Editing Snort (software) (section)

==Uses==
Snort's open-source network-based [[Intrusion prevention system|intrusion detection/prevention system]] (IDS/IPS) has the ability to perform real-time traffic analysis and [[Packet analyzer|packet logging]] on [[Internet Protocol]] (IP) networks. Snort performs protocol analysis, content searching and matching.

The program can also be used to detect probes or [[Attack (computing)|attacks]], including, but not limited to, [[TCP/IP stack fingerprinting|operating system fingerprinting]] attempts, [[semantic URL attack]]s, [[buffer overflow]]s, [[server message block]] probes, and stealth [[Port scanner|port scans]].<ref>{{cite book|author=James Stanger|title=How to Cheat at Securing Linux|url=https://books.google.com/books?id=SdDB718VwZcC&pg=PA126|year=2011|publisher=Elsevier|location=Burlington, MA|isbn=978-0-08-055868-4|page=126}}</ref>

Snort can be configured in three main modes: 1. sniffer, 2. packet logger, and 3. network intrusion detection.<ref>{{cite web |url=http://manual.snort.org/node2.html |title=Snort Usage |author=Snort Team |date=2012-01-01}}</ref>

===Sniffer Mode===
The program will read network packets and display them on the console.

===Packet Logger Mode===
In packet logger mode, the program will log packets to the disk.

===Network Intrusion Detection System Mode===
In intrusion detection mode, the program will monitor network traffic and analyze it against a rule set defined by the user. The program will then perform a specific action based on what has been identified.<ref>{{cite web |url=http://manual.snort.org/node6.html |title=Snort Usage |author=Snort team |date=2013-04-05}}</ref>