Snort Forums Archive

Archive Home » Snort Development » Developing a new Snort component

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Developing a new Snort component

Posted by nemes1s on June 03, 2005 00:49:09

Hi all,
I want to develop a new component, which needs to observe all traffic and has to know if data match a signature or not, in order to generate (eventually) an alert.
Is it possible with actual core? Do I need to re-write some core files?

Thanks in advice

Posted by roesch on June 28, 2005 12:01:04

That's what Snort's rules-based detection engine does. Sounds like all you need to do is write a rule...

-Marty