MODULE_SOURCES
basic.txt
codec.txt
+ connector.txt
data.txt
inspector.txt
ips_action.txt
bugs.txt
building.txt
concepts.txt
- connector.txt
+ connectors.txt
daq.txt
dcerpc.txt
differences.txt
version.txt \
basic.txt \
codec.txt \
+connector.txt \
inspector.txt \
ips_action.txt \
ips_option.txt \
building.txt \
concepts.txt \
config_changes.txt \
-connector.txt \
+connectors.txt \
daq.txt \
dcerpc.txt \
differences.txt \
$(snort) $(plugin_path) --markup --help-module $$m ; \
done > $@
+connector.txt: $(snort)
+ for m in `$(snort) $(plugin_path) --list-modules connector` ; do \
+ $(snort) $(plugin_path) --markup --help-module $$m ; \
+ done > $@
+
inspector.txt: $(snort)
for m in `$(snort) $(plugin_path) --list-modules inspector` ; do \
$(snort) $(plugin_path) --markup --help-module $$m ; \
Connectors are a set of modules that are used to exchange message-oriented
-data among snort threads and the external world. A typical use-case is
+data among Snort threads and the external world. A typical use-case is
HA (High Availability) message exchange. Connectors serve to decouple the
message transport from the message creation/consumption. Connectors expose
a common API for several forms of message transport.
Connectors are a Snort plugin type.
-===== Connector (parent plugin class):
+===== Connector (parent plugin class)
Connectors may either be a simplex channel and perform unidirectional
communications. Or may be duplex and perform bidirectional communications.
* FileConnector - Write messages to files and read messages from files.
-===== TcpConnector:
+===== TcpConnector
TcpConnector is a subclass of Connector and implements a DUPLEX type Connector,
able to send and receive messages over a tcp session.
}
-===== FileConnector:
+===== FileConnector
FileConnector implements a Connector that can either read from files or write
to files. FileConnector's are simplex and must be configured to be
* file_connector_NAME_transmit and file_connector_NAME_receive
-All messages for one snort invocation are read and written to one file.
+All messages for one Snort invocation are read and written to one file.
In the case of a receive FileConnector, all messages are read from the file
prior to the start of packet processing. This allows the messages to
==== Connector
-include::connector.txt[]
+include::connectors.txt[]
==== Side Channel
add_custom_command (
OUTPUT ${output_file}
- COMMAND ${generator_script} $<TARGET_FILE:snort> ${output_file}
+ COMMAND ${generator_script} $<TARGET_FILE:snort> ${output_file} $ENV{SNORT_PLUGIN_PATH}
DEPENDS snort
- COMMENT "Documents: building ${output_file}"
+ COMMENT "Documents: building ${output_file} with $ENV{SNORT_PLUGIN_PATH}"
)
endfunction ( add_help_command )
-HighAvailability (or HA) is a snort module that provides state coherancy
+HighAvailability (or HA) is a Snort module that provides state coherancy
between two partner snort instances. It uses SideChannel for messaging.
-There can be multiple types of HA within snort and snort plugins. HA
+There can be multiple types of HA within Snort and Snort plugins. HA
implements an extensible architecture to enable plugins to subscribe to the
base flow HA messaging. These plugins can then include their own messages
along with the flow cache HA messages.
-SideChannel is a snort module that uses Connectors to implement a messaging
-infrastructure that is used to communicate between snort threads and the
+SideChannel is a Snort module that uses Connectors to implement a messaging
+infrastructure that is used to communicate between Snort threads and the
outside world.
SideChannel adds functionality onto the Connector as:
include::codec.txt[]
+== Connector Modules
+
+Connectors support High Availability communication links.
+
+include::connector.txt[]
+
== Inspector Modules
These modules perform a variety of functions, including analysis of