> You don't need to do those, there's a layer already in Bro that reassembles
> fragments and dispatches the recovered packet.
I assume you're referring to the fragment handling code which is
called early on in NetSessions::NextPacket()?
Right, that's where it happens, all filtered packets go through here.