Re: [snort-devel] Chainning pre-processors

[Hui Cao <hcao () sourcefire com>]

sc means snort configuration. We use PRIORITY to sort the processing. 
All processors enabled will be called and processed based on priority. 
You have to rely on the code to figure out what exactly snort does.

The checking is correct. You will only process rebuilt packets.

Best,
Hui.
On 12/04/2013 02:19 PM, Emiliano Fausto wrote:
> Hello Hui,
>
> thanks a lot for your answer.
>
> Right now I have registered my preprocessor (let's call it 
> examplePreprocess as you said, because right now I'm using the one 
> provided with the DPX) with this line:
>
> _dpd.addPreproc(ExampleProcess, PRIORITY_TRANSPORT, 10000, 
> PROTO_BIT__TCP);
>
> So, the only change is to add previous to the parameter 
> ExampleProcess, the "sc". What does it mean? Do you know if there's 
> any documentation about this chaining preprocesses?
>
> So, checking the flags, should be:
>
> (SFSnortPacket*)tcppacket)->flags & FLAG_REBUILT_FRAG
>
> right?
>
> Thanks again!
> Emiliano.
>
>
>
> Then, I'll have to register my own preprocessor where?
>
>
> 2013/12/4 Hui Cao <hcao () sourcefire com <mailto:hcao () sourcefire com>>
>
>     Yes, it is possible. You can register you preprocessor like this:
>
>     _dpd.addPreproc( sc, ExampleProcess, PRIORITY_TRANSPORT,
>     You_PP_ID, PROTO_BIT__IP );
>
>     Remember check the following flag in your ExampleProcess:
>
>     (SFSnortPacket*)ipacketp)->flags & FLAG_REBUILT_FRAG
>
>     Best,
>     Hui.
>
>
>     On 12/04/2013 12:52 PM, Emiliano Fausto wrote:
> >     Hi everybody,
> >
> >     I'm creating a new preprocessor which needs to have the whole
> >     content in a packet which was fragmented.
> >
> >     So I thought of using the frag3 preprocessor to re-assembly the
> >     packets, and then, when this reassembly is done, sent it to my
> >     own preprocessor.
> >
> >     Do you know if this is possible? May I have the output of frag3
> >     being the input of my own preprocessor?
> >
> >     Regards,
> >     Emiliano.
> >
> >
> >     ------------------------------------------------------------------------------
> >     Sponsored by Intel(R) XDK
> >     Develop, test and display web and hybrid apps with a single code base.
> >     Download it for free now!
> >     http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk
> >
> >
> >     _______________________________________________
> >     Snort-devel mailing list
> >     Snort-devel () lists sourceforge net  <mailto:Snort-devel () lists sourceforge net>
> >     https://lists.sourceforge.net/lists/listinfo/snort-devel
> >     Archive:
> >     http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
> >
> >     Please visithttp://blog.snort.org  for the latest news about Snort!
>
>
>     ------------------------------------------------------------------------------
>     Sponsored by Intel(R) XDK
>     Develop, test and display web and hybrid apps with a single code base.
>     Download it for free now!
>     http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk
>     _______________________________________________
>     Snort-devel mailing list
>     Snort-devel () lists sourceforge net
>     <mailto:Snort-devel () lists sourceforge net>
>     https://lists.sourceforge.net/lists/listinfo/snort-devel
>     Archive:
>     http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
>     Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------
Sponsored by Intel(R) XDK 
Develop, test and display web and hybrid apps with a single code base.
Download it for free now!
http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!