TABLE OF CONTENTS In this section, we'll explore why and how you might write your own preprocessor plug-in. We'll accomplish the former by exploring the spp_telnet_negotiation.c preprocessor. We'll see the necessary components in a preprocessor, how it's plugged in to the Snort source code, and how it accomplishes its function. After this discussion, you'll be well on your way to writing your own preprocessor.
Over the course of this chapter, we've explored the following reasons to write your own preprocessor:
Reassembling packets
Decoding protocols
Nonrule or anomaly-based detection
In essence, you write your own preprocessor whenever you want to do something that straight rule-based detection can't do without help. Let's explore each of the previously listed reasons, to understand why they needed a preprocessor to fulfill the function.
Signature-based detection matches well-defined patterns against the data in each packet, one at a time. It can't look at data across packets without help. By reassembling fragments into full packets with frag2, you can make sure that an attack doesn't successfully use fragmentation to evade detection. By reassembling each stream into one or more pseudo-packets with stream4, you attempt to ensure that the single-packet signature mechanism is able to match patterns across multiple packets in a TCP session. Finally, by adding state-keeping with stream4, you give this signature-matching some intelligence about which packets can be ignored and where a packet is in the connection. Packet reassembly preprocessors help to ensure that Snort detects attacks, even when the data...
