Summary

This chapter discussed inspectors, a crucial component of Snort 3. The inspector modules perform in-depth analyses of various network protocols and enable extensive rule-matching processes.

We discussed the role of inspectors and looked at the types of inspectors, and the various inspectors that fall under each type. We also covered two special inspectors – Binder and Wizard – and discussed their functionalities.

In the next chapter, we will examine stream inspectors in detail.