Re: [RGSPAM] Re: Is there any documentation showing how to write a snort plugin?

[Jason Brvenik <jasonb () sourcefire com>]

John Draper wrote:
> Justin Heath wrote:
>
> > Also, you can check the following link for a nearby library
> >
> > http://worldcatlibraries.org/wcpa/isbn/1931836043
>
> I cannot afford to buy any books right now - I got totally burned by
> my most recent client who owes me money - I hate it when that
> happens,  but with all this outsourcing binge going on,  I have
> pretty scant choices for jobs these days.   Do you know if there are
> any web based references showing the overall structure of a snort
> plugin...

Justin was suggesting you check the book out from your local library.
The link he pasted will tell you where the closest library is with the
book available.

> Is there a Python wrapper for a plugin...  boy - now that would be
> most useful....   Do these plugins deploy "callbacks" or are
> there special method with exact names I have to "subclass"?

Try this link to simplify the process.

http://afrodita.unicauca.edu.co/~cbedon/snort/snort.html

> I've looked at some of these plugins,  and they are so completely
> different from each other (in the way they were written),  but I see
> little to no commonality between them,  other then the spo_
> prefix for the plugin file names...

What you seek is there. Look at templates/* and src/plugbase.*

> Is it possible to write a Python based plugin "wrapper" that deploys
> common "callbacks" into Python?

Sure. Why?

Check here for a perl detection plugin for an older release of snort.

http://cerberus.sourcefire.com/~jeff/archives/snort/sp_perl/


> Oviously,  I'm going to want to deply threads for this....  I think!!!
> I just haven't had this experience yet,  and hope to hook up with
> someone on this mailing list working on similar types of things
> so we can share info.

I humbly suggest that you reconsider.

> My project is important to me, because it's going to contribute to
> the detection and eradication of botnets.

I wish you the best in that pursuit. Care to share more detail? I'm
fairly certain there are better ways of achieving what you want.

> John
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users