I waited for him to snort, get bug-eyed, break and run.
我等待着它喷鼻息，惊讶得目瞪口呆，然后突然转身逃跑。
Certainly, if you want to get more into networking, dig into Snort as much as you like.
当然，如果希望进一步了解网络，那么就尽情地研究Snort吧。
By adding the -l switch to Snort, you tell it to log packets to a directory of your choosing (see Listing 11).
通过为Snort添加- l开关，就能告诉它将包记录到您选定的目录中(如清单11所示)。
I seem to remember that I tried to snort dismissively, but I was too cold to manage much more than a subdued grunt.
我记得我曾经想去狠狠地鼻嗤它，但是我当时太冷了，最后只能发出一声软弱无力的呼噜声。
A rule in Snort terminology is just an instruction to Snort; specifically, a rule is about how to inspect, analyze, or report on packets.
规则在Snort术语里面就是Snort指令；具体来讲，规则就是如何检查、分析或报告包。
Sid yawned, stretched, then brought himself up on his elbow with a snort, and began to stare at Tom.
希德打了个呵欠，伸了个懒腰，然后用胳膊肘支起身子，哼了一声，开始瞪着汤姆。
This file is the source code for Snort, which you can use to generate for your particular platform.
此文件是Snort的源代码，您可以通过此源代码生成您特定的平台。
This means that often, even if you can run Snort, you can't use it to do anything productive.
这也就是说，即便您可以运行Snort，通常也无法使用它来做任何有生产意义的事情。
Rather than you spending hours digging into packets, you can set Snort to handle analysis, and have Snort alert you when there are problems; you do this by giving Snort a set of rules.
不需花大量时间研究包，可以对Snort进行设置来处理分析，并在发生问题时收到Snort的警报；这些功能是通过为Snort指定一组规则实现的。
Yes, that's an error, and it's printed here for an important purpose: Snort requires pretty extensive permissions to do much at all.
是的，这是一个错误，在这里输出有一个重要的目的：Snort需要广泛的权限来完成大量工作。
Listing 12 shows a simple rule you can add to your Snort setup to take care of relaying.
清单12展示了一个示例规则，可以将它添加到Snort设置中处理邮件转发。
Then, what you'll need to get Snort running is a set of rules it can load and work from.
接下来，要运行Snort需要一些可以加载和使用的规则。
Additionally, you'll need to configure Snort and tell it what to do when it senses an attack.
此外，您需要配置Snort，告诉它在感知到攻击时应采取怎样的措施。
With these libraries and tools in place, you're ready to move on to the core Snort configuration and installation.
有了这些库和工具，您就可以转向核心的Snort配置和安装了。
From packet sniffing to analysis to alerting you or an admin to possible intrusions, Snort protects your work from attack.
从包嗅探、分析一直到向您或管理员发出可能出现入侵的警报，Snort能够保护您的工作成果，使之免受攻击。
Unfortunately, Snort wants to write to lots of restricted directories, as well as to run in them.
遗憾的是，Snort需要写入大量受限的目录，并且要在其中运行。
In this article, I'll go well beyond installation and configuration, and talk about how to set up Snort to detect Web-related intrusions.
在本文中，我将越过基本的安装和配置知识，讨论如何设置Snort，以检测与Web相关的入侵。
As a Web developer, there's no reason to become a Snort expert, or budget 20% of your Web development time to intrusion detection.
作为Web开发人员，没有必要成为Snort专家，也没有必要将20%的Web开发时间投入到入侵检测的工作之中。
Because the types of intrusions change rapidly, Snort has a set of rules that you can download from the Snort site that details these intrusions and allows Snort to look for them.
由于入侵的类型不断迅速变化，Snort有一组规则，您可从Snort的站点下载这些规则，它们详细阐述了这些入侵，允许Snort观察入侵。
If you're impatient, and simply can't wait to try out snort as an IDS, try running snort -a, which puts snort in alert mode.
如果您耐心不足，或者无法等待尝试将snort作为IDS使用，请尝试运行snort- A，这会将snort切换为警报模式。
Snort expects to find some rule files, but when it doesn't, it errors out.
Snort期望发现一些规则文件，但是没有找到，因此出现错误。
Run the snort command with the -v flag, which tells snort to sniff network traffic and print out information to the console.
使用- v标记运行snort命令，这告知snort嗅探网络流量，将信息输出到控制台。
So, you can choose to have Snort log to directories you already have access to, and reduce some of the permissions issues.
因此，您可以选择使Snort登录您已经有权访问的目录，减少部分权限问题。
While configuration is a more general set of rules about how Snort should operate, rules tell Snort what to do every time a packet comes across a network interface that Snort monitors.
虽然配置是关于Snort如何操作的更加一般化的规则集，但在包每次跨过所监视的网络接口时，规则将告诉Snort执行什么操作。
Most packages like Snort and PCRE will want to write to protected directories that a typical user can't access.
Snort和PCRE等大多数软件包都需要写入受保护的目录，而普通用户通常无法访问这样的目录。
With a default set of rules, and the tweaks required for Mac OS X implemented if you're using that platform, you're ready to fire up Snort.
具备了默认的规则集，并且对MacOSX(如果使用该平台的话)进行了调整，就可以开始启动Snort了。
Listing 11: Telling Snort where to log packets.
清单11：告诉Snort在何处记录包。
The options on this screen all apply to logging; Snort can log to databases when it sniffs packets.
此屏幕上的选项均应用于登录：Snort在嗅探包时可以登录数据库。
Remember, though, if you had to run Snort as supervisor (using sudo) or root, you'll have to open the file using the same permissions.
但务必牢记，如果必须作为超级用户（使用sudo）或root 用户运行Snort，也就必须使用相同的权限打开此文件。
Remember, though, if you had to run Snort as supervisor (using sudo) or root, you'll have to open the file using the same permissions.
但务必牢记，如果必须作为超级用户（使用sudo）或root 用户运行Snort，也就必须使用相同的权限打开此文件。
应用推荐