[Snort-users] detection and preprocessor plugins
agent33 at ...187...
Tue Jan 29 06:38:09 EST 2002
> > 3) If one have multiple preprocessors, what determines the
> order they run
> > in? Can the defrag run first, then others, allowing them
> to see the packet
> > in its defragged form?
> The order is determined by the way that they're loaded in the
> file. The default order has spp_frag2 loaded first.
So if frag2 is loaded first, will other preprocessors see a packet in its
Or is the defragged packet only available to detection plugins and the
More information about the Snort-users