<div>Dear Developer's,</div><div><br></div><div>Thank you for your support (Victor Julien) ! It has taken some time for me to analyze, going back to C lang books... and work with the protocol decoder, since I am very new to this kind of big software. </div>
<div><br></div><div>I tried to change something in source-pcap.c and checked whether it works when i compile and run the program.</div><div><br></div><div>Steps followed:</div><div><ol><li>I created a new file for my protocol and imitated the steps followed in other's like <i>decode-ethernet.c</i></li>
<li>Added a case<i> switch (p->datalink)</i> for my protocol decode function. These are basic steps to try and understand what works when i change something.</li></ol>Output:</div><div><ol><li>Through a small change in print line , i found my changes are working and I am following the correct path.</li>
</ol></div><div><br></div><div>Noob Questions; (sorry for this, but need some help)</div><div><ol><li>Will the compiler by default compile my new file? or I should add manually somewhere in the configure file to make that fit into the system built.</li>
<li>How to test the unit test functions written at the end of each protocol's decoder file's.?</li><li>Can we use <b>eclipse </b>or any other IDE for debugging and to check step by step process to check what happens next? ,since it links almost all functions and very difficult to follow what happens next by following all the pointer's. If so how to do it? or What you people are using for development?</li>
</ol></div><br><div class="gmail_quote">On Tue, May 15, 2012 at 6:00 PM, <span dir="ltr"><<a href="mailto:oisf-devel-request@openinfosecfoundation.org" target="_blank">oisf-devel-request@openinfosecfoundation.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Oisf-devel mailing list submissions to<br>
<a href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:oisf-devel-request@openinfosecfoundation.org">oisf-devel-request@openinfosecfoundation.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:oisf-devel-owner@openinfosecfoundation.org">oisf-devel-owner@openinfosecfoundation.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Oisf-devel digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Adding New Protocol Support for Suricata (Victor Julien)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 15 May 2012 13:30:06 +0200<br>
From: Victor Julien <<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>><br>
Subject: Re: [Oisf-devel] Adding New Protocol Support for Suricata<br>
To: <a href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</a><br>
Message-ID: <<a href="mailto:4FB23E3E.3090407@inliniac.net">4FB23E3E.3090407@inliniac.net</a>><br>
Content-Type: text/plain; charset=ISO-8859-1<br>
<br>
On 05/14/2012 12:01 PM, Prabhakaran Kasinathan wrote:<br>
> Dear Developer's,<br>
><br>
> I am doing my master of science thesis at Politecnico di torino, Italy.<br>
> My thesis concentrates on developing an efficient intrusion detection<br>
> system for Wireless Sensor Networks. Basically concentrating on the<br>
> protocols (* IEEE 802.15.4, 6LoWPAN *and its application level<br>
> protocol *COAP(Http)* ) . I have been trying to analyse SNORT and<br>
> SURICATA ( Both doesnt support decoding these protocols ). Found<br>
> SURICATA has some better capabilities, hence decided to work with this.<br>
> But to start with I have some problems.<br>
><br>
> Problem:<br>
><br>
> * Currently I have an sensor node which sniff the IEEE 802.15.4<br>
> traffic and forward them to a virtual Interface ( TUN/TAP ).<br>
> * I tried to run Suricata on that interface , I got the error<br>
><br>
> 8/5/2012 -- 17:02:56 - <Error> - [ERRCODE:<br>
> SC_ERR_DATALINK_UNIMPLEMENTED(38)] - Error: datalink type 195 not<br>
> yet supported in module DecodePcap<br>
><br>
> Question:<br>
><br>
> * How to add support for this datalink type in DecodePcap?<br>
<br>
Check the DecodePcap function in source-pcap.c. Currently Linux SLL,<br>
Ethernet, Raw and PPP are supported there.<br>
<br>
> * How to develop decoder for a new protocol? // /Better to have some<br>
> examples,tutorials./<br>
<br>
I agree that would be useful. Until we have that, please have a look at<br>
a decoder like the one for ethernet in decode-ethernet.c<br>
<br>
> * Wireshark can dissect almost all the protocols which I need. Is<br>
> there any way we can use it for developing decoder for Suricata?<br>
<br>
Only as a reference. There is no way to directly use it in Suricata.<br>
<br>
> It would be a great help for me to start and contribute for this<br>
> opensource community through my thesis.<br>
<br>
I agree that would be nice! Feel free to ask more questions, thats what<br>
this list if for!<br>
<br>
Cheers,<br>
Victor<br>
<br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
Oisf-devel mailing list<br>
<a href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
<br>
End of Oisf-devel Digest, Vol 29, Issue 16<br>
******************************************<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Best Regards,<br>Prabhakaran Kasinathan<br>+39 3279720502<br><br>