> > You don't need to do those, there's a layer already in Bro that reassembles > > fragments and dispatches the recovered packet. > > I assume you're referring to the fragment handling code which is > called early on in NetSessions::NextPacket()? Right, that's where it happens, all filtered packets go through here. Vern