[Fwd: Re: [Snort-devel] Input-Plugin]

Nico svf_rebell at ...224...
Fri Feb 3 04:04:09 EST 2006


Sorry forgot the list :[

-------- Original Message --------
Subject: Re: [Snort-devel] Input-Plugin
Date: Fri, 03 Feb 2006 13:01:24 +0100
From: Nico <svf_rebell at ...224...>
To: Roland Turner <raz.fabeg.bet at ...2131...>
References: <43E325A3.1030200 at ...224...> <1138964429.13258.2.camel at ...2856...>

Roland Turner wrote:
> Umm, how about putting your synthesised packet into a file with a
> libpcap header and:
> 
>     snort -r filename
> 

I think that woud be to slow... maybe i explained my problem improperly.

it's not only one packet i have to analyze. i will get continuously
packet information.

So it is more running snort in daemon mode analyzing data from my input
plugin instead of libpcap.


Nico





More information about the Snort-devel mailing list