snort源码学习

可借鉴的工具函数：

mSplit

Snort 2.9 introduces the DAQ, or Data Acquisition library, for packet I/O.  The
DAQ replaces direct calls to libpcap functions with an abstraction layer that
facilitates operation on a variety of hardware and software interfaces without
requiring changes to Snort.  It is possible to select the DAQ type and mode
when invoking Snort to perform pcap readback or inline operation, etc.

The frag3 preprocessor is a target-based IP defragmentation module for Snort.
Frag3 is designed with the following goals:

1) Faster execution with less complex data management.

2) Target-based host modeling anti-evasion techniques.

Frag3 uses the sfxhash data structure and linked lists for data handling
internally which allows it to have much more predictable and deterministic
performance in any environment which should aid us in managing heavily
fragmented environments.

The Stream5 preprocessor is a target-based TCP reassembly module
for Snort.  It is intended to replace both the Stream4 and flow 
preprocessors, and it is capable of tracking sessions for both
TCP and UDP.  With Stream5, the rule 'flow' and 'flowbits' keywords
are usable with TCP as well as UDP traffic.