mirrors/dockerfiles_vimagick
2
0
Fork 0
mirror of https://github.com/vimagick/dockerfiles.git synced 2025-12-21 13:23:02 +01:00
Code Issues Projects Releases Wiki Activity

update snort alert

Browse Source
This commit is contained in:
kev
2018-08-26 15:36:51 +08:00
parent 7414dac1f3
commit 26b8d99a3b
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
snort/README.md
View File

@@ -9,7 +9,7 @@ traffic analysis and packet logging.
```yaml ```yaml
snort: snort:
image: vimagick/snort image: vimagick/snort
command: -q -c /etc/snort/snort.conf -A console -i ens3 command: -q -c /etc/snort/snort.conf -A fast -y -i eth0
volumes: volumes:
- ./data/snort.conf:/etc/snort/snort.conf - ./data/snort.conf:/etc/snort/snort.conf
- ./data/rules:/etc/snort/rules - ./data/rules:/etc/snort/rules
@@ -30,9 +30,9 @@ alert icmp any any -> any any (msg:"ICMP Echo Reply"; itype:0; sid:10001;)
```bash ```bash
$ docker-compose up -d $ docker-compose up -d
$ docker-compose logs --tail 10 -f $ tail -f data/log/alert
snort_1 | 08/26-06:47:35.460754 [**] [1:10000:0] ICMP Echo Request [**] [Priority: 0] {ICMP} x.x.x.x -> y.y.y.y snort_1 | 08/26/18-06:47:35.460754 [**] [1:10000:0] ICMP Echo Request [**] [Priority: 0] {ICMP} x.x.x.x -> y.y.y.y
snort_1 | 08/26-06:47:35.460835 [**] [1:10001:0] ICMP Echo Reply [**] [Priority: 0] {ICMP} y.y.y.y -> x.x.x.x snort_1 | 08/26/18-06:47:35.460835 [**] [1:10001:0] ICMP Echo Reply [**] [Priority: 0] {ICMP} y.y.y.y -> x.x.x.x
$ tcpdump -n -r data/log/snort.log.xxx $ tcpdump -n -r data/log/snort.log.xxx
06:47:35.460754 IP x.x.x.x > y.y.y.y: ICMP echo request, id 17767, seq 933, length 12 06:47:35.460754 IP x.x.x.x > y.y.y.y: ICMP echo request, id 17767, seq 933, length 12

2
snort/docker-compose.yml
View File

@@ -1,6 +1,6 @@
snort: snort:
image: vimagick/snort image: vimagick/snort
command: -q -c /etc/snort/snort.conf -A console -k none -i ens3 command: -q -c /etc/snort/snort.conf -A fast -y -i eth0
volumes: volumes:
- ./data/snort.conf:/etc/snort/snort.conf - ./data/snort.conf:/etc/snort/snort.conf
- ./data/rules:/etc/snort/rules - ./data/rules:/etc/snort/rules