[Snort-devel] Snort Packet Decoder
skaf at ...2563...
Wed Jun 9 02:33:06 EDT 2004
Does anyone know where the application layer is decoded, is it in the
decoder or in the preprocessor?
For example if we receive a telnet packet, does the decoder knows that
it is Telnet (by decoding the application layer and not by relying on
the port) and send it to the telnet_negotition preprocessor to treat it,
Or every packet that comes out from the decoder is passed through all
the preprocessor and a check is made inside the preprocessors to know if
the packet belongs to the protocol that it treats (if it is telnet then
it is treated by telnet preprocessor and is dropped by the RPC
preprocessor for example) ?
If my question is not clear, don't hesitate to ask for clarifications ,
my English isn't very good, Sorry
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel