Re: Custom Snort Scripts Not getting invoked
"Oleksii Shumeiko -X \(oshumeik - SOFTSERVE INC at Cisco\) via Snort-users" <[email protected]> Thu, 3 Oct 2024 08:00:37 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
Hi The Lua script misses 'plugin' table. Here you can find a good example of custom Lua-defined IPS option: https://github.com/snort3/snort3_extra/blob/master/src/ips_options/find/find.lua Good luck, Alexey On 2 Oct 2024, at 20:14, Aditya Venkatesh via Snort-users <[email protected]> wrote: Dear Sir / Ma'am, I have written a custom snort script designed to print out the payload of a packet (my_gtp_inspect.lua, attached below). The command used to invoke snort is as follows snort -c snortLoc/snort.lua --script-path snortRules/scripts/ -A fast -k none -r gtp_in_gtp.pcap -q However, the challenge is that I am unable to register the function as a part of a rule (my attempt is present within the script file my_gtp_inspect.lua). The method mentioned outlined in the documentation says to include the script name /function name as a keyword in the rule. However, doing so simply throws an error as invalid keyword. Rule: <WhatsApp Image 2024-09-03 at 16.24.33_5c488278.jpg> Error: <ba327a71-0a59-45a6-9a08-b92bfcdfaf20.jpg> How do we go about getting the packet to pass into the function for further evaluation? Your help is greatly appreciated Regards Aditya <my_gtp_inspect.lua>_______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette