[Snort-devel] confused about the dynamic preprocessor

邓伟锋 deng.0318 at ...2499...
Sun Jul 18 10:28:59 EDT 2010


hello everyone, I have compiled snort-2.8.6 for windows XP sp3, when I was
running and parsing the file netbios.rules set it occured an error that
is "Unknown keyword dce_iface". then I read the source  for some hints but
I'm confused.
in function SnortInit() in snort.c, the instruction flow is
1.parse the configuration in snort.conf except rules
2.used the parsed configuration, call ConfigurePreprocessors()
3.call InitDynamicPreprocessors() to fullfill the data structure of dynamic
preprocessor
4.parse rules.

here is my question,  in function SnortInit(), after first parse the file
snort.conf, the dynamic preprocessors configuration has been parsed and
saved, but the dynamic preprocessors have not been initialized and
registered at that time, so when call ConfigurePreprocessors(), the config
will not take effect, as a result the parse option dce_iface has not been
registered, so the 4 step parse failed.
did I missed something ? Looking forward to your reply. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20100718/efaedc5d/attachment.html>


More information about the Snort-devel mailing list