I would like to understand if snort rules are applied for each packet in a flow between a source and destination separately? For instance, when packet 1 of the flow arrives at the IDS, all the rules in snort get evaluated, followed by packet 2 and so on? If this is not true, when do the rules actually get evaluated?
Stream. Here is a good document regarding how snort uses libpcap to apply heuristic and signature based anomoly detection to network traffic; http://www.pearsonhighered.com/samplechapter/157870281X.pdf and when in doubt consult the manual https://www.snort.org/faq/readme-stream5