Snort

Snort is a widely-deployed open-source intrusion prevention system (IPS) and intrusion detection system (IDS) capable of performing real-time traffic analysis and packet logging on IP networks. Originally created by Martin Roesch in 1998 and later acquired by Sourcefire (which was itself acquired by Cisco in 2013 for 2.7 billion dollars), Snort has been one of the most influential network security tools in history, with an estimated installation base of over 500,000 active deployments worldwide. Snort pioneered the concept of signature-based network intrusion detection, using a custom rule language to define patterns that match known attack signatures, malicious payloads, and policy violations in network traffic. Key capabilities include: packet sniffing (capturing network packets in promiscuous mode for analysis), packet logging (recording packets to disk in tcpdump or Snort native formats for later analysis), three operating modes: sniffer mode (displaying packets on console), packet logger mode (logging packets to disk), and NIDS mode (the full intrusion detection and prevention system), a powerful rule language supporting content matching (byte-level pattern matching), PCRE regular expressions, protocol anomaly detection, flow tracking (stateful connection tracking via the flow and flowbits keywords), HTTP URI and header normalization and inspection, and boolean logic for complex multi-condition rules, support for both IDS mode (passive detection and alerting) and inline IPS mode (active blocking via NFQ or DAQ), preprocessors for protocol normalization and decoding (HTTP, FTP, Telnet, DNS, SMTP, SSH, and SIP), and shared object rules (compiled rules in shared library format for performance and intellectual property protection). The Snort Community Ruleset provides over 30,000 rules.