[Snort-devel] Snort preprocessor devel docs

Chris Green cmg at ...402...
Thu Mar 28 12:41:29 EST 2002

Bill McCarty <bmccarty at ...1217...> writes:

> Is there any documentation on developing Snort preprocessors?
> Based on inspection of the source code of several preprocessors,
> writing one seems straightforward enough, but I don't want to miss any
> timesavers or subtleties.

There aren't really many. Basically a decoded packet structure is
handed to you and then you're allowed to do with it what you please.

There should be some archives in the mailing list from maybe 1-2 years
ago of information but the best info is in other plugins ( especially
the newer ones )

Is there particular functionality you were looking at?
Chris Green <cmg at ...402...>
To err is human, to moo bovine.

More information about the Snort-devel mailing list