Snort mailing list archives
Re: Questions about Frag3 and Stream5
From: "Jason Brvenik" <jasonb () sourcefire com>
Date: Wed, 16 Jul 2008 08:32:33 -0400
It could be that this is a better question for snort-devel and users are generally not that deep into the engine. In general, after a packet is examined by the preprocessors, it is passed down the chain to the next preprocessor or the detection engine unless the preprocessor expressly tells the engine not to pass it along. The only preprocessors that currently do that that I'm aware of are SSL and http inspect. On Tue, Jul 15, 2008 at 8:37 PM, tung tran <tunghack () gmail com> wrote:
It seems that nobody cares about questions raised by Snort-user or no one knows about this??? This is my fifth post and still not a reply yet. On Fri, Jul 11, 2008 at 4:46 AM, tung tran <tunghack () gmail com> wrote:Hi all, Could anyone please let me know after a packet is examined by Frag3 and Stream5, is the packet always passed down to the Detection Engine? If not, in which case a packet is not passed down to the Detection Engine? Thank you very much.------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Questions about Frag3 and Stream5 tung tran (Jul 11)
- Re: Questions about Frag3 and Stream5 tung tran (Jul 15)
- Re: Questions about Frag3 and Stream5 Joel Esler (Jul 15)
- Re: Questions about Frag3 and Stream5 tung tran (Jul 15)
- Re: Questions about Frag3 and Stream5 Nigel Houghton (Jul 16)
- Re: Questions about Frag3 and Stream5 Joel Esler (Jul 15)
- Re: Questions about Frag3 and Stream5 Jason Brvenik (Jul 16)
- Re: Questions about Frag3 and Stream5 tung tran (Jul 15)
- <Possible follow-ups>
- Re: Questions about Frag3 and Stream5 Andy Pace (Jul 15)