[Snort-devel] Snort Packet Decoder

Brian bmc at ...835...
Wed Jun 9 07:36:01 EDT 2004


On Wed, Jun 09, 2004 at 11:33:34AM +0200, skaf wrote:
> Or every packet that comes out from the decoder is passed through
> all the preprocessor and a check is made inside the preprocessors to
> know if the packet belongs to the protocol that it treats (if it is
> telnet then it is treated by telnet preprocessor and is dropped by
> the RPC preprocessor for example) ? 

Every packet is passed through every preprocessor.  The preprocessors
decide if they want to muck with the packet or not.

Brian




More information about the Snort-devel mailing list