[Snort-devel] Implementing timeouts in Snort

Devdutt Patnaik xendevid at ...2499...
Tue Oct 21 05:18:28 EDT 2008


Hi All,

I am currently working on a preprocessor plugin that needs to keep some
state but will discard it upon a timeout.

I have some experience with snort and have previously written a state
machine based preprocessor plugin.
However I didn't have to use timeouts until now. All the logic was just
based on incoming packet events ie. asynchronous, wherein the packet arrival
events would allow/trigger my logic to execute.
In the timer case I need to get some code to run without triggers from
incoming packets.

I looked at the snort.conf file and preprocessors like frag3 do use
timers/timeouts. However it isnt clear how they are implemented in the code.

Can some one give me a few tips/hints so that I could understand how I could
implement timeouts/timers in Snort.

Thanks,
Devdutt.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20081021/7ccb020b/attachment.html>


More information about the Snort-devel mailing list