I waited for him to snort, get bug-eyed, break and run.
我等待着它喷鼻息，惊讶得目瞪口呆，然后突然转身逃跑。
By adding the -l switch to Snort, you tell it to log packets to a directory of your choosing (see Listing 11).
通过为Snort添加- l开关，就能告诉它将包记录到您选定的目录中(如清单11所示)。
I seem to remember that I tried to snort dismissively, but I was too cold to manage much more than a subdued grunt.
我记得我曾经想去狠狠地鼻嗤它，但是我当时太冷了，最后只能发出一声软弱无力的呼噜声。
A rule in Snort terminology is just an instruction to Snort; specifically, a rule is about how to inspect, analyze, or report on packets.
规则在Snort术语里面就是Snort指令；具体来讲，规则就是如何检查、分析或报告包。
Sid yawned, stretched, then brought himself up on his elbow with a snort, and began to stare at Tom.
希德打了个呵欠，伸了个懒腰，然后用胳膊肘支起身子，哼了一声，开始瞪着汤姆。
The next priority is to ensure that you can run the Snort command.
下一项优先任务就是确保您能够运行Snort命令。
This file is the source code for Snort, which you can use to generate for your particular platform.
此文件是Snort的源代码，您可以通过此源代码生成您特定的平台。
Rather than you spending hours digging into packets, you can set Snort to handle analysis, and have Snort alert you when there are problems; you do this by giving Snort a set of rules.
不需花大量时间研究包，可以对Snort进行设置来处理分析，并在发生问题时收到Snort的警报；这些功能是通过为Snort指定一组规则实现的。
And just to be safe, don't run this in your Snort installation directory, either.
但为了安全起见，请不要在Snort安装目录中执行此命令。
Listing 12 shows a simple rule you can add to your Snort setup to take care of relaying.
清单12展示了一个示例规则，可以将它添加到Snort设置中处理邮件转发。
First, you need to remove your current Snort installation and rebuild a lot of it.
首先，需要删除当前的Snort安装并重新构建。
Then, what you'll need to get Snort running is a set of rules it can load and work from.
接下来，要运行Snort需要一些可以加载和使用的规则。
Additionally, you'll need to configure Snort and tell it what to do when it senses an attack.
此外，您需要配置Snort，告诉它在感知到攻击时应采取怎样的措施。
With these libraries and tools in place, you're ready to move on to the core Snort configuration and installation.
有了这些库和工具，您就可以转向核心的Snort配置和安装了。
From packet sniffing to analysis to alerting you or an admin to possible intrusions, Snort protects your work from attack.
从包嗅探、分析一直到向您或管理员发出可能出现入侵的警报，Snort能够保护您的工作成果，使之免受攻击。
Unfortunately, Snort wants to write to lots of restricted directories, as well as to run in them.
遗憾的是，Snort需要写入大量受限的目录，并且要在其中运行。
Your next priority is to ensure you can run the snort command.
下一项优先任务就是确保您能够运行snort命令。
In this article, I'll go well beyond installation and configuration, and talk about how to set up Snort to detect Web-related intrusions.
在本文中，我将越过基本的安装和配置知识，讨论如何设置Snort，以检测与Web相关的入侵。
As a Web developer, there's no reason to become a Snort expert, or budget 20% of your Web development time to intrusion detection.
作为Web开发人员，没有必要成为Snort专家，也没有必要将20%的Web开发时间投入到入侵检测的工作之中。
Because the types of intrusions change rapidly, Snort has a set of rules that you can download from the Snort site that details these intrusions and allows Snort to look for them.
由于入侵的类型不断迅速变化，Snort有一组规则，您可从Snort的站点下载这些规则，它们详细阐述了这些入侵，允许Snort观察入侵。
If you're impatient, and simply can't wait to try out snort as an IDS, try running snort -a, which puts snort in alert mode.
如果您耐心不足，或者无法等待尝试将snort作为IDS使用，请尝试运行snort- A，这会将snort切换为警报模式。
Snort expects to find some rule files, but when it doesn't, it errors out.
Snort期望发现一些规则文件，但是没有找到，因此出现错误。
The simplest test you can perform is to run the snort command.
可以执行的最简单的测试就是运行snort 命令。
Run the snort command with the -v flag, which tells snort to sniff network traffic and print out information to the console.
使用- v标记运行snort命令，这告知snort嗅探网络流量，将信息输出到控制台。
So, you can choose to have Snort log to directories you already have access to, and reduce some of the permissions issues.
因此，您可以选择使Snort登录您已经有权访问的目录，减少部分权限问题。
While configuration is a more general set of rules about how Snort should operate, rules tell Snort what to do every time a packet comes across a network interface that Snort monitors.
虽然配置是关于Snort如何操作的更加一般化的规则集，但在包每次跨过所监视的网络接口时，规则将告诉Snort执行什么操作。
Before you can write rules, you need to tell Snort to function as an IDS.
在编写规则之前，需要告诉Snort作为IDS运行。
With a default set of rules, and the tweaks required for Mac OS X implemented if you're using that platform, you're ready to fire up Snort.
具备了默认的规则集，并且对MacOSX(如果使用该平台的话)进行了调整，就可以开始启动Snort了。
Listing 11: Telling Snort where to log packets.
清单11：告诉Snort在何处记录包。
Listing 11: Telling Snort where to log packets.
清单11：告诉Snort在何处记录包。
应用推荐