Normalization IP normalization (scrubbing) removes interpretation ambiguities, like overlapping fragments (confusing IDSs) reassembly (caching) of fragments before filtering, only complete packets are filtered sequence number modulation