icmp and bro

Vern Paxson vern at ee.lbl.gov
Fri Dec 18 23:28:45 PST 1998

>  > You don't need to do those, there's a layer already in Bro that reassembles
>  > fragments and dispatches the recovered packet.
> I assume you're referring to the fragment handling code which is
> called early on in NetSessions::NextPacket()?

Right, that's where it happens, all filtered packets go through here.


More information about the Bro mailing list