Snort is an
open source network intrusion prevention system
(
IPS) capable of
performing
real-time traffic analysis and packet-logging on
IP networks. It can
perform protocol analysis, content searching & matching and can be used to detect
a variety of attacks and probes, such as
buffer overflows, stealth port scans,
CGI attacks, SMB probes, OS fingerprinting attempts and more.
Snort uses a flexible rules language to describe traffic that it should
collect or pass, as well as a detection engine that uses a modular plug-in
architecture. Snort has a real-time alerting capability as well, incorporating
alerting mechanisms for syslog, a user-specified file, a UNIX socket, or WinPopup messages to
Windows clients using Samba's smbclient. Snort has three primary uses. It can be used as a straight packet
sniffer
like tcpdump, a packet logger (useful for network traffic debugging and so), or as
a full-blown network intrusion prevention system. [Source:
Snort Web site]
