[Snort-devel] *.rules files parsing

alessandrorguard-snortml at ...2440... alessandrorguard-snortml at ...2440...
Thu Nov 19 07:47:31 EST 2009


During some testing with parser.c it comes out that the rules files
included in the snort.conf file gets included 2 times: the first in
ParseSnortConf(), then in ParseRules().
Is it correct?
What are the differences in the two steps?
Could any developer tell the structure of the parsed rules? The only documentation I’m finding on the net seems to be obsolete…
Thanks!

Alessandro R








More information about the Snort-devel mailing list