[Snort-devel] Problem in developing a preprocessor

abhishek nigam anigam at ...1956...
Thu Apr 24 06:01:10 EDT 2003

I have gone through the SNORT source code and I saw that it uses a large
number of external shared variables between different modules. 
Actually I am writing a preprocessor for SNORT and what I found was that
the value of p(Packet variable) changes on its own in the middle of the
program.In particular p->iph->ip_src changed. 
Going through the source code of SNORT I thought that it basically runs
one thread per interface. But now it seems that I got it wrong. Can
someone suggest what I should do to rectify this problem and ensure that
my preprocessor looks at the correct values of variables???

More information about the Snort-devel mailing list