Normalization IP normalization (scrubbing) removes interpretation ambiguities, like overlapping fragments (confusing IDSs) reassembly (caching) of fragments before filtering, only complete packets are filtered sequence number modulation randomize values that should be random for hosts that have weak generators replace constants to defeat fingerprinting or uptime detection (like netcraft)