Re: Is there any documentation showing how to write a snort plugin?

[John Draper <lists () webcrunchers com>]

Martin Roesch wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> There are no documents or templates on writing output plugins,  
> however you can follow the preprocessor template (spp_template.c) in  
> the templates directory for general guidance and then look at one of  
> the simpler output plugins like spo_log_null.c (95 lines of code, the  
> first 38 of which are comments) for a basic look at how output  
> plugins go together. 

Is there any effort to write up a bonehead document with suggestions and 
approaches on how to sucessfully
write and test such a plugin?

I tend to miss some things when scouring web sites for documentation...  
I feel much better to know I
haven't missed this one....  :-)

Thanx Martin for your personal answer.   I'm getting back into doing 
more Snort work,  other then my
usual line of work (Migrating web apps from M$ IIS to Apache servers), 
and VIOP applications...

A lot of new things have been added since my last encounter with Snort 
back in 2004.

Snortsam and/or Snort Inline seem to be the answer to my Immediate 
needs, but (sigh) I just can't find
anyone who has used these on OpenBSD OS's.   Does anyone in this list 
have any insight on these
issues...   According to my findings,  neither seem to support OpenBSD,  
at least not from the Docs
I've been able to find.   Google sometimes doesn't find everything.... 
even through it is by best friend.. :-)

John

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users