Preprocessors add significant power to Snort. Snort's existing preprocessors give it the capability to reassemble packets, do protocol-specific decoding and normalization, do significant protocol anomaly detection, and add functionality outside of rule-checking and anomaly detection.

The stream4 and frag2 preprocessors enhance Snort's original rule-based pattern-matching model by allowing it to match patterns across several packets with TCP stream reassembly, TCP state-keeping, and IP defragmentation. Data carried by TCP is generally contained in several packets stream reassembly can build a single packet out of an entire stream so that data broken across several packets can still match attack rules. As packets are carried across networks, they often must be broken into fragments. frag2 rebuilds these fragments into packets that can then be run through Snort's detection engine.

The telnet_negotiation, http_decode, and rpc_decode preprocessors all serve the primary purpose of data normalization. The Telnet negotiation preprocessor removes Telnet's inline feature-negotiation codes from the protocol, allowing more deterministic content matching. It accomplishes this while still leaving the original data intact, so that rules with the rawbytes keyword can access the original application data for unhindered pattern matching. The http_decode preprocessor deals with the problem created by Web servers that accept many forms of the same URL by creating a "canonical" form of the URL to which rule-maintainers can write their URLs. This preprocessor does not do data replacement either the canonicalization can be accessed by using the uricontent keyword in a HTTP rule. RPC, when carried over TCP, must still be separated...