diff --git a/doc/sphinx/normalized-buffers.rst b/doc/sphinx/normalized-buffers.rst
new file mode 100644
index 0000000000..111bb97163
--- /dev/null
+++ b/doc/sphinx/normalized-buffers.rst
@@ -0,0 +1,15 @@
+Normalized Buffers
+==================
+
+
+A packet consists of raw data. HTTP and reassembly make a copy of
+those kinds of packets data. They erase anomalous content, combine
+packets etcetera. What remains is a called the 'normalized buffer'.
+
+Example:
+
+.. image:: normalized-buffers/normalization1.png
+
+Because the data is being normalized, it is not what it used to be; it
+is an interpretation.  Normalized buffers are: all HTTP-keywords,
+reassembled streams, TLS-, SSL-, SSH-, FTP- and dcerpc-buffers.
diff --git a/doc/sphinx/normalized-buffers/normalization1.png b/doc/sphinx/normalized-buffers/normalization1.png
new file mode 100644
index 0000000000..a99820cc14
Binary files /dev/null and b/doc/sphinx/normalized-buffers/normalization1.png differ
diff --git a/doc/sphinx/rules.rst b/doc/sphinx/rules.rst
index 88c3773741..5a8ec3036c 100644
--- a/doc/sphinx/rules.rst
+++ b/doc/sphinx/rules.rst
@@ -17,3 +17,4 @@ Rules
    adding-your-own-rules
    live-rule-swap
    tls-keywords
+   normalized-buffers