[Snort-devel] Developping Snort Preprocessor

L0rd Ch0de1m0rt l0rdch0de1m0rt at ...2499...
Tue Aug 10 16:45:05 EDT 2010


Hello.  There are also video and slides:

https://media.defcon.org/dc-16/video/Defcon16-Ben_Feinstein-Snort_Plug-in.m4v

Thank you.

-L0rd Ch0de1m0rt

On 8/10/10, Marcos Rodriguez <marcos.e.rodriguez at ...2499...> wrote:
> On Tue, Aug 10, 2010 at 2:44 PM, L0rd Ch0de1m0rt
> <l0rdch0de1m0rt at ...2499...>wrote:
>
>> Ben Fienstein did a DEFCON presentation on creating snort
>> preprocessors/plugins in 2008 I think.  That could be a good starting
>> point, it should be available on the DEFCON site.
>>
>> -L0rd Ch0de1m0rt
>>
>> On 8/10/10, kevin huber <huberkev11 at ...445...> wrote:
>> >
>> > I am new at snort development and am trying to build a custom
>> preprocessor.
>> > Does anyone have the steps/tutorial on how to go about writing a custom
>> > preprocessor?  Particularily for deep packet inspection and
>> > modification.
>> > Thanks.
>> >
>> > Kevin
>>
>
> Good call!  Here's the link for the presentation:
>
> http://www.defcon.org/images/defcon-16/dc16-presentations/dc-16-feinstein.pdf
>




More information about the Snort-devel mailing list