[Snort-devel] Publishing http attributes

Russ rucombs at ...3461...
Tue Jun 28 07:17:46 EDT 2016

On 6/28/16 5:26 AM, Akhil Koul wrote:
> Hello
> For a project I am working on, I would like to publish http host, 
> version and method so that it is available to subscribers. Currently, 
> only http_raw_uri is published which is subscribed and logged by 
> data_log inspector.
> I would like the data_log inspector to be able to subscribe to above 
> attributes(or maybe a new inspector which can subscribe to and handle 
> several http attributes).
> How do I do this? Any help will be appreciated.
You need to define new DataEvent subclasses and publish them from the 
HTTP inspector.
> Thanks
> Akhil
> ------------------------------------------------------------------------------
> Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
> Francisco, CA to explore cutting-edge tech and listen to tech luminaries
> present their vision of the future. This family event has something for
> everyone, including kids. Get more information and register today.
> http://sdm.link/attshape
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
> Please visit http://blog.snort.org for the latest news about Snort!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20160628/003a848e/attachment.html>

More information about the Snort-devel mailing list