Snort (software)
From Wikipedia, the free encyclopedia
 |
This article is written like a personal reflection or essay and may require cleanup. Please help improve it by rewriting it in an encyclopedic style. (September 2009) |
Snort is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) capable of performing packet logging and real-time traffic analysis on IP networks. Snort was written by Martin Roesch and is now developed by Sourcefire, of which Roesch is the founder and CTO. Integrated enterprise versions with purpose built hardware and commercial support services are sold by Sourcefire.
Combining the benefits of signature, protocol and anomaly based inspection Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and over 225,000 registered users Snort has become the de facto standard for IPS.
Snort performs protocol analysis, content searching/matching, and is commonly used to actively block or passively detect a variety of attacks and probes, such as buffer overflows, stealth port scans, web application attacks, SMB probes, and OS fingerprinting attempts, amongst other features. The software is mostly used for intrusion prevention purposes, by dropping attacks as they are taking place. Snort can be combined with other free software such as sguil, OSSIM, and the Basic Analysis and Security Engine (BASE) to provide a visual representation of intrusion data.
[edit] External links
- Official website
- Sourcefire - The company that owns and maintains Snort.
- Emerging Threats - Community maintained Snort rule sets.
- Snort Inline, a modified version of Snort that will act as an Intrusion Prevention System (IPS).
Free user interfaces:
- Sguil - An open source Tcl/Tk interface for network security monitoring
- Basic Analysis and Security Engine - An open source based Snort DB web analysis tool, replaces ACID.
- Snorby - A new, open source front-end for Snort.
Commercial user interfaces:
- Sourcefire Intrusion Prevention System - Enterprise intrusion prevention at speeds of up to 10Gigabit from the makers of Snort
- CounterSnipe Network Knowledge based IPS - Enhanced snort based IPS by active profiling of networked hosts, applications and vulnerabilities.
- IDS Policy Manager - Snort Rules Management
- Aanval - Snort and Syslog analysis software (free version available)
Tools for use with Snort
- SnortUnified perl modules - Tools for easily processing Snort unified and unified2 log files
- EasyIDS - Free customized CentOS install cd containing Snort, Barnyard, BASE, ntop, and more.
|
|||||||||||||||||||||||
