1
0
mirror of https://github.com/vimagick/dockerfiles.git synced 2024-12-23 01:39:27 +02:00
dockerfiles/snort/README.md

38 lines
1013 B
Markdown
Raw Normal View History

2015-09-03 04:08:27 +02:00
snort
=====
2015-09-02 19:58:29 +02:00
![](https://badge.imagelayers.io/vimagick/snort:latest.svg)
[`Snort`][1] is an open source intrusion prevention system capable of real-time
traffic analysis and packet logging.
2018-08-26 08:55:20 +02:00
```yaml
snort:
image: vimagick/snort
command: -q -c /etc/snort/snort.conf -A console -i ens3
volumes:
- ./data/snort.conf:/etc/snort/snort.conf
- ./data/rules:/etc/snort/rules
- ./data/log:/var/log/snort
cap_add:
- NET_ADMIN
net: host
tty: true
restart: unless-stopped
```
2015-09-03 04:08:27 +02:00
2018-08-26 08:55:20 +02:00
```bash
# /etc/snort/rules/local.rules
alert icmp any any -> any any (msg:"ICMP Echo Request"; itype:8; sid:10000;)
alert icmp any any -> any any (msg:"ICMP Echo Reply"; itype:0; sid:10001;)
2015-09-03 04:08:27 +02:00
```
2018-08-26 08:55:20 +02:00
```bash
$ docker-compose up -d
$ docker-compose logs --tail 10 -f
snort_1 | 08/26-06:47:35.460754 [**] [1:10000:0] ICMP Echo Request [**] [Priority: 0] {ICMP} x.x.x.x -> y.y.y.y
snort_1 | 08/26-06:47:35.460835 [**] [1:10001:0] ICMP Echo Reply [**] [Priority: 0] {ICMP} y.y.y.y -> x.x.x.x
2015-09-03 04:08:27 +02:00
```
2015-09-02 19:58:29 +02:00
[1]: https://snort.org/