TABLE OF CONTENTS This chapter is aimed at people who have prior experience setting up and maintaining Snort source code. To reap the full benefits from the remaining chapters of this book, it will be helpful to have a firm understanding of the inner workings of Snort.
The best way to obtain an understanding of Snort is to read the source code. Snort source code is relatively straightforward and written in modular form, thereby allowing for easy reading and development.
This chapter aims to help readers understand Snort source code. It is suggested that readers download a copy of the Snort source code from www.snort.org to refer to throughout this chapter.
To help develop an understanding of the inner workings of Snort, this chapter runs through the Snort engine and briefly explains the code involved in each part of the process.
This chapter also examines how Snort s inline capability works, and explains the various data structures Snort uses.
The Vi IMproved (vim) text editor and the ctags utility form a partnership that makes browsing a semi-complex code tree like Snort, easy.
The vim editor has long been a favorite of UNIX system administrators and computer geeks. It features an (arguably) intuitive user interface with an enormous range of options available for navigating source code and manipulating text. Vim is...
