Re: Do you know if I can use a bpf file from bcc for snort ?
On Mon, May 27, 2019 at 4:04 AM Dorian ROSSE <dorianbrice@...> wrote:
You mean a bpf program, right?
Do you mean to have a bpf program to do L7 parsing?
If simple one, it should work. See bcc/examples/networking/http_filter/*.
But since kernel verifier currently does not support loops,
the complex options may not be supported.