LINUX security snort Configuration

Groupadd snort
Useradd-g snort-s/bin/false
Passwd-S snort
Mkdir-p/etc/snort/rules
Mkdir-p/var/log/snort/archive
Chown-R snort. snort/var/log/snort
Cd etc; cp */etc/snort
Sniffer
Snort-dev
-V
Using this command, only the IP address and TCP/UDP/ICMP packet header information will be output by snort.
-Vd
View data at the application layer
-E
Display data link layer data
Snort Command Parameters
-L log
Put all intercepted data packets in a file
-B
Data packets are intercepted in binary format and can be unwrapped in some software.
The most important use of snort is as a network intrusion detection system (NIDS). Use the following command line to start this mode:
./Snort-d-l./log-h 192.168.0.0/24-c snort. conf