Re: Alert_unixsock

[Fyodor <fygrave () tigerteam net>]

On Sun, Sep 02, 2001 at 02:34:26PM -0400, Anupam Bansal wrote:
> Hi,
>
> I am trying to write rules so that I can directly send data to a socket.
> However, the documentation for the Alert_unixsock option as outlined in
> the documentation seems to be incomplete, since it does not include any
> specification of the socket number. What is the correct format for
> this option ??

There's no socket  number, all you need is to connect(2) unix socket
SOCK_DGRAM to /dev/snort_alert (defined as UNSOCK_FILE in snort.h)

(I wrote a sample years ago, if you want, I could dig it up :))

-- 
http://www.notlsd.net
PGP fingerprint = 56DD 1511 DDDA 56D7 99C7  B288 5CE5 A713 0969 A4D1

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users