Snort mailing list archives
RE: detection and preprocessor plugins
From: Steve Halligan <agent33 () geeksquad com>
Date: Tue, 29 Jan 2002 08:37:42 -0600
3) If one have multiple preprocessors, what determines theorder they runin? Can the defrag run first, then others, allowing themto see the packetin its defragged form?The order is determined by the way that they're loaded in the snort.conf file. The default order has spp_frag2 loaded first.
So if frag2 is loaded first, will other preprocessors see a packet in its defragged state? Or is the defragged packet only available to detection plugins and the signature engine? -steve _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- detection and preprocessor plugins Steve Halligan (Jan 28)
- Re: detection and preprocessor plugins Martin Roesch (Jan 28)
- <Possible follow-ups>
- RE: detection and preprocessor plugins Steve Halligan (Jan 29)
- RE: detection and preprocessor plugins Steve Halligan (Jan 29)
- Re: detection and preprocessor plugins Martin Roesch (Jan 29)