[Snort-devel] preprocessor drop packets issues
zhanghan0116 at ...2499...
Fri Dec 6 20:04:59 EST 2013
I'm currently writing a Snort preprocessor, which tries to drop
packets before it goes to the detection engine and triggers any rules. I
tried function Active_DropPacket(); but it doesn't work.
I attached my code here, for test purpose, this code just drop all
the HTTP packets. I could see output "Got a packet", which means this
preprocessor was called. But it did not drop any HTTP packet. Was I using a
wrong function to drop the packet? Any comment is appreciate.
static void Detection(Packet *p, void *context)
TestConfig *entropy = NULL;
LogMessage("Got a packet\n");
sfPolicyUserPolicySet (entropy_config, getRuntimePolicy());
entropy = (EntropyConfig *)sfPolicyUserDataGetCurrent(entropy_config);
/* Not configured in this policy */
if (entropy == NULL)
if(p->sp == 80)
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel