[Snort-devel] another spo question

Joe McAlerney joey at ...63...
Mon Dec 18 13:03:05 EST 2000


Joseph Nicholas Yarbrough wrote:
> 
> To use a custom output plugin I:
> *) write the spo files
> *) Then add the spo file to the list of files linked into snort in the
> Makefile.

You also need to add an #include "<plugin_name.h>" to plugbase.h, and
call your setup function from the relevant Init function in plugbase.c. 
The Init function will either be InitPlugIns(), InitPreprocessors(), or
InitOutputPlugins(), depending on what type it is.

> *) Then compile.
> 
> Now I (hopefully) have a snort linked with my output plugin.
> How do I tell snort to use my output plugin?
> 
> Do I use the "-A" option?

You don't need to.

Take a look at the README.PLUGINS file in case you haven't already. 
There's good stuff in there for users and developers.

-Joe M.

-- 
+--                            --+
| Joe McAlerney, Silicon Defense |
| http://www.silicondefense.com/ |
+--                            --+




More information about the Snort-devel mailing list