Snort mailing list archives

confused about the dynamic preprocessor


From: 邓伟锋 <deng.0318 () gmail com>
Date: Sun, 18 Jul 2010 22:28:59 +0800

hello everyone, I have compiled snort-2.8.6 for windows XP sp3, when I was
running and parsing the file netbios.rules set it occured an error that
is "Unknown keyword dce_iface". then I read the source  for some hints but
I'm confused.
in function SnortInit() in snort.c, the instruction flow is
1.parse the configuration in snort.conf except rules
2.used the parsed configuration, call ConfigurePreprocessors()
3.call InitDynamicPreprocessors() to fullfill the data structure of dynamic
preprocessor
4.parse rules.

here is my question,  in function SnortInit(), after first parse the file
snort.conf, the dynamic preprocessors configuration has been parsed and
saved, but the dynamic preprocessors have not been initialized and
registered at that time, so when call ConfigurePreprocessors(), the config
will not take effect, as a result the parse option dce_iface has not been
registered, so the 4 step parse failed.
did I missed something ? Looking forward to your reply. Thank you.
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Current thread: