Signature/rule-matching IDSs are extremely popular for their speed. If we're just inspecting each packet and performing number and string matches against simple patterns, we have a nimble program capable of keeping up with fast, fairly loaded networks. This form of IDS does have weaknesses, though. If its attack patterns are too general, you'll spend too much time analyzing false positives. If those patterns are too specific, you'll miss attacks these misses are called false negatives. Much of the trouble in getting traditional rules right stems from too little expressibility in the signature language, or the inability of the IDS to understand protocols more fully. Some IDSs counter these weaknesses by using a completely different model. They might use protocol anomaly detection, where they alert on packets that don't fit normal use of the packet's protocols. Some signature/rule-based IDSs might also keep additional state on a connection. For example, we don't want our cmd.exe rule from earlier to flag on packets that aren't part of an established TCP session. Preprocessors let Snort do things such as anomaly detection and state keeping on a user-configurable basis.

You'll find preprocessors extremely useful. They make rules easier to write, lower false positive/negative counts, and give a rule-matching IDS the capability to exceed its traditionally simple detection model while maintaining performance. In the next section, we'll examine each of the major purposes for which preprocessors are used, including:

• Reassembling packets

• Decoding protocols

• Nonrule or anomaly-based detection

One thing to take...