I am very confused about exactly what http_uri does. Can someone explain this to me w.r.t NORMALIZED and UNNORMALIZED uri fields?
The normalized and non-normalized uri keywords works differently in snort. Normalization means parsing of the http_uri and then store into the buffer for matching. However in non-normalized uri will directly saved into the buffer without parsing. For example, suppose the http request came like,
Then for normalized uri every hex characters will represented in their corresponding ASCII value, so after normalization the request will look like
then this string will get stored in the buffer for further matching. In case of non-normalized uri the request will stored in the buffer as it is for further matching.