB$DBIib_path = "C:AppServphp5adodb" $alert_dbn ame= "sn ort"$alert_host= "localhost"$alert_port= "3306"$

50、alert_user= "acid"$alert_password = "123"$archive_dbn ame $archive_host $archive_port $archive_user="sno rt_archive" ="localhost"一 Illi.一 ，="acid"$archive_password = "123"$ChartLib_path = "C:AppServphp5jpggraphsrc"打开acid_conf.php文

51、件修改并保存，结果如下图:dctLaniSc*SmcFIilertjuil - 'Jscittist' idwtjSEt 二'MOI1； id£jtwusic - 'sdf: i=lertzwE： -S< 血啦加 第 cwciim pusctcu * crdE_itash 1 "ajKt.Kdur;8 isxhiwJiHd g "bralhrarTSardKKjiri -，- 鲨cfc硒LISI-,在mysql命令端输入如下命令并回车，出现如下所示，表明运行成功:砂时1> S£I PUSSUOHD FOR 恪e

52、hei?To皿lh砒mU)lKSV0MF即); Query OK, 0 rows affectedL (0.00 sec>jnysul?最后在浏览器中输入http:localhost :8080/acid/acid-db-setup.php 出现如下界面:说明安装成功(4)、配置 snort修改C: snortetcsnort.conf 主要改绝对路径：r? output a：ert_prclude芋 metadata reference data. do not modi th?se lines includs-匚lassificarioEL(?CHifi_g includje ref

53、er erics, config* Step 亚了二 Customize、mr：nLl£ set=Forinform at i on; £ 巴亡 Snort Manual, Writing Snort Rnl«斗 site specific nxLes卜snor t -记爭丰匸扫文件嗝擂的椎式誉看理)WQi)# metadata reference data, do not modify these lines修改前include C:Snortetcclassification.confi修改后然后还需要修改引用路径：dyn amicpreprocessor d

54、irectory C:/s no rt/lib/s nort_dyn amicpreprocessor/dyn amice ngine C:/s no rt/lib/s nort_dyn amice ngin e/libsf_e ngin e.dllL sncrrt - 1P.事4| - fn 反文杵褊曙电格式©查看迎希助I# p 曰th to dyne mi 匚librariesdynamicpreprocessor directoryU/弓grt/lib/5Mrt_dyrwrrit：pEpi£i7M #pathtobaseppce5songineH dynamiceng

55、ineC:/snort/lib/s 门 ort_d¥ng»riicEnginE/lib5f_E 门 ginm.dll设置 snort 输出 alert 至U mysql server1把 “# var HOME_NET /24 改成”“var HOME_NET 192.168.04/24 你自己 LAN 内的 地址，把前面的#号去掉。2把 “ var RULE_PATH ./rules 改成 ” “ var RULE_PAH /etc/snort”3把 “ # output database: log, mysql, user=root password=t

56、est dbname=db host=localhost 改成“ output database: log, mysql, user=root password=123 dbname=snort host=localhost 把前面的 # 号去掉。4把 “ # include $RULE_P/TH/web -attacks.rules# in clude $RULE_PATH/backdoor.rules# in clude $RULE_PATH/shellcode.rules# in clude $RULE_PATH/policy.rules# in clude $RULE_PATH/porn.rules# in clude $RULE_PATH/i nfo.rules# in clude $RULE_PATH/icmp-i nfo.rulesi nclude $RULE_PATH/virus.rules# include $RULE_PATH/chat.rules# include $RULE_PA TH/multimedia.rules# include $RULE_PATH/p2p.rules 前面的 #号删除。修改完毕后，保存退出。# SEtup th巳门巳twok 吕ddEESE5 you are protecting茁