[Snort-devel] Snort preprocessor devel docs
cmg at ...402...
Thu Mar 28 12:41:29 EST 2002
Bill McCarty <bmccarty at ...1217...> writes:
> Is there any documentation on developing Snort preprocessors?
> Based on inspection of the source code of several preprocessors,
> writing one seems straightforward enough, but I don't want to miss any
> timesavers or subtleties.
There aren't really many. Basically a decoded packet structure is
handed to you and then you're allowed to do with it what you please.
There should be some archives in the mailing list from maybe 1-2 years
ago of information but the best info is in other plugins ( especially
the newer ones )
Is there particular functionality you were looking at?
Chris Green <cmg at ...402...>
To err is human, to moo bovine.
More information about the Snort-devel