Skip to content
Emacs major mode for editing Snort rules
Emacs Lisp
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
test
.gitignore
README.org
snort-mode.el

README.org

Snort Major Mode for Emacs

About SNORT®

http://upload.wikimedia.org/wikipedia/en/3/3a/Snort_ids_logo.png

Snort is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire.

Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide.

With millions of downloads and nearly 400,000 registered users, Snort has become the de facto standard for IPS.

Emacs

GNU Emacs is an extensible, customizable text editor—and more. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing.

Features

Support for syntax highlighting, commenting and indentation.

Validate the syntax of the current file with snort-validate and test it against a PCAP-file with snort-test-pcap.

Jump between rules with snort-next-rule and snort-previous-rule. Kill the rule at the point with snort-kill-rule.

Customizable variables

Variables are in the snort group.

  • snort-basic-offset: the indentation level
  • snort-executable: path to the Snort executable

Todo

Misc.

  • Remove word lists when regexp are created (free memory?)
  • Does not support user created rule actions (dynamically?)
  • Variable modifiers
  • Extend the syntax table

Functions

  • snort-expand, snort-contract, snort-expand-all, snort-contract-all: toggle between one-line and multiline rules (one modifier per line)
  • snort-create-rule: create skeleton for common rules (e.g. dns query, http-requests, ping)
You can’t perform that action at this time.