0x00 來(lái)源

解壓自snortrules-snapshot-2975.tar.gz，來(lái)自于<解壓目錄>/etc/
　　　classification.config
　　　reference.config
　　　sid-msg.map
　　　snort.conf
　　　threshold.conf
　　　unicode.map
將這些.conf和.map文件放在/etc/snort 目錄下，具體的請(qǐng)看 CentOS6.6下基于snort+barnyard2+base的入侵檢測(cè)系統(tǒng)的搭建

0x01 文件內(nèi)容

reference文件一共就這幾行。

# $Id: reference.config,v 1.6 2012/01/06 15:27:28 hcao Exp $
# The following defines URLs for the references found in the rules
#
# config reference: system URL

config reference: bugtraq   http://www.securityfocus.com/bid/ 
config reference: cve       http://cve.mitre.org/cgi-bin/cvename.cgi?name=
config reference: arachNIDS http://www.whitehats.com/info/IDS
config reference: osvdb     http://osvdb.org/show/osvdb/

# Note, this one needs a suffix as well.... lets add that in a bit.
config reference: McAfee    http://vil.nai.com/vil/content/v_
config reference: nessus    http://cgi.nessus.org/plugins/dump.php3?id=
config reference: url       http://
config reference: msb       http://technet.microsoft.com/en-us/security/bulletin/

我們可以看到這都是一些安全網(wǎng)站，漏洞平臺(tái)的網(wǎng)址，或者是自己可以自定義的url。

0x02 修飾符

reference修飾符，字面意思就是“參考”，我覺(jué)得沒(méi)多大作用，就是聯(lián)系外部的惡意攻擊檢測(cè)網(wǎng)站中關(guān)于此類(lèi)攻擊的頁(yè)面。
舉個(gè)例子。

alert tcp any any -> any 21 (msg:"IDS287/ftp-wuftp260-venglin-linux"; flags:AP; content:"|31c031db 31c9b046 cd80 31c031db|"; reference:arachnids,IDS287; reference:bugtraq,1387; reference:cve,CAN-2000-1574;)

上面定義了三個(gè)reference，拿一個(gè)來(lái)講，reference:cve,CAN-2000-1574。
我們從reference.config文件中看到關(guān)于cve網(wǎng)站的定義
config reference: cve http://cve.mitre.org/cgi-bin/cvename.cgi?name=
這里就相當(dāng)于構(gòu)造了這么一個(gè)url
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1574

把name后面的具體的ID號(hào)給填寫(xiě)上了，形成如下圖這種效果：

reference

點(diǎn)擊一下，就會(huì)跳到對(duì)應(yīng)的網(wǎng)站這個(gè)漏洞的頁(yè)面上去了。

0x03 數(shù)據(jù)庫(kù)

與reference有關(guān)系的有三個(gè)表，

mysql> desc reference_system;
+-----------------+------------------+------+-----+---------+----------------+
| Field           | Type             | Null | Key | Default | Extra          |
+-----------------+------------------+------+-----+---------+----------------+
| ref_system_id   | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| ref_system_name | varchar(20)      | YES  |     | NULL    |                |
+-----------------+------------------+------+-----+---------+----------------+
2 rows in set (0.00 sec)

mysql> desc reference
    -> ;
+---------------+------------------+------+-----+---------+----------------+
| Field         | Type             | Null | Key | Default | Extra          |
+---------------+------------------+------+-----+---------+----------------+
| ref_id        | int(10) unsigned | NO   | PRI | NULL    | auto_increment |
| ref_system_id | int(10) unsigned | NO   |     | NULL    |                |
| ref_tag       | text             | NO   |     | NULL    |                |
+---------------+------------------+------+-----+---------+----------------+
3 rows in set (0.01 sec)

mysql> desc sig_reference;
+---------+------------------+------+-----+---------+-------+
| Field   | Type             | Null | Key | Default | Extra |
+---------+------------------+------+-----+---------+-------+
| sig_id  | int(10) unsigned | NO   | PRI | NULL    |       |
| ref_seq | int(10) unsigned | NO   | PRI | NULL    |       |
| ref_id  | int(10) unsigned | NO   |     | NULL    |       |
+---------+------------------+------+-----+---------+-------+
3 rows in set (0.00 sec)

未完待續(xù)，但是感覺(jué)這部分和入侵檢測(cè)關(guān)系不大。