Question

3. Describe what a pre-processor does in a network-based IDS tool such as Snort. Demonstrate your understanding of this functionality by citing two examples of pre-processors and explaining what they contribute to the process of network traffic analysis and intrusion detection.

Answer 1

Answer:

Pre-processors look at organize traffic and screens parcel transmissions by examining andreassembling divided data.Frag2:preprocessor that battles against IP fracture attacks.Attackers sends a fragmentedTCP bundle with header data that gets entrance through a firewall.At the equivalent time,other parcels with vindictive information "slip" by the firewall undetected because of the fragmentationbeing so little by overwriting the header information.The frag2 pre-processor is specificallydesigned to break down bundle discontinuity to search out noxious information in the sections, which iswhy this pre-processor ought to never be turned off.Stream4:preprocessor Snort uses to coordinate assault marks over numerous packets.Anattacker endeavors to send different parcels into the system conveying parts of the attackpayload which are required to be reassembled by the host so as to start an attack.Stream4 stores the bits of the mark until all bundles are transmitted.Once they are alltransmitted, Stream4 finishes the signature and an alarm is created.

Explanation: