wheezy(debian 7.5)编译安装Snort 2.9.9

Snort 2.99版的官方介绍

先把基本的依赖库安装好

apt-get install -y gcc zlib1g-dev openssl libssl-dev libdumbnet-dev bison flex libdnet

wget http://www.tcpdump.org/release/libpcap-1.8.1.tar.gz
tar xvf libpcap-1.8.1.tar.gz 
cd libpcap-1.8.1/
./configure
make && make install

pcre使用8.4版的，去官网下载并且编译安装

wget https://ftp.pcre.org/pub/pcre/pcre-8.40.tar.gz
tar xvf pcre-8.40.tar.gz 
cd pcre-8.40/
./configure
make && make install

daq直接使用snort官方下载页面上推荐与2.9.9搭配的版本即可

tar xvf daq-2.0.6.tar.gz 
cd daq-2.0.6/
./configure
autoreconf -ivf
make && make install

在Snort 2.9.9的介绍页面中，nghttp2需要被使用，如果你用1.25的版本在wheezy可能装不了，那就用1.19的版本

wget https://github.com/nghttp2/nghttp2/releases/download/v1.19.0/nghttp2-1.19.0.tar.gz
tar xvf nghttp2-1.19.0.tar.gz 
cd nghttp2-1.19.0/
./configure 
make && make install
ldconfig

最后安装snort，这一部可编译的选项比较多，可以自己看一下configure文件帮助

tar xvf snort-2.9.9.0.tar.gz
cd snort-2.9.9.0/
./configure --enable-sourcefire 
autoreconf -ivf
make
make install

启动Snort，运行正常

[root@debian ~]# snort
Running in packet dump mode

        --== Initializing Snort ==--
Initializing Output Plugins!
pcap DAQ configured to passive.
Acquiring network traffic from "eth0".
Decoding Ethernet

        --== Initialization Complete ==--

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.9.9.0 GRE (Build 56) 
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
           Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.8.1
           Using PCRE version: 8.30 2012-02-04
           Using ZLIB version: 1.2.7

Commencing packet processing (pid=18702)
WARNING: No preprocessors configured for policy 0.
07/13-02:06:08.985161 172.16.11.196:22 -> 172.16.11.198:49388
TCP TTL:64 TOS:0x10 ID:35782 IpLen:20 DgmLen:108 DF
***AP*** Seq: 0x4F4E4F4  Ack: 0x35E422BA  Win: 0x677  TcpLen: 20
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

在安装目录下，直接运行

make uninstall
make clean

如果是编译过程出错，要重新编译

make clean
然后再
./configure
make && make install

参考链接：
           1. ubuntu下snort的安装
           2. How to Install Snort on Ubuntu 16