snort output plugin

Dear all,

I am currently using Snort and Prelude-Manager.
Currently, the additionnal data field containing the packet payload is in
format "byte-string".
I have identified this line in the snort prelude output plugin
        add_byte_data(alert, "payload", p->data, p->dsize);

I would like to know if this is possible to convert the packet payload into
ascii, and if yes, how?

Would something like this would be possible? I looked at the spo_idmef.c
output plugin that uses "payload = ascii(p->data, p->dsize);"
        payload = ascii(p->data, p->dsize);
        add_string_data(alert, "payload", payload);
        free(payload);

Thanks a lot,
Best regards,

Raymond
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user