[Snort-devel] Packet versus SFSnortPacket

Steven Sturges steve.sturges at ...402...
Tue Sep 8 17:41:50 EDT 2009


The layout is exactly the same in terms of field alignment.

The dynamic preprocessors that use the SFSnortPacket structure
only need certain fields from the Packet.  In order to not
pull in all of the data types for the various headers that
they do not require, SFSnortPacket declares those as void *.

snort user wrote:
> Hello!
> 
> Could anyone explain the reason for using SFSnortPacket as opposed to
> the Packet in dynamic preprocessor code. They seem to be almost exactly same.
> 
> Thanks !





More information about the Snort-devel mailing list