In layman language, Snort works on the basis of deep packet inspection for a pattern and once matched, extracts the captured string and triggers some actions defined by