[Snort-devel] Dynamic Preprocessor development using Stream5

S N snortdev at ...2499...
Tue Mar 10 16:58:31 EDT 2009


Hello all,

I have a question regarding dynamic preprocessor and using stream5
preprocessor. I want to use stream5 capabilities of reassembling TCP, UDP,
and other fragmented streams. But Stream5 (and stream_api) does not have any
sort of documentation. Can anybody direct me to some documentation or
example usage of stream5 preprocessor, in another preprocessor (esspecially
in a dynamic one, if that makes a difference).

BTW, I have another question about SFSnortPacket and Packet. Both structures
are the same but the names of fields, then why there are two different
structure definitions in the code? Is there something I should be aware of
when writing a dynamic preprocessor?

thanks for you help,

SK
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20090310/81fe7c0c/attachment.html>


More information about the Snort-devel mailing list