[Autogenerated] getting the packets analyzed is tough to do unless
we're able to decode and process the packets properly.
The various protocols that we use in our networks behave in
specific ways and understanding the ways they behave allows us
to understand the activity better.
So pre processes are what snort uses to accomplish this in sports operations.
The rule engine is what matches the traffic to rules and allows you to
create your own prior to getting to the rule engine though,
Snorts pre processors handle the packets.
Pre processors do many things for snort for example,
the FTp telnet pre processor provides a stateful
inspection capability for FTP and telnet.
Using this pre processor you can identify both server and client
commands and responses as well as the escape sequences.
Other pre processors provide similar benefits for their protocols or purposes.
The stream pre processor tracks both TCP and UdP sessions and reassembles them.
One pre processor that's useful is the one that helps detect and
filter P II or personally identifiable information.
It's critical that organizations do not accidentally expose
this information and the sensitive data.
Pre processor is what's capable of helping us do so the ssl
and TLS pre processor gives you the capability to decode and
filter ssl and TLS traffic.
We're going to cover three other Pre processors in
more detail throughout this module.
We'll start with the http inspect pre processor to
assist with processing http traffic.
Then we'll dive into the ports.
Can Pre processor which helps to detect ports scans.
Finally we're going to talk about the app I.
D.
Pre processor which is great at giving you application
specific information from the stream.