TABLE OF CONTENTS Preprocessors are written as "plug-ins" to allow them to give Snort flexible extensibility, configurable on a host-by-host basis.
Preprocessors give Snort the ability to handle data stretched over multiple packets.
Snort uses preprocessors to canonicalize data in protocols where data can be represented in multiple ways.
Snort uses preprocessors to do detection that doesn't fit its model of flexible pattern matching.
Preprocessors provide Snort with much of its anomaly detection capabilities, which can detect some attacks that might not yet have rules.
stream4 adds statefulness to Snort, so that it can ignore packets that will be ignored by the target host.
stream4 adds stream reassembly to Snort, so that it can detect attacks broken across several packets in a TCP stream.
frag2 reassembles packets from their associated fragments, allowing it to detect attacks broken across multiple fragments.
telnet_negotiation normalizes Telnet traffic, removing the inline feature-negotiation codes that are part of the Telnet protocol.
http_decode normalizes URLs in HTTP requests, making pattern-matching possible even when attacks obfuscate URLs with Web server-specific alternative encodings.
rpc_decode normalizes RPC traffic, forcing all RPC messages into single-fragment messages.
Preprocessors can also allow you to add nearly any detection model to Snort.
portscan detects portscan attacks by watching for the number of incoming packets from each source to exceed a packet-per-time-period threshold. It also watches for NMAP "stealth" packets.
The...
