[Oisf-devel] Going to Open Source and plugins

[Victor Julien]

On 09/18/2014 09:30 AM, Sartakov A. Vasily wrote:
>>> The second question is about plugins support. There is functionality in snort that are need for us. We have to control association of MAC and IP provided by rules. As far I understand, that functionality provided via plugin in Snort. Can you advise right approach for obtaining the same functional in Suricata? What is the best place in sources to «hook», or, maybe, there are plugin engine already under construction? 
>> > 
>> > We don't currently have a dynamic plugin API. The various keywords are
>> > implemented in a modular way though.
> 
> So, as I understand, we have to implement this functionality from scratch. Can you give advice? We have to register new keyword, right, and add MAC address processing somewhere?

I would suggest having a look at some of the current detection modules.
A simple one would be the 'itype' module, which matches against icmp
'type' fields.

detection: detect-itype.c
packet decoding: decode-icmpv4.c

Cheers,
Victor

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------