It could be that this is a better question for snort-devel and users are
generally not that deep into the engine.
In general, after a packet is examined by the preprocessors, it is passed
down the chain to the next preprocessor or the detection engine unless the
preprocessor expressly tells the engine not to pass it along. The only
preprocessors that currently do that that I'm aware of are SSL and http
inspect.
On Tue, Jul 15, 2008 at 8:37 PM, tung tran <tunghack@gmail.com> wrote:
It seems that nobody cares about questions raised by Snort-user or no
one knows about this??? This is my fifth post and still not a reply
yet.
On Fri, Jul 11, 2008 at 4:46 AM, tung tran <tunghack@gmail.com> wrote:
Hi all,
Could anyone please let me know after a packet is examined by Frag3 and
Stream5, is the packet always passed down to the Detection Engine? If
not, in which case a packet is not passed down to the Detection
Engine?
Thank you very much.
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>list
archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
