Re: Questions about Frag3 and Stream5

["Jason Brvenik" <jasonb () sourcefire com>]

It could be that this is a better question for snort-devel and users are
generally not that deep into the engine.

In general, after a packet is examined by the preprocessors, it is passed
down the chain to the next preprocessor or the detection engine unless the
preprocessor expressly tells the engine not to pass it along. The only
preprocessors that currently do that that I'm aware of are SSL and http
inspect.

On Tue, Jul 15, 2008 at 8:37 PM, tung tran <tunghack () gmail com> wrote:

> It seems that nobody cares about questions raised by Snort-user or no
> one knows about this??? This is my fifth post and still not a reply
> yet.
>
> On Fri, Jul 11, 2008 at 4:46 AM, tung tran <tunghack () gmail com> wrote:
> > Hi all,
> > Could anyone please let me know after a packet is examined by Frag3 and
> > Stream5, is the packet always passed down to the Detection Engine? If
> > not, in which case a packet is not passed down to the Detection
> > Engine?
> > Thank you very much.
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's
> challenge
> Build the coolest Linux based applications with Moblin SDK & win great
> prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users