[Snort-devel] [snort-devel] Chainning pre-processors

Emiliano Fausto emiliano.fausto at ...2499...
Wed Dec 4 12:52:48 EST 2013


Hi everybody,

I'm creating a new preprocessor which needs to have the whole content in a
packet which was fragmented.

So I thought of using the frag3 preprocessor to re-assembly the packets,
and then, when this reassembly is done, sent it to my own preprocessor.

Do you know if this is possible? May I have the output of frag3 being the
input of my own preprocessor?

Regards,
Emiliano.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20131204/381bbb74/attachment.html>


More information about the Snort-devel mailing list