Re: How get list of valid app names for appids rule option.

[Andy Swartzbaugh via Snort-users <snort-users () lists snort org>]

Sorry, I forgot to include the appid directory:

appid =
{
    debug = true,
    -- appid requires this to use appids in rules
    app_detector_dir = '/opt/snort/lib/'
}

You get the dynamic stats:

--------------------------------------------------
Appid dynamic stats:
firefox: flows: 0, clients: 1, users: 0, payloads 0, misc: 0, incompatible:
0, failed: 0
http: flows: 1, clients: 0, users: 0, payloads 0, misc: 0, incompatible: 0,
failed: 0
--------------------------------------------------

in addition to the overall line:

AppId Lua-Detector Stats: instance 0, odp detectors 497, custom detectors
0, total memory 2900 kb

But you still won't get a listing of the appids.

On Thu, Oct 4, 2018 at 10:26 AM Andy Swartzbaugh <andy.swartzbaugh () gmail com>
wrote:

> I believe that the last column of the
> 'src/network_inspectors/appid/odp/appMapping.data' file will give you what
> you need.
>
> With the following snort.lua configuration element:
>
> appid =
> {
>     debug = true,
> }
>
> You only get the following appid-specific debug information from the
> executable (which unfortunately does not include the list of appid names):
>
> AppId Lua-Detector Stats: instance 0, odp detectors 0, custom detectors 0,
> total memory 33 kb
>
> On Thu, Oct 4, 2018 at 7:21 AM Meridoff via Snort-users <
> snort-users () lists snort org> wrote:
>
> > Hello,
> > subj.
> >
> > For snort++.
> >
> > How is the simplest wayt to get valid names that can be used in appids
> > rules option ?
> >
> > I have the ODP dir with lua odp modules, I need to parse them to get
> > names? The valid name is DetectorPackageInfo.name filed ?
> > Thanks
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists snort org
> > Go to this URL to change user options or unsubscribe:
> > https://lists.snort.org/mailman/listinfo/snort-users
> >
> >         To unsubscribe, send an email to:
> >         snort-users-leave () lists snort org
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> > Snort news!
> >
> > Please follow these rules:
> > https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette