stream based av and snort/Stream5

["lynch.meng" <lynch.meng () gmail com>]

hello all!
    I am working for develop a snort preprosessor to do stream based anti virus. 
    I need do mime decodeing and decompress, so reassembled packets should come to my preprosessor sequentially. 
client side packet have no problem, but i can not get packet with PKT_REBUILT_STREAM flags from server side?

snort version 2.8.x. 
stream5 config:
preprocessor stream5_global: max_tcp 8192, track_tcp yes, track_udp no
preprocessor stream5_tcp: policy first, ports both 80


thanks!

------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel