Comments (3)
It looks like your --plugin-path arg is not including the install directory for your plugin. You can specify a colon separated list with that arg and include the install path of your plugin.
You can check that the plugin is loaded like this:
$ snort --warn-all --plugin-path <so_path>:<cusotm_path> --list-plugins
Be sure to put --list-plugins last as shown. The warnings will reveal any plugin that fails to load due to missing symbols.
from snort3_extra.
Hi,
I received these two warnings:
WARNING: /home/jaeger/snort3_extra/build/src/daqs/daq_socket/daq_socket.so: undefined symbol: snort_plugins (/home/jaeger/snort3_extra/build/src/daqs/daq_socket/daq_socket.so)
WARNING: /home/jaeger/snort3_extra/build/src/tp_appid/tp_appid_example.so: undefined symbol: snort_plugins (/home/jaeger/snort3_extra/build/src/tp_appid/tp_appid_example.so)
After that a bunch of modules/files were listed. Even my custom inspector was there.
inspector::custom_plugin v0 /home/jaeger/snort3_extra/build/src/inspectors/custom_plugin/custom_plugin.so
I updated my command to see if I receive any warning in the actual run.
sudo /usr/local/bin/snort --warn-all -c /usr/local/etc/snort/snort.lua -r ~/pcap_dir/test.pcap -l /var/log/snort --plugin-path /usr/local/etc/so_rules/:/home/jaeger/snort3_extra
And right at the beginning when all the inspectors were loaded I got this warning:
"WARNING: /usr/local/etc/snort/snort.lua: unknown table custom_plugin"
In snort.lua I just added this to the inspector section: custom_plugin = { }
.
Is this not the right way to do this?
from snort3_extra.
Update:
When I change the order from
--plugin-path /usr/local/etc/so_rules/:/home/jaeger/snort3_extra
to
--plugin-path /home/jaeger/snort3_extra:/usr/local/etc/so_rules/
it actually works.
from snort3_extra.
Related Issues (9)
- [API Question] How to use per rule arguments for a new ips action plugin HOT 1
- Issue HOT 12
- Compiling error on CentOS 8: function marked ‘override’, but does not override HOT 2
- issue during 'make' step - get_netbios HOT 4
- fatal error: daq/daq_user.h No such file or directory HOT 1
- None of the required 'snort>=3' found HOT 1
- cannot do httpx per attachment HOT 1
- Cannot build 3.1.0.47 but 3.1.0.42 builds successfully
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from snort3_extra.