[Snort-devel] another spo question

Joseph Nicholas Yarbrough nyarbrough at ...118...
Mon Dec 18 07:12:00 EST 2000


To use a custom output plugin I:
*) write the spo files
*) Then add the spo file to the list of files linked into snort in the 
Makefile.
*) Then compile.

Now I (hopefully) have a snort linked with my output plugin.
How do I tell snort to use my output plugin?

Do I use the "-A" option?
If so, what is the argument I should pass?
Is it the first (char *) argument I passed to RegisterOutputPlugin()?
Should the value I passed as arg 1 to RegisterOutputPlugin() be in the format 
"alert_[-a tag]"?

Maybe someone can clear some of this up for me...

Thanks!
-Nick

Joseph Nicholas Yarbrough
Information Security Analyst
LURHQ Corporation
==========================>
843-626-4ESM (4376) ext. 312
nyarbrough at ...118...





More information about the Snort-devel mailing list