Re: Do you know if I can use a bpf file from bcc for snort ?


Yonghong Song
 

On Mon, May 27, 2019 at 4:04 AM Dorian ROSSE <dorianbrice@...> wrote:

Hello everybody,


Do you know if I can use a bpf file from bcc for snort ?
You mean a bpf program, right?
Do you mean to have a bpf program to do L7 parsing?
If simple one, it should work. See bcc/examples/networking/http_filter/*.
But since kernel verifier currently does not support loops,
the complex options may not be supported.


Thank you in advance to answer if I can and how to do my ask,

Regards.


Dorian ROSSE.



Provenance : Courrier pour Windows 10



Join iovisor-dev@lists.iovisor.org to automatically receive all group messages.