[Snort-devel] another spo question

Joe McAlerney joey at ...63...
Mon Dec 18 13:03:05 EST 2000

Joseph Nicholas Yarbrough wrote:
> To use a custom output plugin I:
> *) write the spo files
> *) Then add the spo file to the list of files linked into snort in the
> Makefile.

You also need to add an #include "<plugin_name.h>" to plugbase.h, and
call your setup function from the relevant Init function in plugbase.c. 
The Init function will either be InitPlugIns(), InitPreprocessors(), or
InitOutputPlugins(), depending on what type it is.

> *) Then compile.
> Now I (hopefully) have a snort linked with my output plugin.
> How do I tell snort to use my output plugin?
> Do I use the "-A" option?

You don't need to.

Take a look at the README.PLUGINS file in case you haven't already. 
There's good stuff in there for users and developers.

-Joe M.

+--                            --+
| Joe McAlerney, Silicon Defense |
| http://www.silicondefense.com/ |
+--                            --+

More information about the Snort-devel mailing list