snort

Snort is an open-source network intrusion detection system (NIDS) and intrusion prevention system (IPS). It was created by Martin Roesch and released in 1998, with development later carried out by Sourcefire and subsequently Cisco after its 2013 acquisition. It is available under an open-source license and is widely deployed on Unix-like systems and Windows. Snort can function as a network security monitor in multiple modes: a sniffer that prints packets, a packet logger that records traffic, or an IDS/IPS that analyzes traffic for suspicious activity and can operate inline to block traffic.

Detection in Snort relies on a rule-based engine that compares network traffic against a library of rules describing malicious patterns, protocol anomalies, and known exploits. Rules specify actions such as alert, log, pass, or drop; protocols; source and destination addresses and ports; and optional content matching and flow-control options. To improve detection accuracy, Snort uses preprocessors (for example, http_inspect, stream5, and frag3) to normalize traffic, reassemble streams, and handle protocol peculiarities before rule evaluation.

Snort draws on a range of rule sources, including community-maintained rule sets and commercially supported subscriptions. The open-source core is complemented by management tools for rule updates, configuration, and alert management, and it integrates with SIEMs and incident response workflows. Snort 3, a major rewrite of the engine, emphasizes modularity, scalability, and easier extension. Cisco continues to support Snort as a foundation for its security portfolio, including commercial rule feeds and related products.