[Snort-devel] DNS protocol plugin

scott campbell axonpotential at ...398...
Mon Mar 18 08:42:04 EST 2002


I have put together a DNS protocol plugin that will
allow you to write rules based on the content of both
the header fields and the recursive data structures
within.  The software works and has been more or less
tested, but should be treated like all alpha code.

To get it working, please carefully read the
instructions on the web site - it will be required to
extend the Packet type in order to have a place to put
the required data.  If someone knows a better way,
please let me know and I would be more than happy to
change the design.

I have code, plugin options and examples of use on the
page:

http://www.geocities.com/axonpotential/snort/#DNS_PLUG

Other links on the page go to the DNS preprocessor -
the two work well together!

Please let me know if anyone actually tests this out
or feedback you get.

thanks!

scott campbell

__________________________________________________
Do You Yahoo!?
Yahoo! Sports - live college hoops coverage
http://sports.yahoo.com/




More information about the Snort-devel mailing list