SnortIntrusion Detection and Prevention System: watching every packet, so you don't have to.
Snort is an open-source intrusion detection and prevention system (IDPS) created by Martin Roesch in 1998. It is designed to detect and prevent network attacks by analyzing network traffic in real-time.
Snort uses signature-based detection methods to identify known threats, anomalies, and suspicious activities. Each packet is decoded, normalised and compared against a library of rules, and anything that matches raises an alert or, in inline mode, is dropped before it reaches its target.
Reads packets off the wire and prints them to the screen, like a lightweight tcpdump.
snort -v -i eth0
Records traffic to disk in pcap format for later forensic analysis.
snort -l /var/log/snort -i eth0
Matches traffic against rules and alerts, or inline in IPS mode, drops malicious packets.
snort -c snort.conf -i eth0 -A console
Every rule has a header (who and where) and options (what to look for). This one flags SSH brute-force attempts.
Packets are read from the interface by the DAQ layer.
Ethernet, IP and TCP/UDP headers are parsed.
Streams reassembled, fragments rebuilt, HTTP normalised. Snort 3 calls these "inspectors".
The detection engine matches against thousands of rules.
Alerts are logged or sent to a SIEM, and inline mode drops the packet.
Real-time monitoring and alert visualization.
View and manage intrusion alerts.
Configure and customize detection rules.
Real-time traffic analysis and threat detection.
Proactive blocking of malicious network activity.
Comprehensive visibility into network traffic.
Snort is a trademark of Cisco. This website is an independent educational resource and is not affiliated with, sponsored by, or endorsed by Cisco. Any Snort trademarks, logos, and screenshots are used solely for identification and educational purposes.
Official Website: www.snort.org