TABLE OF CONTENTS Preprocessors have gone from humble beginnings as simple normalizers to where they are today: not just normalizers, but intense and complex pieces of code. Today's preprocessors not only perform anomaly detection and protocol normalization, but also they generate their own alerts (many always have). In fact, they are more important than ever to the detection engine. When people refer to the detection engine, they aren't referring to Snort as a whole anymore Detection engine is a term that is used to refer to the Rules engine, the portion of code that builds the rules on startup and runs packets through the rules when Snort is operating. It is important to distinguish these different parts of the Snort engine now, because most people fail to realize that preprocessors are not rule-based. They are self-standing pieces of code that are compiled into Snort, each having their own configuration, each performing a different function, but all of them working together to show the Rules engine the "simplest" possible view of traffic.
In this chapter, we will discuss how preprocessors work alone as well as together to solve the complex problem of analyzing traffic and attacks present in today's world.
Want the quick answer? A preprocessor is code that is compiled into the Snort engine upon build in order to normalize traffic and/or examine the traffic for attacks in a fashion beyond what can be done in normal rules. Although that might seem like an...
