Abstract: This document describes techniques for continuing execution of intrusion detection software when a process exception caused by a protocol decoder is thrown during processing. In one example, a method includes receiving a packet, and processing the packet using intrusion detection software that includes a processing engine and a plurality of protocol decoders. The method also includes detecting an exception that occurs during processing of the packet, identifying a memory location associated with the exception, and determining whether the exception was caused by one of the protocol decoders based on the memory location associated with the exception. The method further includes handling the exception and continuing execution of the intrusion detection software after determining that the exception was caused by one of the protocol decoders. In some implementations, handling the exception may include determining which one of the protocol decoders caused the exception, and disabling the decoder.