[Snort-devel] Preprocessor guides

Pietro Ravasio snort at ...1266...
Mon Apr 15 05:50:03 EDT 2002

 >Hi to all ,
 >I am a new snort user and i wish  to get involved in the development >and
 >coding part of snort.
 >I feel that starting with preprocessors' development is an interesting
 >idea and i would be very thankfull if anyone has something to recomend
 >me about reading that could be helpful in any way .

Hi John,

I'm writing a plugin at the moment too, you can find some info in 
/templates/spp_template.c|h snort source files, they're a good starting 
point. Don't forget to read /doc/README.PLUGINS to learn how to activate 
your preprocessor.
Then I suggest you to carefullyread decode.h to understand Packet 
structures layout you can work on in your plugin. You can also get some 
example from one of snort built-in preprocessors, like 
spp_telnet_negotiation.c (one of the simplest).

I've also create a documentation of the source tree with doxygen, it can 
be of great help to find what you're looking for. Working with a 
"visual" tool like anjuta or source navigator can be useful, too.

Kind regards,

"Our real illiteracy is our inability to create"

More information about the Snort-devel mailing list