[Snort-devel] Question regarding Flowbits

Todd Wease twease at ...402...
Fri May 30 14:48:57 EDT 2008


The actual rule option data is allocated and stored in a hash table. 
See src/detection-plugins/sp_flowbits.{c,h}.  Stream5 uses a mempool to 
dole out flow data structures.  Look at src/preprocessors/spp_stream5.c 
and src/preprocessors/Stream5/*.

Adayadil Thomas wrote:
> Greetings.
> 
> I am looking through the source code of snort 2.8.1 and I am trying to
> understand
> the allocation for memory for flowbits data.
> 
> If x bytes (x times 8 bits) are needed for flowbits data, how and
> where the memory
> is allocated? If you can specify the file/function that I am looking
> for that would be great.
> 
> Thanks
> Aday
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel





More information about the Snort-devel mailing list