[Snort-devel] snort and preprocessors

From: antonat <antonat(at)csd.uoc.gr>
Date: Mon Jul 28 2003 - 19:50:59 EDT

i have two questions :

a)for every packet that it comes we perform a setwise content-match and then we check for the header? if so, when keywords like flow are examined?

b)when i enable stream4 the packet is first given to preprocessor. afterwards the detect() function is called. so all packets which are part of a stream are also being examined independently?

Antonatos Spyros

---

This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Mon Jul 28 20:21:56 2003