[Snort-devel] How to make my preprocessor being called before the stream5_global (aka spp_session)?

Jan Hermes jan.hermes at ...3632...
Fri Jun 3 03:57:16 EDT 2016

I developed a preprocessor that is also handling Ethernet frames.

The problem I've got is, that my preprocessor is being disabled by the session preprocessor because an Ethernet frame does not have a valid IP header.

I registered my preprocessor with PRIORITY_CORE which evaluates to 0x0 but the session preprocessor is registered with PP_SESSION_PRIORITY = PRIORITY_CORE + PP_CORE_ORDER_SESSION which evaluates also to 0x0 (= 0x0 + 0x0).

So both preprocessors have theoretically the same priority value. The session pp though is being called before, so my preprocessor is being disabled before it can process any Ethernet frame.

Is there a way to register my preprocessor or tweak anything via the session_api, so that it is being called in any case? (e.g. make it the first preprocessor in line, even before the session preprocessor)

Thank you for any help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20160603/53fadd22/attachment.html>

More information about the Snort-devel mailing list