Click here

Snort

Snort is an open source network intrusion prevention system (IPS) capable of performing real-time traffic analysis and packet-logging on IP networks. It can perform protocol analysis, content searching & matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts and more.

Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that uses a modular plug-in architecture. Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user-specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient. Snort has three primary uses. It can be used as a straight packet sniffer like tcpdump, a packet logger (useful for network traffic debugging and so), or as a full-blown network intrusion prevention system.  [Source: Snort Web site]



Top Terms

Connect with Webopedia

  • What is 250 GB Data Usage?

    What is 250 GB (250 gigabytes) and why is this phrase so popular? Webopedia explains what the phrase 250 GB means in reference to data storage...

    Read More »

Did You Know? Archive »

  • Quick Reference Archive »