安裝Snort 

參考 在Ubuntu14.04上安裝Snort


安裝PF_RING 

$ git clone https://github.com/ntop/PF_RING.git
$ cd PF_RING/kernel
$ make
$ sudo insmod ./pf_ring.ko
$ cd ../userland
$ make
$ cd [PF_RING PATH]/userland/lib
$ sudo ./configure
$ sudo make
$ sudo make install


安裝pfring-daq-module

$ cd [PF_RING PATH]/userland/snort/pfring-daq-module
$ autoreconf -ivf
$ sudo ./configure
$ sudo make
$ sudo make install


於IDS mode執行Snort

$ sudo snort --daq-dir=/usr/local/lib/daq --daq pfring --daq-mode passive -i eth0 -v -e