Snort配置出错

kyxy3465

我在配置snort的时候，基本已经配置完成了！可以打开
http://127.0.0.1:50080/acid/acid_main.php的时候去提示如下信息：

Warning: session_start(): open(/tmp\sess_d77d3cbbebf5c361e151550d7486b834, O_RDWR) failed: No such file or directory (2) in D:\Apache\Apache2\htdocs\acid\acid_state_common.inc on line 82

Warning: session_start(): Cannot send session cookie - headers already sent by (output started at D:\Apache\Apache2\htdocs\acid\acid_state_common.inc:82) in D:\Apache\Apache2\htdocs\acid\acid_state_common.inc on line 82

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at D:\Apache\Apache2\htdocs\acid\acid_state_common.inc:82) in D:\Apache\Apache2\htdocs\acid\acid_state_common.inc on line 82
   


Warning: Unknown(): open(/tmp\sess_b0a9f1918e3f834a38aba8f169be42b5, O_RDWR) failed: No such file or directory (2) in Unknown on line 0

Warning: Unknown(): Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/tmp) in Unknown on line 0




有哪一位高手帮忙解决一下问题！！！！！！！！

hq8318

据你的错误提示，尝试修改php.ini：
1. session.save_path = "D:/tmp" ;;具体路径自己设置
2. session.auto_start = 0 设为 session.auto_start = 1

kyxy3465

回复 2# hq8318


    谢谢啦！
  我的php装在了D盘：
  1. 在D盘建了文件夹tmp
   2. 按上述方法修改php.int
   没有出现错误提示。
可是在运行snort后出现提示：
Warning: flowbits key 'realplayer.playlist' is checked but not ever set.
acid主页面http://127.0.0.1:50080/acid/acid_main.php
无抓包信息。
这是为何啊？

hq8318

1. 检查有没安装 WinPcap；

2. 进入“mysql> ”命令行下，“mysql> use snort;”接着“mysql> show tables;”，会看到很多表：
+------------------+
| Tables_in_snort |
+------------------+
| acid_ag |
| acid_ag_alert |
| acid_event |
| acid_ip_cache |
………………
………………

3. 如无这些表，执行：
mysql> create database snort;
mysql> grant all privileges on snort.* to ’snort’@'localhost’ identified by ’snort’;
退出mysql运行: mysql -D snort -u snort -p < /usr/src/snort-2.8.3.2/schemas/create_mysql
mysql> flush privileges;

4. 检查是否建立了snort用户：select user,host,password from mysql.user;
    或者尝试登录：mysql -u snort -p -h localhost
(如无snort用户，建立后要重复步骤3)

kyxy3465

1. 检查有没安装 WinPcap；

2. 进入“mysql> ”命令行下，“mysql> use snort;”接着“mysql> show tabl ...
hq8318 发表于 2010-12-27 03:31

按照提示都做了，仍然有问题啊。崩溃。有个04年的贴子也是抓不到包，也是无解。之前本人配置过两次，都未出现此问题。下面是运行snort的结果：
C:\Snort\bin>snort -c "C:\Snort\etc\snort.conf" -l "C:\Snort\log" -d -e -X
Running in IDS mode
Log directory = C:\snort\log

Initializing Network Interface \Device\NPF_{C85BD820-C10E-4FDA-B5FB-784E219726C9
}

        --== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface \Device\NPF_{C85BD820-C10E-4FDA-B5FB-784E219726C9
}
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file C:\snort\etc\snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
,-----------[Flow Config]----------------------
| Stats Interval:  0
| Hash Method:     2
| Memcap:          10485760
| Rows  :          4099
| Overhead Bytes:  16400(%0.16)
`----------------------------------------------
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
    Fragment min_ttl:   0
    Fragment ttl_limit: 5
    Fragment Problems: 0
    Self preservation threshold: 500
    Self preservation period: 90
    Suspend threshold: 1000
    Suspend period: 30
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Evasion alerts: INACTIVE
    Scan alerts: INACTIVE
    Log Flushed Streams: INACTIVE
    MinTTL: 1
    TTL Limit: 5
    Async Link: 0
    State Protection: 0
    Self preservation threshold: 50
    Self preservation period: 90
    Suspend threshold: 200
    Suspend period: 30
Stream4_reassemble config:
    Server reassembly: INACTIVE
    Client reassembly: ACTIVE
    Reassembler alerts: ACTIVE
    Zero out flushed packets: INACTIVE
    flush_data_diff_size: 500
    Ports: 21 23 25 53 80 110 111 143 513 1433
    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
HttpInspect Config:
    GLOBAL CONFIG
      Max Pipeline Requests:    0
      Inspection Type:          STATELESS
      Detect Proxy Usage:       NO
      IIS Unicode Map Filename: C:\snort\etc\unicode.map
      IIS Unicode Map Codepage: 1252
    DEFAULT SERVER CONFIG:
      Ports: 80 8080 8180
      Flow Depth: 300
      Max Chunk Length: 500000
      Inspect Pipeline Requests: YES
      URI Discovery Strict Mode: NO
      Allow Proxy Usage: NO
      Disable Alerting: NO
      Oversize Dir Length: 500
      Only inspect URI: NO
      Ascii: YES alert: NO
      Double Decoding: YES alert: YES
      %U Encoding: YES alert: YES
      Bare Byte: YES alert: YES
      Base36: OFF
      UTF 8: OFF
      IIS Unicode: YES alert: YES
      Multiple Slash: YES alert: NO
      IIS Backslash: YES alert: NO
      Directory Traversal: YES alert: NO
      Web Root Traversal: YES alert: YES
      Apache WhiteSpace: YES alert: YES
      IIS Delimiter: YES alert: YES
      IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
      Non-RFC Compliant Characters: NONE
rpc_decode arguments:
    Ports to decode RPC on: 111 32771
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119
database: compiled support for ( mysql odbc )
database: configured to use mysql
database:          host = localhost
database:          user = snort
database: password is set
database: database name = snort
database: data encoding = hex
database: detail level  = full
database:   sensor name = WHITESHA-A44DC1:\Device\NPF_{C85BD820-C10E-4FDA-B5FB-7
84E219726C9}
database:     sensor id = 1
database: schema version = 106
database: using the "alert" facility
1864 Snort rules read...
1864 Option Chains linked into 187 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Warning: flowbits key 'realplayer.playlist' is checked but not ever set.

+-----------------------[thresholding-config]----------------------------------
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]----------------------------------
| none
+-----------------------[thresholding-local]-----------------------------------
| gen-id=1      sig-id=2495      type=Both       tracking=dst count=20  seconds=
60
| gen-id=1      sig-id=2496      type=Both       tracking=dst count=20  seconds=
60
| gen-id=1      sig-id=2275       type=Threshold tracking=dst count=5   seconds=
60
| gen-id=1      sig-id=2494      type=Both       tracking=dst count=20  seconds=
60
| gen-id=1      sig-id=2523      type=Both       tracking=dst count=10  seconds=
10
+-----------------------[suppression]------------------------------------------
-------------------------------------------------------------------------------
Rule application order: ->activation->dynamic->alert->pass->log

        --== Initialization Complete ==--

-*> Snort! <*-
Version 2.2.0-ODBC-MySQL-FlexRESP-WIN32 (Build 30)
By Martin Roesch (roesch@sourcefire.com, www.snort.org)
1.7-WIN32 Port By Michael Davis (mike@datanerds.net, www.datanerds.net/~mike)
1.8 - 2.x WIN32 Port By Chris Reid (chris.reid@codecraftconsultants.com)

hq8318

“之前本人配置过两次”与现在的系统相同吗，会不会是windows的防火墙作怪？

kyxy3465

回复 6# hq8318


    这个警告解决了。http://www.mcabee.org/lists/snort-users/Aug-04/msg00366.html
    方法：turn on multimedia.rules and then that warning won't show up.
之前的配置环境是win2000，内网。这次是xp，直接放在互联网上。可能是由于电脑装了防火墙和杀毒软件吧，一直无数据。
于是在另外一台电脑上重新操作了，有数据了，以udp为主。

hq8318

你给出的方法，我也搜到并看过，但你的是无数据，故想取消警告作用不大。“另外一台电脑”，是什么配置，linux?现结论是防火墙的问题吧。

kyxy3465

回复 8# hq8318
是啊，警告取消和获取数据貌似无关啊。我还是在win xp下配置的。不同的是没有装杀毒软件和防火墙。之前两次成功经历，均是由几台电脑组成的局域网内，没装独立的杀毒软件和防火墙。
看来是防火墙的事吧，呵呵。