Snort mailing list archives
confused about the dynamic preprocessor
From: 邓伟锋 <deng.0318 () gmail com>
Date: Sun, 18 Jul 2010 22:28:59 +0800
hello everyone, I have compiled snort-2.8.6 for windows XP sp3, when I was running and parsing the file netbios.rules set it occured an error that is "Unknown keyword dce_iface". then I read the source for some hints but I'm confused. in function SnortInit() in snort.c, the instruction flow is 1.parse the configuration in snort.conf except rules 2.used the parsed configuration, call ConfigurePreprocessors() 3.call InitDynamicPreprocessors() to fullfill the data structure of dynamic preprocessor 4.parse rules. here is my question, in function SnortInit(), after first parse the file snort.conf, the dynamic preprocessors configuration has been parsed and saved, but the dynamic preprocessors have not been initialized and registered at that time, so when call ConfigurePreprocessors(), the config will not take effect, as a result the parse option dce_iface has not been registered, so the 4 step parse failed. did I missed something ? Looking forward to your reply. Thank you.
------------------------------------------------------------------------------ This SF.net email is sponsored by Sprint What will you do first with EVO, the first 4G phone? Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel
Current thread:
- confused about the dynamic preprocessor 邓伟锋 (Jul 18)