icmp and bro

> You don't need to do those, there's a layer already in Bro that reassembles
> fragments and dispatches the recovered packet.

I assume you're referring to the fragment handling code which is
called early on in NetSessions::NextPacket()?

Right, that's where it happens, all filtered packets go through here.

    Vern