Pablo Neira wrote:

quoted

Same for my infrastructure with the difference that libqsearch uses
a single input buffer so no chance for non-linear data.

hm, i don't understand quite well, i bet that libqsearch was already 
fragment-aware. Anyway the main difference is that libqsearch wasn't 
designed to be used in user space so, for example, it needed a complete 
rework to reduce dynamic memory allocations.

sorry, i meant '/s/wasn't/was/g'. libqsearch was designed to be used my 
snort.

--
Pablo