Re: Access to the raw data of packets from SFSnortPacket structure

[Russ Combs <rcombs () sourcefire com>]

pkt_data gives you the the raw packet, starting with the outermost header.

payload gives you the start of data after any decoded headers.

On Tue, Jan 31, 2012 at 3:36 AM, <romain () ftml net> wrote:

> Hello,
>
> I would like to develop a snort preprocessor that require access to the
> raw data of a packet, as an array of bytes for example.
> With this preprocessor, I have access to the SFSnortPacket structure but
> I couldn't find the right field in this structure that point to the
> data.
> I was thinking of pkt_data but according to my tests, it does not seem
> to be that.
>
> Do you have any suggestions ?
>
> Thanks,
> Romain
>
>
> ------------------------------------------------------------------------------
> Keep Your Developer Skills Current with LearnDevNow!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-d2d
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!