{"id":894,"date":"2010-07-05T23:14:37","date_gmt":"2010-07-05T23:14:37","guid":{"rendered":"http:\/\/pchero21.com\/?p=894"},"modified":"2010-07-05T23:14:37","modified_gmt":"2010-07-05T23:14:37","slug":"9-%ec%8a%a4%eb%85%b8%ed%8a%b8-%ea%b7%9c%ec%b9%99%ec%9d%84-iptables-%ea%b7%9c%ec%b9%99%ec%9c%bc%eb%a1%9c-%eb%b3%80%ed%99%98","status":"publish","type":"post","link":"http:\/\/pchero21.com\/?p=894","title":{"rendered":"9.\uc2a4\ub178\ud2b8 \uaddc\uce59\uc744 iptables \uaddc\uce59\uc73c\ub85c \ubcc0\ud658"},"content":{"rendered":"

 * \ub4e4\uc5b4\uac00\uba70..<\/span><\/p>\n

 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc744 \ud56d\uc0c1 \uae54\ub054\ud558\uac8c \ubcc0\ud65c\ud560 \uc218\ub294 \uc5c6\uc73c\uba70, \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc5b8\uc5b4\ub294 \ub9e4\uc6b0 \ubcf5\uc7a1\ud558\uae30 \ub54c\ubb38\uc5d0 fwsnort\ub294 \uc2a4\ub178\ud2b8 \ubc84\uc804 2.3.3 \uc5d0 \ud3ec\ud568\ub41c \uaddc\uce59\uc758 \uc57d 60% \uc815\ub3c4\ub97c \ubcc0\ud658\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 fwsnort\uac00 \uc804\uccb4 \uc2a4\ub178\ud2b8 \uc11c\uba85 \uc9d1\ud569\uc744 iptables \uaddc\uce59\uc73c\ub85c \ubcc0\ud65c\ud560 \uc218\ub294 \uc5c6\uc9c0\ub9cc fwsnort \ub294 \ud56d\uc0c1 \ub124\ud2b8\uc6cc\ud06c \ud2b8\ub798\ud53d\uc5d0 \uc778\ub77c\uc778\uc73c\ub85c \ubc30\uce58\ub41c\ub2e4. \uc2a4\ub178\ud2b8\ub294 \uc8fc\ub85c \uc218\ub3d9\uc801 \uc804\ub7b5\uc73c\ub85c \ubc30\uce58\ub418\uba70 \ub124\ud2b8\uc6cc\ud06c \ud2b8\ub798\ud53d\uc5d0\uc11c \uc218\uc0c1\ud55c \ud65c\ub3d9\uc744 \uac10\uc2dc\ud558\ub294 \ub370 \uc4f0\uc778\ub2e4. \uc989, \uc2a4\ub178\ud2b8\ub294 \uc778\ub77c\uc778 \uae30\ub2a5\uc744 \uc9c0\uc6d0\ud568\uc5d0\ub3c4 \ubd88\uad6c\ud558\uace0 \ub300\uac1c \uc778\ub77c\uc778\uc73c\ub85c \ubc30\uce58\ub418\uc9c0 \uc54a\ub294\ub2e4. fwsnort\uac00 \uc0dd\uc131\ud55c \ubaa8\ub4e0 \uc815\ucc45\uc740 \uc218\ub3d9\uc801 \ud328\ud0b7 \uc870\uc0ac\uc5d0 \uad6d\ud55c\ub418\uc9c0 \uc54a\ub294\ub2e4. fwsnort\uac00 \uc0dd\uc131\ud55c \ubaa8\ub4e0 \uc815\ucc45\uc740 \uc218\ub3d9\uc801 \ud328\ud0b7 \uc870\uc0ac\uc5d0 \uad6d\ud55c\ub418\uc9c0 \uc54a\ub294\ub2e4. fwsnort \uc815\ucc45\uc740 iptables DROP \ud0c0\ucf13\uc744 \ud1b5\ud574 \uc545\uc758\uc801\uc778 \ud328\ud0b7\uc744 \ubc84\ub9ac\uac8c \uc124\uc815\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc5b8\uc5b4\uc758 \uc735\ud1b5\uc131\uacfc \uc644\uacb0\uc131\uc740 \uc2a4\ub178\ud2b8\uac00 \ub124\ud2b8\uc6cc\ud06c \uae30\ubc18 \uacf5\uaca9\uc758 \uc124\uba85\uc801 \ud45c\ud604\uc744 \uac80\uc0c9\ud560 \uc218 \uc788\uac8c \ud574\uc8fc\uba70, \uacf5\uaca9\uc774 \ub124\ud2b8\uc6cc\ud06c\ub97c \ud1b5\ud574 \uc804\uc1a1\ub420 \ub54c \uc774\uc5d0 \uc751\ub2f5\ud560 \uc218 \uc788\uac8c \ud574\uc900\ub2e4. \uc774\uac83\uc774 \uc2a4\ub178\ud2b8\ub97c \ucd5c\uace0\uc758 \ub124\ud2b8\uc6cc\ud06c \uce68\uc785 \ud0d0\uc9c0\uc640 \ubc29\uc9c0 \ub3c4\uad6c\uc758 \ud558\ub098\ub85c \uad73\uac8c \uc790\ub9ac\ub9e4\uae40\ud574\uc900 \uae30\ub2a5\uc774\ub2e4.<\/p>\n

 \uadf8\ub7ec\ub098 \uc88b\uc740 \uce68\uc785 \ubc29\uc9c0 \uc2dc\uc2a4\ud15c(IPS)\uc774 \ud6a8\uacfc\uc801\uc778 \ubc29\ud654\ubcbd\uc758 \uc644\ubcbd\ud55c \ub300\uccb4 \uc218\ub2e8\uc774 \ub418\ub294 \uac83\uc740 \uc808\ub300 \uc544\ub2c8\ub2e4. \ubc29\ud654\ubcbd\uacfc \uce68\uc785 \ubc29\uc9c0 \uc2dc\uc2a4\ud15c\uc740 \uc77c\ubc18\uc801\uc73c\ub85c \uc11c\ub85c \ubc18\ub300 \uad00\uc810\uc5d0\uc11c \ubcf4\uc548 \uac15\ud654\uc5d0 \uc811\uadfc\ud55c\ub2e4. \ubc29\ud654\ubcbd\uc740 \ubcf4\uc548 \uc815\ucc45\uc5d0 \uae30\ubc18\ud574\uc11c \ud5c8\uc6a9 \uac00\ub2a5\ud55c \ud2b8\ub798\ud53d\uc744 \uc815\uc758\ud558\uace0 \uc815\ucc45\uc744 \ub530\ub974\uc9c0 \uc54a\ub294 \ud2b8\ub798\ud53d\uc744 \ucc28\ub2e8(\uadf8\ub9ac\uace0 \uae30\ub85d)\ud55c\ub2e4. \ubc18\uba74 \uce68\uc785 \ubc29\uc9c0 \uc2dc\uc2a4\ud15c\uc740 \ud5c8\uc6a9\ud560 \uc218 \uc5c6\ub294 \ub124\ud2b8\uc6cc\ud06c \ud2b8\ub798\ud53d\uc744 \uc815\uc758\ud558\uace0 \uc774\ub7f0 \ud65c\ub3d9\ub9cc \ucc28\ub2e8(\ub610\ub294 \uc751\ub2f5)\ud55c\ub2e4.<\/p>\n

 \uc774\uc640 \ub3d9\uc2dc\uc5d0 \ubc29\ud654\ubcbd\uacfc IPS \uad6c\ud604\uc758 \uacbd\uacc4\ub294 \uc774 \ub458\uc774 \uc735\ud569\ud558\uba74\uc11c \uc810\ucc28 \ubd88\ubd84\uba85\ud574\uc9c0\uae30 \uc2dc\uc791\ud588\ub2e4. \ubc29\ud654\ubcbd\uc740 \uc880 \ub354 \ub9ce\uc740 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ucc98\ub9ac \uae30\ub2a5(\uc624\ub7ab\ub3d9\uc548 \uce68\uc785 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c\ub9cc\uc758 \uae30\ub2a5\uc774\uc5c8\ub2e4)\uc744 \uac00\uc9c0\uac8c \ub410\uace0 \uce68\uc785 \ubc29\uc9c0 \uc2dc\uc2a4\ud15c\uc740 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ucc98\ub9ac\uc640 \ub3c5\ub9bd\uc801\uc778 \uae30\ubcf8\uc801\uc778 \ud544\ud130\ub9c1 \uae30\ub2a5\uc744 \uc81c\uacf5\ud558\uac8c \ub418\uc5c8\ub2e4.<\/p>\n

 * fwsnort\ub97c \uc0ac\uc6a9\ud574\uc57c \ud558\ub294 \uc774\uc720<\/span><\/p>\n

 fwsnort \ud504\ub85c\uc81d\ud2b8\ub294 \ub9ac\ub205\uc2a4 \uc2dc\uc2a4\ud15c\uacfc \ud1b5\uc2e0\ud558\uac8c \ud5c8\uc6a9\ub418\ub294 \ud328\ud0b7\uc758 \uc720\ud615\uc744 \uc81c\uc5b4\ud558\ub294 \ub9ac\ub205\uc2a4 \ucee4\ub110\uc758 \uae30\ub2a5\uc744 \ud5a5\uc0c1\uc2dc\ud0a4\ub294 \ub370 \ucd08\uc810\uc744 \ub450\uace0 \uc788\ub2e4. \uc2a4\ub178\ud2b8 \uc11c\uba85 \uc5b8\uc5b4\uc758 \uac15\ub825\ud568\uc5d0 \ub9ac\ub205\uc2a4 \ucee4\ub110\uc758 \uc18d\ub3c4\uc640 iptables \uba85\ub839\uc758 \uac04\uacb0\uc131\uc744 \uacb0\ud569\ud568\uc73c\ub85c\uc368 fwsnort\ub294 \uae30\uc874 IPD\/IPS \uc778\ud504\ub77c\uc2a4\ud2b8\ub7ed\ucc98\uc758 \ubcf4\uc548 \uc804\ub7b5\uc744 \ubcf4\uc644\ud560 \uc218 \uc788\ub2e4. fwsnort \ub294 \ub2e8\uc21c\ud788 iptables \uba85\ub839\uc744 \uc2e4\ud589(\uc8fc\ub85c \ub9d0\ub2e8 \ud638\uc2a4\ud2b8\uc5d0\uc11c \uc2e4\ud589)\ud558\ub294 \uc258 \uc2a4\ud06c\ub9bd\ud2b8\ub97c \uc791\uc131\ud558\uae30 \ub54c\ubb38\uc5d0 fwsnort\ub97c \ub2e4\ub978 IDS\/IPS\uc640 \ud568\uaed8 \ubc30\uce58\ud558\ub294 \uac83\uc740 \ub9e4\uc6b0 \uc27d\ub2e4. \ub354\uc6b1\uc774 iptables\ub294 \ub124\ud2b8\uc6cc\ud06c \ud2b8\ub798\ud53d\uc5d0 \ud56d\uc0c1 \uc778\ub77c\uc778\uc774\uae30 \ub54c\ubb38\uc5d0 \uc548\uc815\uc131\uacfc \uc18d\ub3c4 \uce21\uba74\uc5d0\uc11c \uc5c4\uaca9\ud558\uac8c \ud14c\uc2a4\ud2b8\ub410\ub2e4.<\/p>\n

 ** \ucca0\uc800\ud55c \ubc29\uc5b4<\/p>\n

 \uae0d\uc815 \uc624\ub958\ub97c \uc0dd\uc131\ud558\uac8c \ud558\ub294 \ubc29\ubc95\uc73c\ub85c IDS \uacbd\uace0 \uae30\ub2a5\uc744 \uc804\ubcf5\ud558\ub824\ub294 \uc2dc\ub3c4\uc5d0\uc11c IDS \ub0b4\uc5d0 \uc874\uc7ac\ud558\ub294 \ucde8\uc57d\uc810\uc744 \uc774\uc6a9\ud574\uc11c \ucf54\ub4dc\ub97c \uc2e4\ud589\ud558\ub824\ub294 \uc2dc\ub3c4\uc5d0 \uc774\ub974\uae30\uae4c\uc9c0 \uce68\uc785 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c \uc790\uccb4\uac00 \uacf5\uaca9 \ubaa9\ud45c\uac00 \ub418\ub294 \uacbd\uc6b0\ub3c4 \ub9ce\ub2e4.<\/p>\n

 \ucca0\uc800\ud55c \ubc29\uc5b4\uc758 \uc6d0\ub9ac\ub294 \uc804\ud615\uc801\uc778 \ucef4\ud4e8\ud130 \uc2dc\uc2a4\ud15c(\uc11c\ubc84\uc640 \ub370\uc2a4\ud06c\ud1b1)\ubfd0\ub9cc \uc544\ub2c8\ub77c \ubc29\ud654\ubcbd\uc774\ub098 \uce68\uc785 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c\uacfc \uac19\uc740 \ubcf4\uc548 \uc778\ud504\ub77c\uc2a4\ud2b8\ub7ed\ucc98\uc5d0\ub3c4 \uc801\uc6a9\ub41c\ub2e4. \uadf8\ub7ec\ubbc0\ub85c \uae30\uc874\uc758 \uce68\uc785 \ud0d0\uc9c0\/\ubc29\uc9c0 \uc2dc\uc2a4\ud15c\uc744 \ucd94\uac00\uc801\uc778 \ubc29\ubc95\uc73c\ub85c \ubcf4\ucda9\ud560 \uc5ec\uc9c0\uac00 \uc788\ub2e4.<\/p>\n

 ** \ubaa9\ud45c \uae30\ubc18 \uce68\uc785 \ud0d0\uc9c0\uc640 \ub124\ud2b8\uc6cc\ud06c \uacc4\uce35 \ube44\ub2e8\ud3b8\ud654<\/p>\n

 IDS \uc5d0 \ud0d0\uc9c0 \ub3d9\uc791\uacfc \ub9d0\ub2e8 \ud638\uc2a4\ud2b8\uc758 \ud2b9\uc9d5\uc744 \uacb0\ud569\ud560 \uc218 \uc788\uac8c \ud574\uc8fc\ub294 \uae30\ub2a5\uc744 \ucd94\uac00\ud558\ub294 \uac83\uc744 \ubaa9\ud45c \uae30\ubc18 \uce68\uc785 \ud0d0\uc9c0(target-based intrusion detection)\uc774\ub77c\uace0 \ud55c\ub2e4. <\/p>\n

 \uc608\ub97c \ub4e4\uc5b4 \uc708\ub3c4\uc6b0 \uc2dc\uc2a4\ud15c\uc5d0 \ub300\ud574 \ub2e8\ud3b8\ud654\ub41c \uacf5\uaca9\uc774 \uc804\uc1a1\ub418\ub294\ub370, \uc2a4\ub178\ud2b8\ub294 \ub9ac\ub205\uc2a4 IP \uc2a4\ud0dd\uc774 \uc0ac\uc6a9\ud558\ub294 \uc54c\uace0\ub9ac\uc998\uc73c\ub85c \uacf5\uaca9\uc744 \ube44\ub2e8\ud3b8\ud654\ud55c\ub2e4\uba74 \uacf5\uaca9\uc744 \ub193\uce58\uac70\ub098 \uc798\ubabb \ubcf4\uace0\ud560 \uc218 \uc788\ub2e4.<\/p>\n

  fwsnort \uc758 \uacbd\uc6b0(\uacf5\uaca9\uc790\uac00 \ubaa9\ud45c\ub85c \uc0bc\uc740 \ub3d9\uc77c\ud55c \uc2dc\uc2a4\ud15c\uc5d0 \ub85c\uceec\ud558\uac8c \ubc30\uce58\ub420 \ub54c\ub294 \ud2b9\ud788) \ub2e8\ud3b8\ud654 \ubb38\uc81c\uc5d0 \ub300\ud574 \uc2e0\uacbd \uc4f8 \ud544\uc694\uac00 \uc5c6\ub2e4. fwsnort \uc5d0 \uc801\uc6a9\ub41c \ub2e8\ud3b8\ud654 \uc54c\uace0\ub9ac\uc998\uc740 \uc2e4\uc81c \uacf5\uaca9 \ub300\uc0c1 IP \uc2a4\ud0dd\uc758 \uc54c\uace0\ub9ac\uc998\uc774\uae30 \ub54c\ubb38\uc774\ub2e4. fwsnort\ub97c \uc0ac\uc6a9\ud558\uba74 \ub124\ud2b8\uc6cc\ud06c \ub2e8\ud3b8\ud654\ub294 (\ud328\ud0b7\uc744 \uc62c\ubc14\ub978 \uc5f0\uacb0\ub85c \ubd84\ub958\ud558\uae30 \uc704\ud574 \ud2b8\ub798\ud53d\uc744 \ube44\ub2e8\ud3b8\ud654\ud574\uc57c \ud558\ub294) \ub137\ud544\ud130 \uc5f0\uacb0\ucd94\uc801 \ud558\uc704\uc2dc\uc2a4\ud15c\uc744 fwsnort \uc815\ucc45\uacfc \ud568\uaed8 \uc0ac\uc6a9\ud558\ub294 \ubc29\ubc95\uc73c\ub85c \uc218\ud589\ub41c\ub2e4. fwsnort\uac00 \uc218\ud589\ud558\ub294 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \uc870\uc0ac\ub294 \ub9ac\ub205\uc2a4 IP \uc2a4\ud0dd\uc774 \uc774\ubbf8 \ud2b8\ub798\ud53d\uc744 \ub2e8\ud3b8\ud654\ud55c \ud6c4\uc5d0 \uc77c\uc5b4\ub09c\ub2e4.<\/p>\n

 – fwsnort\uc640 iptables\ub97c \uc774\uc6a9\ud558\uba74 \ub2e8\ud3b8\ud654\ub41c \uacf5\uaca9\uc5d0 \ub300\ud574\uc11c\ub294 \ub35c \uac71\uc815\ud574\ub3c4 \ub418\uc9c0\ub9cc \ubaa9\ud45c \uae30\ubc18 \uce68\uc785 \ud0d0\uc9c0\uc758 \uc7a5\uc810\uc774 \ub124\ud2b8\uc6cc\ud06c \ub2e8\ud3b8\ud654 \ubb38\uc81c \ub54c\ubb38\uc5d0 \uc81c\ud55c\ub418\ub294 \uac83\uc740 \uc544\ub2c8\uba70 \ub2e8\ud3b8\ud654 \ubb38\uc81c\ub294 IDS \ucee4\ubba4\ub2c8\ud2f0\uc5d0\uc11c \ud65c\ubc1c\ud55c \uc5f0\uad6c \uac1c\ubc1c\uc774 \uc9c4\ud589 \uc911\uc778 \ubd84\uc57c\ub2e4. \uc608\ub97c \ub4e4\uc5b4 IDS\ub294 \uc7a0\uc7ac\uc801\uc778 \uae0d\uc815 \uc624\ub958\ub97c \ud310\ubcc4\ud558\uac70\ub098 \ubcf4\uace0\ub41c \uacf5\uaca9\uc758 \uc2ec\uac01\uc131\uc744 \uc880 \ub354 \uc815\ud655\ud788 \ud310\ub2e8\ud558\uae30 \uc704\ud574 OS\uc640 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uc815\ubcf4\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4. \uc608\ub97c \ub4e4\uc5b4 \ub9c8\uc774\ud06c\ub85c\uc18c\ud504\ud2b8 IIS \uc6f9\uc11c\ubc84\uc758 \ubc84\ud37c \uc624\ubc84\ud50c\ub85c\uc6b0\ub97c \uc774\uc6a9\ud558\ub294 \uacf5\uaca9\uc740 \uc544\ud30c\uce58 \uc6f9\uc11c\ubc84\ub85c \uc804\uc1a1\ub418\uba74 \ubaa9\ud45c\uc5d0 \uc808\ub300 \uce68\ud22c\ud560 \uc218 \uc5c6\ub2e4. IDS\uac00 \uc774\uacf5\uaca9\uc744 \ud0d0\uc9c0\ud558\ub294 \uacbd\uc6b0 \uc774\ubca4\ud2b8\uc758 \uc2ec\uac01\uc131\uc740 \uacf5\uaca9\uc774 \uc2e4\uc81c IIS \uc11c\ubc84\ub85c \uc804\ub2ec\ub410\uc744 \ub54c\ubcf4\ub2e4 \uc0c1\ub2f9\ud788 \ub0ae\uc544\uc57c \ud55c\ub2e4.<\/p><\/blockquote>\n

 ** \uc801\uc740 \uc790\uc6d0 \uc0ac\uc6a9<\/p>\n

 \uc0ac\uc6a9\ub7c9\uc774 \ub9ce\uc740 \uc2dc\uc2a4\ud15c\uc740 \uce68\uc785 \ud0d0\uc9c0\ub97c \uc704\ud574 \uc0ac\uc6a9\uc790 \ud504\ub85c\uc138\uc2a4(\uc608\ub97c \ub4e4\uc5b4 \uc2a4\ub178\ud2b8)\ub97c \ucd94\uac00\ub85c \uc2e4\ud589\ud558\uae30\uc5d0\ub294 \uc790\uc6d0\uc774 \ubd80\uc871\ud560 \uc218 \uc788\ub2e4. fwsnort\uc758 \uacbd\uc6b0 \ud328\ud0b7 \uc870\uc0ac\uac00 \ub9ac\ub205\uc2a4 \ucee4\ub110 \ub0b4\ubd80\uc5d0\uc11c \uc9c1\uc811 \uc77c\uc5b4\ub098\uba70, \uc774\ub294 \uc8fc\ub85c \uc2dc\uc2a4\ud15c \uc790\uc6d0\uc744 \uc870\uae08\ub9cc \uc0ac\uc6a9\ud55c\ub2e4. (\uc77c\ubc18\uc801\uc778 IPS\uc640 \ub2ec\ub9ac) \ucee4\ub110 \uacf5\uac04\uc5d0\uc11c \uc0ac\uc6a9\uc790 \uacf5\uac04 \ud504\ub85c\uc138\uc2a4\ub85c \uba54\ubaa8\ub9ac\ub97c \ubcf5\uc0ac\ud560 \ud544\uc694\uac00 \uc5c6\ub2e4. \uc790\uc6d0 \uc81c\uc57d \ub54c\ubb38\uc5d0 IDS\/IPS \ub97c \uc124\uce58\ud558\uae30 \ud798\ub4e0 \uc2dc\uc2a4\ud15c\uc774\ub77c\uba74 fwsnort \uac00 \uc801\uc808\ud55c \ub300\uc548\uc774\ub2e4.<\/p>\n

 ** \uc778\ub77c\uc778 \uc751\ub2f5<\/p>\n

 fwsnort\uac00 \uc0dd\uc131\ud558\ub294 iptables \uc11c\uba85 \uc815\ucc45\uc740 \ud56d\uc0c1 \ub124\ud2b8\uc6cc\ud06c \ud2b8\ub798\ud53d\uc5d0 \uc778\ub77c\uc778\uc774\uae30 \ub54c\ubb38\uc5d0 \ud2b9\ud788 \uc545\uc758\uc801\uc778 \ud2b9\uc815 \uacf5\uaca9\uc5d0 \uc870\uce58\ub97c \ucde8\ud560 \ub54c\uc5d0\ub294 iptables \uc774 \uc774\uc0c1\uc801\uc77c \uc218 \uc788\ub2e4.<\/p>\n

 \uc11c\ubc84\uc758 \uac00\ub3d9 \uc2dc\uac04\uc774 \uc11c\ube44\uc2a4 \uc218\uc900 \uacc4\uc57d\uc11c (SLA, Service Level Agreement)\ub97c \ub530\ub77c\uc57c \ud558\ub294 \uacbd\uc6b0\uc5d0\ub294 \uc11c\ubc84\ub97c \uc911\ub2e8\ud558\uace0 \ud328\uce58\ud558\uae30 \uc804\uc5d0 \ub300\uae30 \uc2dc\uac04\uc774 \uc788\uc744 \uc218 \uc788\ub2e4. \ubb3c\ub860 \uc774\ub294 \ucde8\uc57d\uc810\uc744 \uc218\uc815\ud560 \ud328\uce58\uac00 \uc874\uc7ac\ud55c\ub2e4\uace0 \uac00\uc815\ud55c\ub2e4(\uadf8\ub7ec\ub098 \ud328\uce58\uac00 \ud56d\uc0c1 \uc874\uc7ac\ud558\ub294 \uac83\uc740 \uc544\ub2c8\ub2e4). \ud328\uce58\ub97c \uc801\uc6a9\ud558\uae30 \uc704\ud574 \uc11c\ube44\uc2a4 \uc911\ub2e8 \uc2dc\uac04\uc744 \uc7a1\uc744 \uc218 \uc788\uae30 \uc804\uae4c\uc9c0\ub294 \uc0ac\uc6a9\uc790\uac00 \uc11c\ubc84 \uc18c\ud504\ud2b8\uc6e8\uc5b4\ub97c \uc774\uc6a9\ud560 \uc218 \uc788\uc5b4\uc57c \ud55c\ub2e4\uba74 \uc778\ub77c\uc778 \ubc29\uc9c0 \uae30\ubc95\uc774 \ucde8\uc57d\uc810\uc5d0 \ub300\ud55c \uacf5\uaca9\uc73c\ub85c\ubd80\ud130 \uc11c\ubc84\ub97c \uc801\uc808\ud788 \ubcf4\ud638\ud560 \uc218 \uc788\ub2e4(\ub610 fwsnort \uc815\ucc45\uc740 \uacbd\ub7c9\uc774\uae30 \ub54c\ubb38\uc5d0 \ub300\uac1c\ub294 \uc778\ub77c\uc778 \ubaa8\ub4dc\ub85c \uc2e4\ud589\uc911\uc778 \uc2a4\ub178\ud2b8\uc640 \uac19\uc740 \ub2e4\ub978 \ubc29\uc9c0 \uae30\ubc95\uacfc \ud568\uaed8 \ubc30\uce58\ub420 \uc218 \uc788\ub2e4).<\/p>\n

 – fwsnort\ub294 \ub2e8\uc21c\ud788 iptables\ub97c \uc2e4\ud589\ud558\uae30 \uc704\ud55c \uc258 \uc2a4\ud06c\ub9bd\ud2b8\ub97c \uc791\uc131\ud558\uae30 \ub54c\ubb38\uc5d0 SSH\ub97c \ud1b5\ud574 \ud55c\ubc88\uc5d0 \uc5ec\ub7ec \uc6d0\uaca9 \uc2dc\uc2a4\ud15c\uc5d0 \uba85\ub839\uc5b4\ub97c \uc2e4\ud589\ud560 \uc218 \uc788\ub294 \uc81c\ub178\uc2a4(Zenoss, http:\/\/www.zenos.org)\uc640 \uac19\uc740 \uac83\uc744 \uac16\ucd98 \uc2dc\uc2a4\ud15c\uc5d0 \uc27d\uac8c \ubc30\uce58\ud560 \uc218 \uc788\ub2e4. Zenoss \ub294 \uc2dc\uc2a4\ud15c \uc778\ud504\ub77c\uc2a4\ud130\ub7ed\ucc98\uc758 \ubaa8\ub4e0 \ub9ac\ub205\uc2a4 \uc2dc\uc2a4\ud15c\uc5d0 fwsnort \ub97c \uc27d\uac8c \ubc30\uce58\ud560 \uc218 \uc788\uac8c \ud574\uc900\ub2e4.<\/p><\/blockquote>\n

 * fwsnort\uc758 \uc2a4\ub178\ud2b8 \uaddc\uce59 \ud574\uc11d<\/span><\/p>\n

 \uc2a4\ub178\ud2b8\uac00 \uc81c\uacf5\ud558\ub294 \uae30\ub2a5\uc5d0 \ube44\ud574 iptables\uac00 \uc81c\uacf5\ud558\ub294 \uae30\ub2a5\uc774 \uac00\uc9c0\ub294 \ud55c\uacc4 \ub54c\ubb38\uc5d0 \ubaa8\ub4e0 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc774 \ubcc0\ud658\ub420 \uc218 \uc788\ub294 \uac74 \uc544\ub2c8\ub2e4. \ub4a4\uc5d0\uc11c \uc124\uba85\ud558\uaca0\uc9c0\ub9cc \uc2a4\ub178\ud2b8\uac00 \uc81c\uacf5\ud558\ub294 \uae30\ub2a5\uc5d0 \ube44\ud574 iptables\uac00 \uc81c\uacf5\ud558\ub294 \uae30\ub2a5\uc774 \uac00\uc9c0\ub294 \ud55c\uacc4 \ub54c\ubb38\uc5d0 \ubaa8\ub4e0 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc774 \ubcc0\ud658\ub420 \uc218 \uc788\ub294 \uac74 \uc544\ub2c8\ub2e4.<\/p>\n

 \ub124\ud2b8\uc6cc\ud06c \uae30\ubc18 \uacf5\uaca9\uc740 \uad49\uc7a5\ud788 \ud070 \uac00\ubcc0\uc131\uc744 \uac00\uc9c4\ub2e4. \uc5c4\uccad\ub09c \uc18d\ub3c4\ub85c \ubaa8\ub4e0 \uc885\ub958\uc758 \uc18c\ud504\ud2b8\uc6e8\uc5b4\uc5d0 \ub300\ud574 \uc0c8\ub85c \ubc1c\ud45c\ub418\ub294 \ucde8\uc57d\uc810\ubfd0\ub9cc \uc544\ub2c8\ub77c \ubd88\uba85\ud655\ud55c \ubc29\uc2dd\uc73c\ub85c \uc774\ub7f0 \ucde8\uc57d\uc810\uc744 \uc0ac\uc6a9\ud558\ub294 TCP\/IP \uc640 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 API\ub3c4 \uacf5\uaca9 \uc804\ub2ec\uc744 \uac00\ub2a5\ud558\uac8c \ud55c\ub2e4. \ud328\ud0b7 \ub2e8\ud3b8\ud654, TCP \uc138\uc158 \uacb0\ud569(TCP session spicing), \ub2e4\uc591\ud55c \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uc778\ucf54\ub529, \uadf8\ub9ac\uace0 \uc774\uc640 \uc720\uc0ac\ud55c \uac83 \ub54c\ubb38\uc5d0 \ub2e8\uc21c\ud788 \ud2b8\ub798\ud53d\uc774 \ub124\ud2b8\uc6cc\ud06c\ub97c \ud1b5\ud574 \uc544\ubb34 \ubb38\uc81c\uc5c6\uc774 \uc804\uc1a1\ub420 \ub54c \uc774\ub97c \uac10\uc2dc\ud558\ub294 \uc218\ub3d9\uc801 \uac10\uc2dc \uc2dc\uc2a4\ud15c\uc774 \uacf5\uaca9\uc744 \ud0d0\uc9c0\ud558\uae30\ub294 \ub354\uc6b1 \uc5b4\ub835\ub2e4.<\/p>\n

 ** \uc2a4\ub178\ud2b8 \uaddc\uce59 \ud5e4\ub354 \ubcc0\ud658<\/p>\n

  \uc2a4\ub178\ud2b8 \uaddc\uce59\uc740 \uaddc\uce59 \ud5e4\ub354\uc640 \uaddc\uce59 \uc635\uc158\uc774\ub77c\ub294 \ub450 \uac1c\uc758 \uc8fc\uc694 \ubd80\ubd84\uc73c\ub85c \ub098\ub25c\ub2e4. \uaddc\uce59 \ud5e4\ub354\ub294 \ub124\ud2b8\uc6cc\ud06c\uc640 \uc804\uc1a1 \uacc4\uce35\uc758 \ub9e4\uce6d \uae30\uc900\uc744 \uc5c4\uaca9\ud788 \uc815\uc758\ud55c\ub2e4. \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ub9e4\uce6d \uae30\uc900\uc740 \uc2a4\ub178\ud2b8 \uaddc\uce59 \ud5e4\ub354\uc5d0 \uc874\uc7ac\ud560 \uc218 \uc5c6\ub2e4.<\/p>\n

 – \uc2a4\ub178\ud2b8 \uaddc\uce59 \ud5e4\ub354<\/p>\n

 \uc608\ub97c \ub4e4\uc5b4 \uc2a4\ub178\ud2b8\uac00 \uc784\uc758\uc758 \ucd9c\ubc1c\uc9c0 IP \uc8fc\uc18c\uc5d0\uc11c 192.168.10.0\/24 \uc11c\ube0c\ub137\uc5d0 \uc874\uc7ac\ud558\ub294 \uc784\uc758\uc758 IP \uc8fc\uc18c\uc758 \ud3ec\ud2b8 53\uc73c\ub85c \uc804\uc1a1\ub418\ub294 \ubaa8\ub4e0 TCP \ud2b8\ub798\ud53d\uacfc \ub9e4\uce6d\uc2dc\ud0a4\uac8c \uc9c0\uc2dc\ud558\ub294 \uc2a4\ub178\ud2b8 \uaddc\uce59 \ud5e4\ub354\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n

 alret tcp any any -> 192.168.10.0\/24 53<\/p><\/blockquote>\n

 \uc11c\uba85 \uad00\uc810\uc5d0\uc11c \uc774 \ud5e4\ub354\ub294 \ub2e4\uc74c\uacfc \uac19\uc774 iptables \uba85\ub839\uacfc \ube44\uc2b7\ud558\ub2e4.<\/p>\n

# iptables -A FORWARD -p tcp -d 192.168.10.0\/24 –dport 53 -j LOG<\/p><\/blockquote>\n

  \uc6b0\uc120 \uc2a4\ub178\ud2b8\ub294 \uaddc\uce59 \ud5e4\ub354\uc5d0\uc11c \uc9c1\uc811 IP, ARP, UDP, ICMP, TCP \ub97c \uc9c0\uc6d0\ud55c\ub2e4(\ub2e4\ub978 \ud504\ub85c\ud1a0\ucf5c\uc740 \ub4a4\uc5d0\uc11c \ubcf4\uc774\uc9c0 \uc54a\uac8c \uc9c0\uc6d0\ud55c\ub2e4). \ub2e4\uc74c\uc73c\ub85c \uc2a4\ub178\ud2b8 \uaddc\uce59\uc740 \uc2a4\ub178\ud2b8 \uaddc\uce59 \ud5e4\ub354\uc758 \uc8fc\uc18c \ubd80\ubd84\uc744 \ud1b5\ud574 \ub124\ud2b8\uc6cc\ud06c\ub098 \uac1c\ubcc4 IP \uc8fc\uc18c\uc5d0 \uc801\uc6a9\ub420 \uc218 \uc788\ub2e4. \ub124\ud2b8\uc6cc\ud06c\ub294 CIDR \ud45c\uae30\ubc95(\uc608\ub97c \ub4e4\uc5b4 192.168.10.0\/24)\uc774\ub098 \ud45c\uc900 \ub3c4\ud2b8 4\uc790\ub9ac \ud45c\uae30\ubc95(\uc608\ub97c \ub4e4\uc5b4 192.168.10.0\/255.255.255.0)\uc73c\ub85c \uba85\uc2dc\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 \ub05d\uc73c\ub85c \uc804\uc1a1 \uacc4\uce35 \ucd9c\ubc1c\uc9c0\uc640 \ubaa9\uc801\uc9c0 \ud3ec\ud2b8 \ubc88\ud638\uac00 \uc815\uc758 \ub41c\ub2e4. \ud3ec\ud2b8 \ubc94\uc704\ub294 \ucf5c\ub860(:)\uc73c\ub85c \uba85\uc2dc\ud560 \uc218 \uc788\uc73c\uba70(\uc608\ub97c \ub4e4\uc5b4 :2123 \uc740 \ud3ec\ud2b8 21\uc5d0\uc11c 23\uae4c\uc9c0\ub97c \uc758\ubbf8\ud55c\ub2e4), \ud3ec\ud2b8 \ubc88\ud638 \uc5ed\uc2dc \ub290\ub08c\ud45c(!)\ub85c \ubd80\uc815\ud560 \uc218 \uc788\ub2e4(\uc608\ub97c \ub4e4\uc5b4 !80\uc740 \ud3ec\ud2b8 80\uc744 \uc81c\uc678\ud55c \ubaa8\ub4e0 \ud3ec\ud2b8\uc5d0 \uc801\uc6a9\ub41c\ub2e4).<\/p>\n

 – \uc2a4\ub178\ud2b8 \ud5e4\ub354 \uc640\uc77c\ub4dc \uce74\ub4dc\uc640 \ubcc0\uc218 \uacb0\uc815
 \uc2a4\ub178\ud2b8 \uaddc\uce59 \ud5e4\ub354\uc758 \ubaa8\ub4e0 \ub9e4\uce6d \uae30\uc900(\ud504\ub85c\ud1a0\ucf5c\uc740 \uc81c\uc678)\uc740 \uc2a4\ub178\ud2b8\uac00 \ud2b9\uc815 IP \uc8fc\uc18c\ub098 \ud3ec\ud2b8 \ubc88\ud638\ub85c \uc870\uc0ac\ub97c \uc81c\ud55c\ud558\uc9c0 \uc54a\uac8c \ud558\uae30 \uc704\ud574 \uc640\uc77c\ub4dc\uce74\ub4dc\ub85c \uc124\uc815\ud560 \uc218 \uc788\ub2e4. \ub610 \uc2a4\ub178\ud2b8\ub294 snort.conf \uc124\uc815 \ud30c\uc77c\uc5d0 \uac12(\uc608\ub97c \ub4e4\uc5b4 IP \uc8fc\uc18c\ub098 \ud3ec\ud2b8 \ubc88\ud638\uc758 \ubaa9\ub85d)\uc774 \uba85\uc2dc\ub41c \ubcc0\uc218\uc758 \uc815\uc758\ub3c4 \uc9c0\uc6d0\ud55c\ub2e4.<\/p>\n

 \uc608\ub97c \ub4e4\uc5b4 \uc2a4\ub178\ud2b8\uc758 \ub9ce\uc740 \uc6f9 \uae30\ubc18 \uaddc\uce59\uc774 \ub2e4\uc74c\uacfc \uac19\uc740 \ud5e4\ub354\ub97c \ud3ec\ud568\ud55c\ub2e4.<\/p>\n

 alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS<\/p><\/blockquote>\n

 – \uaddc\uce59 \ub3d9\uc791\uacfc iptables \uc5d0\ubbac\ub808\uc774\uc158<\/p>\n

 \uaddc\uce59 \ub3d9\uc791\uc740 alert, log, pass, activate, dynamic \uc911 \ud558\ub098\uac00 \ub420 \uc218 \uc788\uc73c\uba70, \ub300\ubd80\ubd84\uc758 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc740 alert \ub97c \uae30\ubcf8 \ub3d9\uc791\uc73c\ub85c \uac00\uc9c4\ub2e4. alert \ub3d9\uc791\uc774 \uac00\uc7a5 \uc911\uc694\ud558\ub2e4(alert \ub294 \uc2a4\ub178\ud2b8\uac00 \uc774\ubca4\ud2b8\ub97c \uc0dd\uc131\ud558\uace0 \uc774 \uacbd\uace0\ub97c \uc77c\uc73c\ud0a8 \ud328\ud0b7\uc744 \uae30\ub85d\ud558\uac8c \ud55c\ub2e4). \ub098\uba38\uc9c0 \ub3d9\uc791\uc740 \uc5b4\ub5a4 \uc870\uce58\ub3c4 \uc5c6\uc774 \ud328\ud0b7\uc744 \ud1b5\uacfc\uc2dc\ud0a4\uac70\ub098(pass) \ud328\ud0b7\uc744 \uae30\ub85d\ud558\uac70\ub098(log) \ud2b9\uc815 \uaddc\uce59\uc774 \ub9e4\uce6d\ub420 \ub54c\uae4c\uc9c0 \ube44\ud65c\uc131 \uc0c1\ud0dc\uc5d0 \uc788\ub2e4\uac00 \ub9e4\uce6d \uc2dc\uc810\uc5d0 \ud65c\uc131\ud654\ub3fc\uc11c \ud328\ud0b7\uc744 \uae30\ub85d\ud558\uac8c \uc77c\ubd80 \uaddc\uce59\uc744 \uc124\uc815\ud558\ub294 (activate \uc640 dynamic) \ubd80\uac00\uc801\uc778 \uae30\ub2a5\uc744 \uc81c\uacf5\ud55c\ub2e4.<\/p>\n

 \uc9c0\uae08\uae4c\uc9c0 \uc0b4\ud3b4\ubcf8 \ubc14\ub85c\ub294 \uc2a4\ub178\ud2b8 \uaddc\uce59 \ud5e4\ub354\uc5d0\uc11c activate\uacfc dynamic \ub3d9\uc791\uc744 \uc81c\uc678\ud55c \ubaa8\ub4e0 \uac83\uc774 iptables \uc640 fwsnort \uc5d0\uc11c\ub3c4 \uc720\uc0ac\ud55c \uae30\ub2a5\uc5d0 \uc758\ud574 \uc9c0\uc6d0\ub41c\ub2e4.<\/p>\n

 -s IP \ub098 -d IP \uc778\uc790\ub97c \uc0ac\uc6a9\ud558\uba74 \uac01\uae30 \ucd9c\ubc1c\uc9c0\uc640 \ubaa9\uc801\uc9c0 IP \uc8fc\uc18c\ub098 \ub124\ud2b8\uc6cc\ud06c\ub97c iptables\uc5d0 \uba85\uc2dc\ud560 \uc218 \uc788\uc73c\uba70 \ub458 \ubaa8\ub450 CIDR\uc640 \ub3c4\ud2b8 4\uc790\ub9ac \ud45c\uae30\ubc95\uc744 \uc9c0\uc6d0\ud55c\ub2e4. \ucd9c\ubc1c\uc9c0\uc640 \ubaa9\uc801\uc9c0 \ud3ec\ud2b8 \ubc88\ud638\ub294 –sport port \uc640 –dport port \uc635\uc158\uc744 \uc0ac\uc6a9\ud574\uc11c \uc904 \uc218 \uc788\uc73c\uba70, \uc2a4\ub178\ud2b8\uc640 \ub9c8\ucc2c\uac00\uc9c0\ub85c \ud3ec\ud2b8 \ubc94\uc704\ub294 \ucf5c\ub860(:)\uc73c\ub85c \uba85\uc2dc\ud55c\ub2e4. \ud504\ub85c\ud1a0\ucf5c\uc740 -p protocol \ub85c \uba85\uc2dc\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 \uc608\ub97c \ub4e4\uc5b4 TCP \ud2b8\ub798\ud53d\uc5d0 \uc801\uc6a9\ub418\ub294 iptables \uaddc\uce59\uc744 \ub9cc\ub4e4\uace0\uc790 \ud55c\ub2e4\uba74 iptables \uba85\ub839\uc5d0 -p tcp \uc778\uc790\ub97c \uc0ac\uc6a9\ud55c\ub2e4. \uaddc\uce59\uc744 \ubaa9\uc801\uc9c0 \ud3ec\ud2b8 53\uc73c\ub85c \uc81c\ud55c\ud558\uace0 \uc2f6\ub2e4\uba74 –dport 53 \uc744 \uc0ac\uc6a9\ud55c\ub2e4. \uaddc\uce59\uc758 \ubaa9\uc801\uc9c0 \uc8fc\uc18c\ub97c 192.168.10.0\/24 \uc11c\ube0c\ub137\uc758 \ubaa8\ub4e0 IP \uc8fc\uc18c\ub85c \uc801\uc6a9\ud558\ub824\uba74 -d 192.168.10.0\/24 \ub97c \uc0ac\uc6a9\ud55c\ub2e4.<\/p>\n

 – \uc2a4\ub178\ud2b8 \ub3d9\uc791\uacfc \uacbd\uace0<\/p>\n

 \uc2a4\ub178\ud2b8\ub294 \uacbd\uace0\ub97c \uc0dd\uc131\ud558\uace0 \ud328\ud0b7 \ub370\uc774\ud130\ub97c \uae30\ub85d\ud558\ub294 \uba87 \uac00\uc9c0 \ud6cc\ub96d\ud55c \uc635\uc158\uc744 \uc81c\uacf5\ud55c\ub2e4. fwsnort\ub97c \uc774\uc6a9\ud558\uba74 \ub2e4\uc74c\uacfc \uac19\uc740 \uc2a4\ub178\ud2b8 \ub3d9\uc791\uc744 \uc5d0\ubbac\ub808\uc774\uc158\ud558\uae30 \uc704\ud574 \uc774\ub7f0 \uae30\ub2a5\uc744 \uacb0\ud569\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 — \uacbd\uace0 : \uc8fc\uc694 \uc2a4\ub178\ud2b8 \uaddc\uce59 \ub3d9\uc791\uc774\uba70, fwsnort \ub0b4\uc5d0\uc11c \uacbd\uace0\ub294 \ub85c\uadf8 \uba54\uc2dc\uc9c0 \ub098\uba38\uc9c0 \ubd80\ubd84\uc758 \ub85c\uadf8 \uc811\ub450\uc5b4\uc640 \ud328\ud0b7 \ud5e4\ub354 \uc815\ubcf4 \ub0b4\uc5d0 \uc788\ub294 \uc2a4\ub178\ud2b8 \uc11c\uba85 msg \ud56d\ubaa9\uc744 \uae30\ub85d\ud558\uae30 \uc704\ud574 iptables LOG \ud0c0\uac9f\uc744 \uc0ac\uc6a9\ud558\ub294 \uac83\uacfc \uac19\ub2e4. iptables \ub85c\ub294 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ub370\uc774\ud130\ub97c \uae30\ub85d\ud560 \uc218 \uc5c6\uc9c0\ub9cc (ulogd PCAP \uc791\uc131\uae30\uc640 \ud568\uaed8 ULOG \ud0c0\uac9f\uc744 \uc0ac\uc6a9\ud558\uba74 \uac00\ub2a5\ud558\ub2e4) \uc801\uc5b4\ub3c4 msg \ud56d\ubaa9\uc744 \ud1b5\ud574 \uacf5\uaca9\uc740 \uae30\ub85d\ub41c\ub2e4.<\/p>\n

 — \uae30\ub85d : fwsnort \ub0b4\uc5d0\uc11c \uc774 \ub3d9\uc791\uc740 \uc880 \ub354 \ud3ec\uad04\uc801\uc778 \ud328\ud0b7 \ub85c\uae45\uc744 \uc704\ud574 ulogd PCAP \uc791\uc131\uae30\ub97c \uc0ac\uc6a9\ud558\ub294 \ud560 \ub54c\uc758 iptables ULOG \ud0c0\uac9f\uacfc \ub3d9\uc77c\ud558\ub2e4.<\/p>\n

 — \ud1b5\uacfc : \uc774 \ub3d9\uc791\uc740 \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc9d1\ud569\uc5d0\uc11c \ub54c\ub54c\ub85c \ud328\ud0b7\uc744 \ubb34\uc2dc\ud558\uae30 \uc704\ud574 \uc4f0\uc774\uba70, fwsnort \ub0b4\uc5d0\uc11c\ub294 iptables ACCEPT \ud0c0\uac9f\uacfc \ub3d9\uc77c\ud558\ub2e4. ACCEPT \ud0c0\uac9f\uc740 \ub9e4\uce6d\ub418\ub294 \ud2b8\ub798\ud53d\uc774 iptables \uc758 \uc5b4\ub5a0\ud55c \uc218\uc815\uc774\ub098 \ucd94\uac00\uc801\uc778 \ub3d9\uc791 \uc5c6\uc774 \ud1b5\uacfc\ud558\uac8c \ud574\uc900\ub2e4.<\/p>\n

 ** \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc635\uc158 \ubcc0\ud658: iptables \ud328\ud0b7 \ub85c\uae45<\/p>\n

 \uc2a4\ub178\ud2b8\uc758 \ubcf5\uc7a1\ud55c \ud328\ud0b7 \ucc98\ub9ac\ub294 \uc8fc\ub85c \uaddc\uce59 \uc635\uc158(TCP \uc2a4\ud2b8\ub9bc \uc7ac\uc870\ub9bd\uc774\ub098 \ud3ec\ud2b8 \uc2a4\uce94 \ud0d0\uc9c0\uc640 \uac19\uc740 \ud2b9\uc815 \ubb38\uc81c\ub97c \ud574\uacb0\ud558\ub294 \uc804\ub2f4 \uc804\ucc98\ub9ac\uae30\uac00 \uc218\ud589\ud558\ub294 \uc791\uc5c5\uc740 \uc608\uc678)\uc5d0 \uc758\ud574 \uad6c\ud604\ub41c\ub2e4.<\/p>\n

 fwsnort\ub294 iptables\uc5d0 \ub3d9\ub4f1\ud55c \ub9e4\uce6d\/\ud544\ud130\ub9c1 \uc635\uc158\uc774 \uc5c6\ub294 \ub2e4\uc74c \ubaa9\ub85d\uacfc \uac19\uc740 \uc635\uc158\uc744 \ud3ec\ud568\ud558\ub294 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc740 \ubcc0\ud658\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n

ack : TCP \ud5e4\ub354\uc758 32\ube44\ud2b8 \uc2b9\uc778 \ubc88\ud638\uc640 \ub9e4\uce6d\uc2dc\ud0a8\ub2e4.<\/p>\n

 icmp_id : \uc77c\ubd80 ICMP \ud328\ud0b7\uc5d0 \uc874\uc7ac\ud558\ub294 ID \uac12\uacfc \ub9e4\uce6d\uc2dc\ud0a8\ub2e4.<\/p>\n

 icmp_seq : \uc77c\ubd80 ICMP \ud328\ud0b7\uc5d0 \uc874\uc7ac\ud558\ub294 \uc21c\uc11c \ubc88\ud638 \uac12\uacfc \ub9e4\uce6d\uc2dc\ud0a8\ub2e4.<\/p>\n

 id : IP \ud5e4\ub354\uc758 16\ube44\ud2b8 IP ID \ud56d\ubaa9\uacfc \ub9e4\uce6d\uc2dc\ud0a8\ub2e4.<\/p>\n

 sameip : \ub3d9\uc77c\ud55c \ucd9c\ubc1c\uc9c0\uc640 \ubaa9\uc801\uc9c0 IP \uc8fc\uc18c\ub97c \uac80\uc0c9\ud55c\ub2e4.<\/p>\n

 seq : TCP \ud5e4\ub354\uc758 32 \ube44\ud2b8 \uc21c\uc11c \ubc88\ud638\uc640 \uc77c\uce58\uc2dc\ud0a8\ub2e4.<\/p>\n

 window : TCP \ud5e4\ub354\uc758 16 \ube44\ud2b8 \uc708\ub3c4\uc6b0 \uac12\uacfc \uc77c\uce58\uc2dc\ud0a8\ub2e4.<\/p><\/blockquote>\n

 \uadf8\ub7ec\ub098 \uc704 \ubaa9\ub85d\uc758 \ubaa8\ub4e0 \ud328\ud0b7 \ud5e4\ub354 \uc815\ubcf4\ub294 psad\uc640 \uac19\uc740 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc774 \uc27d\uac8c \ubd84\uc11d\ud560 \uc218 \uc788\uac8c iptables \ub85c\uadf8\uc5d0 \ud3ec\ud568\ub41c\ub2e4.<\/p>\n

 ** \uc2a4\ub178\ud2b8 \uc635\uc158\uacfc iptables \ud328\ud0b7 \ud544\ud130\ub9c1<\/p>\n

\uc9c0\uae08\uae4c\uc9c0\ub294 iptables \uc758 \ub85c\uae45 \uae30\ub2a5\ub9cc \uc774\uc6a9\ud558\ub294 \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc635\uc158\uc744 \ub17c\ud588\ub2e4. \uc774\uc81c iptables\uac00 \uba85\uc2dc\uc801\uc778 \ub9e4\uce6d\uacfc \ud544\ud130\ub9c1\uc744 \uc9c0\uc6d0\ud558\ub294 \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc635\uc158\uc744 \uc0b4\ud3b4\ubcf4\uc790. \uc774\ub7f0 \uc635\uc158\uc744 \uc0ac\uc6a9\ud558\ub294 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc740 \ub3d9\ub4f1\ud55c iptables \uaddc\uce59\uc73c\ub85c \ubcc0\ud658 \uac00\ub2a5\ud558\uba70, \ud45c\uc900 iptables \ud0c0\uac9f \ubcf4\ub450\uac00(LOG, DROP, REJECT \ub4f1) \ud328\ud0b7\uc744 \ub9e4\uce6d\ud558\ub294 \ub370 \uc801\uc6a9\ub420 \uc218 \uc788\ub2e4. \uc774\ub7f0 \ubd84\ub958\uc5d0 \uc18d\ud558\ub294 \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc635\uc158\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n

 content, flags, dsize, uricontent, itype, ip_proto, offset, icode, flow, depth, ttl, replace, distance, tos, resp, within, ipopts<\/p><\/blockquote>\n

– content
 \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc5b8\uc5b4\uc758 content \uc635\uc158\uc5d0\ub294 \uc778\uc790\uac00 \ubc14\uc774\ud2b8\uc758 \ub098\uc5f4 \ud615\ud0dc, \uc608\ub97c \ub4e4\uc5b4 \/bin\/sh \uc5ec\uc57c \ud558\uba70 \uc2a4\ub178\ud2b8\ub294 \ubcf4\uc774\uc5b4-\ubb34\uc5b4 \ubb38\uc790\uc5f4 \uac80\uc0c9 \uc54c\uace0\ub9ac\uc998\uc744 \uc0ac\uc6a9\ud574\uc11c \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ub370\uc774\ud130\uc5d0\uc11c \uc774\ub7f0 \ubc14\uc774\ud2b8 \ub098\uc5f4\uc744 \uac80\uc0c9\ud55c\ub2e4. iptables \ub9e4\uce6d \ud655\uc7a5\uc740 \ucee4\ub110\uc5d0 \uad6c\ud604\ub41c \ub3d9\uc77c\ud55c \uc54c\uace0\ub9ac\uc998(\uc0ac\uc6a9\uc790\uac00 \uc120\ud0dd)\uc744 \uc0ac\uc6a9\ud574\uc11c \ud328\ud0b7\uc774 \ub124\ud2b8\uc6cc\ud0b9 \uc2a4\ud0dd\uc73c\ub85c \ub4e4\uc5b4\uc62c \ub54c \ud328\ud0b7\uc758 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ud398\uc774\ub85c\ub4dc\uc5d0 \uc788\ub294 \ubc14\uc774\ud2b8 \ub098\uc5f4\uc744 \uac80\uc0c9\ud55c\ub2e4.<\/p>\n

 – uricontent
 uicontent \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 \uc2a4\ub178\ud2b8\uac00 HTTP\ub97c \ud1b5\ud574 \uc804\uc1a1\ub418\ub294 URL \uc778\ucf54\ub529\ub41c \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ub370\uc774\ud130\ub97c \ucc98\ub9ac\ud558\uac8c \ud574\uc900\ub2e4. \uc774 \uc635\uc158\uc740 \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc5b8\uc5b4\uc5d0 \uc9c1\uc811 \ud1b5\ud569\ub3fc \uc788\uc73c\uba70(\uc804\ucc98\ub9ac\uae30\uc5d0 \uad6c\ud604\ub418\ub294 \uac83\uacfc \ub2e4\ub974\ub2e4) \uc774\ub294 \uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ud1b5\uc2e0\uc758 \uc911\uc694\uc131\uc774 \ucee4\uc9c0\uba74\uc11c \uc774\ub4e4\uc744 \ub300\uc0c1\uc73c\ub85c \ud558\ub294 \uacf5\uaca9\uc744 \ud0d0\uc9c0\ud560 \ud544\uc694\uc131\ub3c4 \ucee4\uc84c\uae30 \ub54c\ubb38\uc774\ub2e4. URL \uc778\ucf54\ub529\ub41c \ub370\uc774\ud130\ub97c \uc9c0\uc6d0\ud558\ub294 \uc6f9\uc11c\ubc84\uc5d0 \ub300\ud55c \uacf5\uaca9\uc740 \uc778\ucf54\ub529 \ubc29\uc2dd\uc758 \uc81c\uc57d \uc870\uac74 \ud558\uc5d0\uc11c \uc5b4\ub5a4 \ud615\ud0dc\ub3c4 \ucde8\ud560 \uc218 \uc788\uc73c\uba70, \uadf8 \uacb0\uacfc \uacf5\uaca9\uc740 \ub124\ud2b8\uc6cc\ud06c\uc0c1\uc5d0\uc11c \ub370\uc774\ud130\ub97c \uc815\uaddc\ud654\ud558\ub294 \ubc29\ubc95 \uc5c6\uc774\ub294 \ub514\ucf54\ub529\ud558\uae30 \uc5b4\ub824\uc6b4 \uc218\uc900\uc758 \uac00\ubcc0\uc131\uc744 \uac00\uc9c0\uac8c \ub410\ub2e4. \uc5c4\uaca9\ud788 \ub9d0\ud574\uc11c iptables\uc758 \ubb38\uc790\uc5f4 \ub9e4\uce6d \ud655\uc7a5\uc740 URL \uc778\ucf54\ub529\ub41c \ub370\uc774\ud130\ub97c \uc9c1\uc811 \ub514\ucf54\ub529\ud560 \uc218 \uc5c6\uae30 \ub54c\ubb38\uc5d0 iptables\uc5d0 uricontent \uc2a4\ub178\ud2b8 \uc635\uc158\uc5d0 \ub300\ud55c \uc9c1\uc811\uc801\uc778 \ubcc0\ud658\uc740 \uc5c6\ub2e4.<\/p>\n

 \uc815\uaddc\uc2dd\uacfc iptables
 iptables\uc5d0 (\uc5ed \ucc38\uc870\ub098 \ubc18\ubcf5\uacfc \uac19\uc740 \uae30\ub2a5\uc774 \uc81c\uac70\ub41c) \uc81c\ud55c\ub41c \ud615\ud0dc\uc758 \uc815\uaddc\uc2dd \uc9c0\uc6d0\uc744 \ucd94\uac00\ud558\ub294 \uac83\uc740 \uc804\ubd80\ud130 iptables \ud504\ub85c\uc81d\ud2b8 \uad00\ub9ac\uc790\uc5d0\uac8c \uc81c\uc548\ub418\uace0 \uc788\ub2e4. \uadf8\ub7ec\ub098 \ucee4\ub110\uc5d0 (\ud384, \ud30c\uc774\uc120, GNU Emacs, vi, grep \ub4f1\uacfc \uac19\uc774 \ub9ce\uc740 \uc5b8\uc5b4, \uc720\ud2f8\ub9ac\ud2f0, \ud3b8\uc9d1\uae30\uc5d0\uc11c \uc0ac\uc6a9\ub418\ub294 \uac83\uacfc \ube44\uc2b7\ud55c) \ube44\uacb0\uc815\uc801 \uc720\ud55c \uc624\ud1a0\ub9c8\ud0c0, \uc989 NFA(nondeterministic finite automaton)\uacfc \uac19\uc740 \uc77c\ubc18\ud654\ub41c \uc815\uaddc\uc2dd \uc5d4\uc9c4\uc744 \uad6c\ud604\ud558\ub294 \uac83\uc740 \uc704\ud5d8\ud558\ub2e4. \ub54c\ub85c\ub294 \ub370\uc774\ud130\uc5d0 \ub300\ud55c \ud2b9\uc815 \uc815\uaddc\uc2dd\uc758 \uc2e4\ud589 \uc2dc\uac04\uc774 \uc218\ucc9c \ub144\uc774 \ub420 \uc218\ub3c4 \uc788\ub294 \uc545\uc758\uc801 \ub370\uc774\ud130\ub97c \uc0dd\uc131\ud558\ub294 \uac83\ub3c4 \uac00\ub2a5\ud558\ub2e4. \ub2e8\uc21c\ud788 \uc2dc\uc2a4\ud15c \uc778\ud130\ud398\uc774\uc2a4\ub97c \ud1b5\uacfc\ud558\ub294 \uc545\uc758\uc801\uc73c\ub85c \uad6c\uc131\ub41c \ud328\ud0b7\uc5d0 \uc758\ud574 \uc2dc\uc2a4\ud15c\uc774 \uc27d\uac8c \ub2e4\uc6b4\ub418\uae38 \uc6d0\ud558\ub294 \uc0ac\ub78c\uc740 \uc544\ubb34\ub3c4 \uc5c6\ub2e4.<\/p><\/blockquote>\n

 – offset
 offset \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 \uc2a4\ub178\ud2b8\uac00 \ud328\ud0b7\uc758 \ud398\uc774\ub85c\ub4dc \ub370\uc774\ud130 \uc2dc\uc791 \ubd80\ubd84\uc73c\ub85c\ubd80\ud130 \ud2b9\uc815 \ubc14\uc774\ud2b8\ub9cc\ud07c \ub5a8\uc5b4\uc9c4 \uacf3\uc5d0\uc11c \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ub0b4\uc6a9 \ub9e4\uce6d \ub3d9\uc791\uc744 \uc2dc\uc791\ud558\uac8c \ud55c\ub2e4. \uc774\ub294 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc758 \ubaa8\ub4e0 \ub0b4\uc6a9 \ub9e4\uce6d\uc5d0 \uc801\uc6a9\ub418\ub294 \uc808\ub300 \uac12\uc73c\ub85c \uc5ec\ub7ec \ub0b4\uc6a9 \ub9e4\uce6d \uac04\uc758 \uc0c1\ub300\uc801\uc778 \ubc14\uc774\ud2b8 \uc218\uc5d0 \uc885\uc18d\uc801\uc774\uc9c0 \uc54a\ub2e4(distance \uc2a4\ub178\ud2b8 \uc635\uc158\uc774 \uc774\ub97c \uc704\ud574 \uc0ac\uc6a9\ub41c\ub2e4). iptables\uc5d0\uc11c offset \uc635\uc158\uc740 \ud398\uc774\ub85c\ub4dc \ub370\uc774\ud130\uc5d0\uc11c \ud328\ud134\uc744 \uac80\uc0c9\ud560 \ub54c \ubb38\uc790\uc5f4 \ub9e4\uce6d \ud655\uc7a5\uc5d0 –from \uba85\ub839 \ud589 \uc778\uc790\ub97c \uc0ac\uc6a9\ud568\uc73c\ub85c\uc368 \uc9c0\uc6d0\ub41c\ub2e4(\uc774 \uc778\uc790\ub294 \ucee4\ub110 \ubc84\uc804 2.6.14 \uc640 \uadf8 \uc774\ud6c4 \ubc84\uc804\uc5d0\uc11c\ub9cc \uc9c0\uc6d0\ub41c\ub2e4).<\/p>\n

 – depth
 depth \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 \ud328\ud0b7 \ud398\uc774\ub85c\ub4dc \ub370\uc774\ud130 \ub0b4\uc6a9\uc744 \ub9e4\uce6d\ud558\ub824\ub294 \ubaa8\ub4e0 \uc2dc\ub3c4\uac00 \ud398\uc774\ub85c\ub4dc \uc2dc\uc791 \uc9c0\uc810\uc5d0\uc11c \ud2b9\uc815 \ubc14\uc774\ud2b8 \uc218\ub97c \ub118\uc9c0 \uc54a\uac8c \ud55c\ub2e4.<\/p>\n

 – distance
 \uc2a4\ub178\ud2b8\ub294 \ud328\ud134 \ub9e4\uce6d \uc0ac\uc774\uc5d0 \uac74\ub108\ub6f8 \ubc14\uc774\ud2b8 \uc218\ub97c \uba85\uc2dc\ud558\uae30 \uc704\ud574 distance \uc635\uc158\uc744 \uc0ac\uc6a9\ud55c\ub2e4.<\/p>\n

 – within
 within \uc635\uc158\uc740 \uc2a4\ub178\ud2b8\uac00 \ucc98\uc74c \ub9e4\uce6d \ub2e4\uc74c\uc758 \ud328\ud134 \ub9e4\uce6d\uc774 \ud2b9\uc815 \ubc14\uc774\ud2b8 \uc218 \uc774\ub0b4\uc5d0\uc11c \uc77c\uc5b4\ub098\uac8c \uc694\uad6c\ud558\uac8c \ud55c\ub2e4.<\/p>\n

 – flags
 flags \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 TCP \ud5e4\ub354\uc758 \uc81c\uc5b4 \ube44\ud2b8\uc5d0 \uac80\uc0c9 \uae30\uc900\uc744 \uc801\uc6a9\ud55c\ub2e4. \uc81c\uc5b4 \ube44\ud2b8\ub294 TCP \uc5f0\uacb0\uc758 \uc0c1\ud0dc\uc5d0 \ub530\ub77c \ub2ec\ub77c\uc9c0\uba70 iptables\ub294 –tcp-flags \uc778\uc790\ub97c \ud1b5\ud574 \ud2b9\uc815 \uc870\ud569\uc744 \ub9e4\uce6d\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 – itype\uacfc icode
 itype\uacfc icode \uc635\uc158\uc740 \uac01\uae30 ICMP \ud5e4\ub354\uc758 8\ube44\ud2b8 ICMP \uc720\ud615\uacfc \ucf54\ub4dc \ud56d\ubaa9\uc758 \ud2b9\uc815 \uc22b\uc790 \uac12\uacfc \ub9e4\uce6d\ub41c\ub2e4.<\/p>\n

 – ttl
 \uc2a4\ub178\ud2b8\ub294 ttl \uc635\uc158\uc744 \uc774\uc6a9\ud574\uc11c IP \ud5e4\ub354\uc758 \ud328\ud0b7 \uc720\uc9c0 \uc2dc\uac04(TTL, Time-to-Live)\uac12\uacfc \ub9e4\uce6d\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 – tos
 tos \uc635\uc158\uc740 \uc2a4\ub178\ud2b8\uac00 IP \ud5e4\ub354\uc758 \uc11c\ube44\uc2a4 \uc720\ud615(TOS, Type Of Service) \ube44\ud2b8\ub97c \uc870\uc0ac\ud558\uac8c\ud558\uba70, \uc774 \uc635\uc158\uc740 \uc22b\uc790 \uac12\uacfc \ubd80\uc815 \uae30\ud638 !\ub97c\u3139 \ubd99\uc778 \uc22b\uc790\uac12\ub9cc \ubc1b\uc544\ub4e4\uc77c \uc218 \uc788\uae30 \ub54c\ubb38\uc5d0 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc5d0\uc11c \uc0c1\ub300\uc801\uc73c\ub85c \uac04\ub2e8\ud558\ub2e4.<\/p>\n

 – ipopts
 ipopts \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 \uac80\uc0c9 \uae30\uc900\uc774 IP \ud5e4\ub354\uc758 \uc635\uc158 \ubd80\ubd84\uc5d0\ub3c4 \uc801\uc6a9\ub418\uac8c \ud574\uc900\ub2e4. IP \uc635\uc158\uc740 \uc801\ubc95\ud55c IP \ud2b8\ub798\ud53d\uc5d0\uc11c \uac70\uc758 \uc0ac\uc6a9\ub418\uc9c0 \uc54a\uc9c0\ub9cc \uc18c\uc2a4 \ub77c\uc6b0\ud305 IP \uc635\uc158(\uacf5\uaca9\uc790\uac00 \ub2e4\ub978 \ubc29\ubc95\uc73c\ub85c\ub294 \ub3c4\ub2ec\ud560 \uc218 \uc5c6\ub294 \ub124\ud2b8\uc6cc\ud06c\ub97c \ud1b5\ud574 \ud328\ud0b7\uc744 \ub77c\uc6b0\ud305\ud558\ub824\ub294 \uc2dc\ub3c4\uc5d0 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub294 \uc635\uc158)\uc744 \uc0ac\uc6a9\ud558\ub824\ub294 \uc2dc\ub3c4\ub97c \ud0d0\uc9c0\ud558\ub294 \uac83\uc740 \uc911\uc694\ud558\ub2e4.<\/p>\n

 – dsize
 dsize \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 \ud328\ud0b7 \ud398\uc774\ub85c\ub4dc \ub370\uc774\ud130\uc758 \ud06c\uae30\uc5d0 \uc870\uac74\uc744 \uac74\ub2e4. dsize \uc635\uc158\uc740 \uc591\uc758 \uc815\uc218\ub97c \ucde8\ud558\uba70 \uaddc\uce59\uc774 \ub9e4\uce6d\ub418\uae30 \uc704\ud574 \ud53c\ud0b7\uc758 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ubd80\ubd84\uc5d0 \uc874\uc7ac\ud574\uc57c\ud560 \ubc14\uc774\ud2b8 \uc218\ub97c \ub098\ud0c0\ub0b4\ub294 < \uc640 > \uc5f0\uc0b0\uc790\ub97c \uc0ac\uc6a9\ud560 \uc218\ub3c4 \uc788\ub2e4.<\/p>\n

 fwsnort \uc5d0\uc11c\ub294 \/etc\/fwsnort\/fwsnort.conf \uc758 AVG_IP_HEADER_LEN \uc640 AVG_TCP_HEADER_LEN \ud0a4\uc6cc\ub4dc\ub97c \ud1b5\ud574 IP\uc640 TCP \ud5e4\ub354\uc758 \ud3c9\uade0 \ud5e4\ub354 \uae38\uc774\ub97c \uc124\uc815\ud560 \uc218 \uc788\ub2e4.<\/p><\/blockquote>\n

 – ip_proto
 ip_proto \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc774 IP \ud5e4\ub354\uc758 \ud504\ub85c\ud1a0\ucf5c \ud56d\ubaa9\uc73c\ub85c \uac00\ub2a5\ud55c \uac12 256\uac1c \uc911 \uc784\uc758\uc758 \uac83\uc73c\ub85c \uc81c\ud55c\ud560 \uc218 \uc788\uac8c \ud574\uc900\ub2e4. \uc774 \uac12\ub4e4\uc740 \/etc\/protocols \ud30c\uc77c\uc5d0 \uc815\uc758\ub418 \uc788\ub2e4.<\/p>\n

 – flow
 flow \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc5b8\uc5b4\uc5d0\uc11c \uc880 \ub354 \uc911\uc694\ud55c \uae30\ub2a5 \uc911 \ud558\ub098\ub85c \uc2a4\ud2b8\ub9bc \uc804\ucc98\ub9ac\uae30\uc640 \ud568\uaed8 \uc0ac\uc6a9\ub41c\ub2e4. \ud750\ub984 \uc635\uc158\uc740 \uc2a4\ub178\ud2b8 \uaddc\uce59\uc774 \uc7ac\uc870\ub9bd\ub41c TCP \uc2a4\ud2b8\ub9bc\uc5d0 \ub300\ud574 \uc0c1\ud0dc\uc640 \ubc29\ud5a5 \uae30\uc900\uc744 \uc801\uc6a9\ud560 \uc218 \uc788\uac8c \ud574\uc900\ub2e4.<\/p>\n

 – replace
 replace \uc2a4\ub178\ud2b8 \uc635\uc158\uc740 \uc2a4\ub178\ud2b8\uac00 \uc778\ub77c\uc778 \ubaa8\ub4dc\ub85c \uc2e4\ud589 \uc911\uc774\uace0 \ud328\ud0b7 \ub370\uc774\ud130 \uacbd\ub85c\uc5d0 \uc778\ub77c\uc778\uc73c\ub85c \ubc30\uce58\ub410\uc744 \ub54c\ub9cc \uc801\uc6a9\ub420 \uc218 \uc788\ub2e4. \uc774 \ubaa8\ub4dc\uc5d0\uc11c \uc2a4\ub178\ud2b8\ub294 \ubcf4\ud638\ub41c \ub2c8\ud14c\uc73c\ucffc\u3161 \uc548\ud30e\uc73c\ub85c \uc2a4\ub178\ud2b8\uc758 \ud0d0\uc9c0 \uc5d4\uc9c4\uc774 \ud328\ud0b7\uc744 \uc870\uc0ac\ud55c \ud6c4\uc5d0\ub9cc \uc774\ub97c \uc804\ub2ec\ud558\ub294 \uae30\ub2a5\uc744 \uac16\ucd98 \uc9c4\uc815\ud55c \uce68\uc785 \ubc29\uc9c0 \uc2dc\uc2a4\ud15c\uc774 \ub41c\ub2e4. replace \uc635\uc158\uc740 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uacc4\uce35 \ub370\uc774\ud130\uc5d0 \ub300\ud574 \ub3d9\uc791\ud558\uba70 content \uc635\uc158\uc5d0 \uc758\ud574 \ud0d0\uc9c0\ub41c \ubc14\uc774\ud2b8 \ub098\uc5f4\uc774 \ub3d9\uc77c\ud55c \uae38\uc774\uc758 \ub2e4\ub978 \ub098\uc5f4\ub85c \ub300\uccb4\ub418\uac8c \ud574\uc900\ub2e4.<\/p>\n

– resp
 flexresponse \uc640 flexresponse2 \uc2a4\ub178\ud2b8 \ud0d0\uc9c0 \ud50c\ub7ec\uadf8\uc778\uc774 \uc81c\uacf5\ud558\ub294 resp \uc635\uc158\uc740 \uc2a4\ub178\ud2b8\uac00 \uc11c\uba85 \ub9e4\uce6d\uc744 \uc885\ub8cc\uc2dc\ud0a4\uae30 \uc704\ud574 TCP RST\/ACK \ud328\ud0b7\uc744 \uc804\uc1a1\ud558\ub294 \uac83\uacfc ICMP \ub124\ud2b8\uc6cc\ud06c, \ud638\uc2a4\ud2b8, \ud3ec\ud2b8 \ub3c4\ub2ec \ubd88\uac00 \ud328\ud0b7\uc744 \uc0dd\uc131\ud558\ub294 \uac83\uc774 \uc788\ub2e4. iptables REJECT \ud0c0\ucf13\uc740 TCP \uc5f0\uacb0\uc5d0 \ub300\ud574\uc11c \uc778\uc790 -j REJECT –reject-with tcp-reset, UDP \ud328\ud0b7\uc5d0 \ub300\ud574 \uc778\uc790 -j REJECT –reject-with icmp-*-unreachable(*\ub294 net, host, port \uc911 \ud558\ub098)\uc744 \ud1b5\ud574 \uc774\ub7f0 \uae30\ub2a5\uc744 \uc81c\uacf5\ud55c\ub2e4.
 <\/p>\n","protected":false},"excerpt":{"rendered":"

 * \ub4e4\uc5b4\uac00\uba70..  \uc2a4\ub178\ud2b8 \uaddc\uce59\uc744 \ud56d\uc0c1 \uae54\ub054\ud558\uac8c \ubcc0\ud65c\ud560 \uc218\ub294 \uc5c6\uc73c\uba70, \uc2a4\ub178\ud2b8 \uaddc\uce59 \uc5b8\uc5b4\ub294 \ub9e4\uc6b0 \ubcf5\uc7a1\ud558\uae30 \ub54c\ubb38\uc5d0 fwsnort\ub294 \uc2a4\ub178\ud2b8 \ubc84\uc804 2.3.3 \uc5d0 \ud3ec\ud568\ub41c \uaddc\uce59\uc758 \uc57d 60% \uc815\ub3c4\ub97c \ubcc0\ud658\ud560 \uc218 \uc788\ub2e4.  fwsnort\uac00 \uc804\uccb4 \uc2a4\ub178\ud2b8 \uc11c\uba85 \uc9d1\ud569\uc744 iptables \uaddc\uce59\uc73c\ub85c \ubcc0\ud65c\ud560 \uc218\ub294 \uc5c6\uc9c0\ub9cc fwsnort \ub294 … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[52],"tags":[184,218,241,399,528,557,564,809],"_links":{"self":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts\/894"}],"collection":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=894"}],"version-history":[{"count":0,"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts\/894\/revisions"}],"wp:attachment":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=894"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}