Categories
SNORT
Snort is a network intrusion detection system that performs real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and more.
Snort has three primary uses: as a straight packet sniffer like tcpdump(1), as a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion detection system. Snort logs packets in either tcpdump(1) binary format or in Snort's decoded ASCII format to logging directories that are named based on the IP address of the "foreign" host. It should work any place libpcap does.
Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture. It also has real-time alerting capabilities.
Last updated 19 Jul, 2005
About
Leadership
- Martin Roesch - Maintainer
Requirements
- libpcap (Use Requirement)
- libpcap (Build Prerequisite)
Related Projects
RazorBack, Snort-rep, libpcap, mod_security, scanlogd, tcpdump
Subprograms
See, /contrib/README, file, in, the, distribution, for, complete, list
Versions
2.3.3
2.3.3 stable released 2005-04-22
- Released: 22 Apr, 2005
- Code Maturity: Stable
- Source Archive: http://www.snort.org/dl/current/snort-2.3.3.tar.gz
- Licenses: GPLv2
- Interfaces: Command Line
User Community and Support
User FAQ available from http://www.snort.org/; see same URL for complete list of documentation; user manpage included in the distribution
General Resources
Announcement Resources
Support Resources
Development
Developer Resources
- VCS Checkout Command:
:pserver:anonymous@cvs.sourceforge.net:/cvsroot/snort - Mailing List Info/Archive
- VCS Repository Webview
- irc://irc.linux.com/#snort




