132

Chapter 4     Plugins, Preprocessors and Output Modules

Figure 4 1 Simplified block diagram for Snort.

4.1 Preprocessors

When a packet is received by Snort, it may not be ready for processing by the main

Snort detection engine and application of Snort rules. For example, a packet may be

fragmented. Before you can search a string within the packet or determine its exact size,

you need to defragment it by assembling all fragments of the data packet. The job of a

preprocessor is to make a packet suitable for the detection engine to apply different

rules to it. In addition, some preprocessors are used for other tasks such as detection of