Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort
Snort News Downloads Snort Docs Rules Snort Community Snort Forums Snort Training
Search Site
Search Rules
Account
email
password
not registered?
user preferences

Snort Forums Archive

Archive Home » Snort Development » Lightweight Snort for one single service/application

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Lightweight Snort for one single service/application


Posted by Leo_Cavallari on February 08, 2006 12:23:08

Hi al..

I'm developing an application agent that fed the snort directly on the variables at decode.c file (brevizniak's tip) and pass Ip and Port, destination IP and port, and payload to be analyzed.

First question, Are those information enough to be analyzed and generate alerts?


Second point: as I said, the agent will monitor the data for a single application/service (eg: ftp, http) and I want to let snort detect only the information I pass by the agent, and discard all other information that comes from the ethernet interface.
..Second question: How could I disable all decoders for other protocols formats?

Thanks in advance!



site feedback | Terms of Use | Privacy Policy | forum archives ©2007 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.