使用Python和Suricata进行网络入侵检测

sudo apt-get install suricata
sudo service suricata start

import subprocess
import socket

def main():
    HOST = '0.0.0.0'
    PORT = 8888

    # 创建socket对象
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    # 绑定IP地址和端口号
    s.bind((HOST, PORT))
    # 监听连接
    s.listen(1)
    print('Listening on {}:{}'.format(HOST, PORT))

    while True:
        # 接收客户端连接
        conn, addr = s.accept()
        print('Connected by', addr)

        # 调用Suricata进行分析
        try:
            suricata_output = subprocess.check_output(['suricata', '-r', '-'], stdin=conn.makefile('rb'))
            print(suricata_output)
        except Exception as e:
            print('Error: {}'.format(e))

        # 关闭连接
        conn.close()

if __name__ == '__main__':
    main()

telnet localhost 8888
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
pidancode.com