решил поковырять сию IDS. сделал такой конф:
var HOME_NET $eth0_ADDRESS
var EXTERNAL_NET $eth1_ADDRESS
var DNS_SERVERS $HOME_NET
var SMTP_SERVERS $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var TELNET_SERVERS $HOME_NET
var SNMP_SERVERS $HOME_NET
var HTTP_PORTS 80
var SHELLCODE_PORTS !80
var ORACLE_PORTS 1521
preprocessor flow: stats_interval 0 hash 2
preprocessor stream4: disable_evasion_alerts
preprocessor sfportscan: proto { all } \
memcap { 10000000 } \
sense_level { high }
preprocessor arpspoof
output alert_full
var RULE_PATH /etc/snort/rules
include classification.config
include reference.config
include $RULE_PATH/local.rules
include $RULE_PATH/exploit.rules
include $RULE_PATH/community-exploit.rules
include $RULE_PATH/scan.rules
include $RULE_PATH/finger.rules
include $RULE_PATH/icmp.rules
include $RULE_PATH/other-ids.rules
include threshold.conf
