Snort not showing all packets

[Ned <gned () optusnet com au>]

I have written a preprocessor that prints the packet payload size and 
contents (p->dsize and p->dp). I want to use it to test stream4 and its 
ability to reassemble TCP streams.

My preprocessor  *almost* works. Unfortunately, when I run it through a 
tcpdump file containing a simple wget of an index.html, I do not see the 
first part of the data from the web server. The first packet is there, but 
my preprocessor sees it as a packet of size 0.

Does anyone know what I could try to fix this?

Also, can anyone confirm that the following determines whether a packet is 
a reassembled stream from stream4?

        if (p->packet_flags & PKT_REBUILT_STREAM) {
                printf("This is a rebuilt stream, rebuilt by stream4.\n");
        }

Thanks



-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users