[Snort-users] Implementing timeouts in Snort
xendevid at ...11827...
Tue Oct 21 05:34:11 EDT 2008
I am currently working on a preprocessor plugin that needs to keep some
state but will discard it upon a timeout.
I have some experience with snort and have previously written a state
machine based preprocessor plugin.
However I didn't have to use timeouts until now. All the logic was just
based on incoming packet events ie. asynchronous, wherein the packet arrival
events would allow/trigger my logic to execute.
In the timer case I need to get some code to run without triggers from
I looked at the snort.conf file and preprocessors like frag3 do use
timers/timeouts. However it isnt clear how they are implemented in the code.
Can some one give me a few tips/hints so that I could understand how I could
implement timeouts/timers in Snort.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users