[Snort-users] SO Rules: More complex rule writing

Ryan Jordan ryan.jordan at ...1935...
Tue Mar 24 13:36:14 EDT 2009

SO rules are written using the C programming language. We give you the means
to write your own function that gets called whenever your rule is checked.
Ultimately, you would still do some computation and report "Match" or "No
Match", but you can get really creative. We also give you functions to
access the detection plugins, so you can check/set flowbits, use PCRE, etc.

I would highly suggest only writing SO rules if you cannot accomplish your
goals with normal Snort rules. For a silly example, if you wanted to alert
when the payload is a palindrome, it would be much simpler to write a
palindrome-checking C function and put it in an SO rule.

For more information about the API, check out the "Dynamic Modules" section
of the Snort manual:

For a couple example rules, download the Snort source code and look in

If you hit any snags after reading up on this stuff, I'll be here.


On Tue, Mar 24, 2009 at 12:33 PM, Mnemonyss <mnemonyss at ...11827...> wrote:

> I just wanted to get a little more information on what exactly the SO
> format of the rules in 2.6 and later will do exactly.
> I keep reading that one can write more complex rules using it.
> Does this mean I can write a rule that instead of just looking for a
> keyword and alerting, it can do more?
> To keep it simple something like :
> For all traffic encountered matching A but not C and D and F then alert?
> I'm still trying to find more documentation on this and having a hard
> time. Please point me in the right direction.
> Thank you,
> Alicia
> ------------------------------------------------------------------------------
> Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
> powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
> easily build your RIAs with Flex Builder, the Eclipse(TM)based development
> software that enables intelligent coding and step-through debugging.
> Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090324/cbd6c570/attachment.html>

More information about the Snort-users mailing list