[Snort-users] Dynamic preprocessor - detection engine on normalized data only

Arun Koshal akoshal04 at ...11827...
Sat Feb 21 10:55:57 EST 2015


Hi,

We are developing a simple snort dynamic preprocessor for a TCP based
application. The application traffic includes messages of varying lengths
between the client and server. The objective of preprocessor is to have
snort doing rule detection on messages rather than on packets.

The preprocessor simply identifies the messages boundaries based on the
message length in the message header and copies the message in
DecodeBuffer.data. We are calling SetAltDecode function with proper message
length, followed by the _dpd.detect(). We observe that snort is still
working on the packet payload instead of this normalized DecodeBuffer. Is
this behavior correct?

How can we make snort rule engine to work on normalized payload in
DecodeBuffer and ignore the payload in Packet?

We are using Snort 2.9.6.2.

Please suggest.

Thanks,
Arun
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150221/f072a5d0/attachment.html>


More information about the Snort-users mailing list