Home page logo

snort logo Snort mailing list archives

How snort rules are used
From: Raphael Wutzke <raphael.wutzke () fu-berlin de>
Date: Wed, 26 Jun 2013 16:24:27 +0200

Hey folks,

I have got a question concerning snort rules being applied. The 
documentation is not very clear on discussing the data flow. So I wanted 
to know basically, whether it is possible to extract a subsystem 
(without to much difficulty) from the snort source code which would 
function as follows:
2 inputs, one being a file containing the rules and the other one a 
packet or even better a packet stream,file, whatever
output being whether any of the given rules applies to the packet(s).

What I want to do is having generated some snort rules I want to check 
easily on Android OS whether a packet applies to a rule. Since snort 
does not run natively on Android and the depending libraries are not 
available for android either (and manually porting them is not feasible 
easily for all of them) I wanted to extract the specific part of Snort 
which I really need to have, which I hope is possible since I don't 
quite know what the data flow in snort is.

Please bear with me if I totally got it wrong!

Thanks in advance,

This SF.net email is sponsored by Windows:

Build for Windows Store.

Snort-devel mailing list
Snort-devel () lists sourceforge net

Please visit http://blog.snort.org for the latest news about Snort!

  By Date           By Thread  

Current thread:
  • How snort rules are used Raphael Wutzke (Jun 26)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]