WEBVTT

00:00:00.650 --> 00:00:04.160
[Autogenerated] getting the packets analyzed is tough to do unless

00:00:04.160 --> 00:00:07.400
we're able to decode and process the packets properly.

00:00:08.180 --> 00:00:11.320
The various protocols that we use in our networks behave in

00:00:11.320 --> 00:00:15.730
specific ways and understanding the ways they behave allows us

00:00:15.730 --> 00:00:17.800
to understand the activity better.

00:00:18.470 --> 00:00:24.230
So pre processes are what snort uses to accomplish this in sports operations.

00:00:24.450 --> 00:00:28.250
The rule engine is what matches the traffic to rules and allows you to

00:00:28.250 --> 00:00:32.189
create your own prior to getting to the rule engine though,

00:00:32.630 --> 00:00:35.330
Snorts pre processors handle the packets.

00:00:36.240 --> 00:00:40.140
Pre processors do many things for snort for example,

00:00:40.380 --> 00:00:43.680
the FTp telnet pre processor provides a stateful

00:00:43.680 --> 00:00:46.350
inspection capability for FTP and telnet.

00:00:47.500 --> 00:00:51.830
Using this pre processor you can identify both server and client

00:00:51.830 --> 00:00:55.600
commands and responses as well as the escape sequences.

00:00:56.250 --> 00:01:00.550
Other pre processors provide similar benefits for their protocols or purposes.

00:01:01.180 --> 00:01:07.440
The stream pre processor tracks both TCP and UdP sessions and reassembles them.

00:01:08.000 --> 00:01:11.600
One pre processor that's useful is the one that helps detect and

00:01:11.600 --> 00:01:15.250
filter P II or personally identifiable information.

00:01:16.470 --> 00:01:20.110
It's critical that organizations do not accidentally expose

00:01:20.110 --> 00:01:22.320
this information and the sensitive data.

00:01:22.320 --> 00:01:27.440
Pre processor is what's capable of helping us do so the ssl

00:01:27.440 --> 00:01:30.970
and TLS pre processor gives you the capability to decode and

00:01:30.970 --> 00:01:33.340
filter ssl and TLS traffic.

00:01:33.860 --> 00:01:36.500
We're going to cover three other Pre processors in

00:01:36.500 --> 00:01:38.410
more detail throughout this module.

00:01:39.040 --> 00:01:42.420
We'll start with the http inspect pre processor to

00:01:42.420 --> 00:01:45.270
assist with processing http traffic.

00:01:46.100 --> 00:01:47.880
Then we'll dive into the ports.

00:01:47.880 --> 00:01:51.650
Can Pre processor which helps to detect ports scans.

00:01:52.430 --> 00:01:54.900
Finally we're going to talk about the app I.

00:01:54.900 --> 00:01:55.150
D.

00:01:55.150 --> 00:01:58.530
Pre processor which is great at giving you application

00:01:58.530 --> 00:02:00.350
specific information from the stream.