"What capabilities does Snort have that might surprise
or be underused by IT managers?
"Angela Orebaugh: Snort has some powerful
functionality built into the pre-processors. These include the
ability to maintain state, fragmented packet reassembly, stream
reassembly, HTTP normalization, application decoders, portscan
detectors and performance monitoring..."