[Snort-devel] Snort PlugIns

skaff rawad rawadskaff at ...445...
Tue Jun 1 06:53:05 EDT 2004


I am doing a study on snort and I have few question if anyone can answer 
them it will be great.

I read and understood the logic behind PreProcessors and detection PlugIns, 
and they are great for users and developers to add new functionality;

but I was wondering, is it possible that we use another sensor to feed snort 
with packets, what I mean is that to decode the packets and send different 
or more  information (variables) to snort  so it can apply the rules on them 
(if i have a aggregation mechanism for exemple that separates packets 
depending on their QoS ) ?

which part of the code is responsible to decode the packets and send them to 
snort ?

finally where, how and when does the code treats the rule and the snort.conf 
files (written in ASCII text file) ?



The new MSN 8: smart spam protection and 2 months FREE*  

More information about the Snort-devel mailing list