Snort mailing list archives
Re: How get list of valid app names for appids rule option.
From: Andy Swartzbaugh via Snort-users <snort-users () lists snort org>
Date: Thu, 4 Oct 2018 10:26:53 -0400
I believe that the last column of the 'src/network_inspectors/appid/odp/appMapping.data' file will give you what you need. With the following snort.lua configuration element: appid = { debug = true, } You only get the following appid-specific debug information from the executable (which unfortunately does not include the list of appid names): AppId Lua-Detector Stats: instance 0, odp detectors 0, custom detectors 0, total memory 33 kb On Thu, Oct 4, 2018 at 7:21 AM Meridoff via Snort-users < snort-users () lists snort org> wrote:
Hello, subj. For snort++. How is the simplest wayt to get valid names that can be used in appids rules option ? I have the ODP dir with lua odp modules, I need to parse them to get names? The valid name is DetectorPackageInfo.name filed ? Thanks _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- How get list of valid app names for appids rule option. Meridoff via Snort-users (Oct 04)
- Re: How get list of valid app names for appids rule option. Andy Swartzbaugh via Snort-users (Oct 04)
- Re: How get list of valid app names for appids rule option. Andy Swartzbaugh via Snort-users (Oct 04)
- Re: How get list of valid app names for appids rule option. Mike Stepanek (mstepane) via Snort-users (Oct 04)
- Re: How get list of valid app names for appids rule option. Meridoff via Snort-users (Oct 05)
- Re: How get list of valid app names for appids rule option. Diddi amiibiai via Snort-users (Oct 05)
- Re: How get list of valid app names for appids rule option. Russ via Snort-users (Oct 05)
- Re: How get list of valid app names for appids rule option. Andy Swartzbaugh via Snort-users (Oct 04)