[Snort-devel] About the output plugin

Steven Sturges steve.sturges at ...402...
Mon Mar 17 12:21:27 EDT 2008

Hi Leo--

You can think of all of the 'core' snort modules that are
built into a library as a '.a' and statically linked as
the main Snort binary.  This is the case with the detection
plugins, output plugins, preprocessors, and utility functions.

There is certainly no requirement that the output plugins (or
any of the core modules) are built as .a, however there is
currently no core to load them dynamically at run time based
on a configuration.  You could certainly built them as '.so'
and let the run-time link loader do that for you.

Of course, care must be taken as interfaces are added/deleted
for the output plugins to maintain compatibility across similarly
named '.so' files.


Leo Lin wrote:
> Hi,
> I am trying to use snortsam to integrate snort to checkpoint firewall, 
> and I found that I have to use its output plugin in recompiling whole 
> source way, in the Makefile of output plugin, I found that all plugins 
> is archived as `.a'. That puzzled me, is there any reason not to use the 
> output plugin as `.so' and provides some dynamical loading method to 
> avoid the re-compile? What I think is flexibility is helpful.
> Thanks.
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

More information about the Snort-devel mailing list