[Snort-devel] Input-Plugin

Roland Turner raz.fabeg.bet at ...2131...
Fri Feb 3 03:01:07 EST 2006


On Fri, 2006-02-03 at 10:42 +0100, Nico wrote:

> Summary: i've got full knowlegde(maybe some payload missing) of a packet
> and need snort to analyze it. Two solutions were discussed in the thread:
> 
> 1. craft a packet out of the info and kinda "replay" it snort the normal way
> 2. modify decode.c for my needs.
> 
> So before making my decision and start - i just want to make sure that
> there is no thing like an input-module/input-interface where i can
> easily inject a packet into snort.

Umm, how about putting your synthesised packet into a file with a
libpcap header and:

    snort -r filename

?

- Raz






More information about the Snort-devel mailing list