Editing Snort (software)

{{Short description|Open-source intrusion prevention system}}
{{Infobox software
| name                   = Snort
| logo                   = Image:Snort ids logo.png
| screenshot             = 
| caption                = 
| collapsible            = 
| developer              = [[Cisco Systems]]
| released               = 
| latest release version = {{multiple releases
  | branch1  = Snort 2.x (Legacy)
  | version1 = 2.9.19.0
  | date1    = {{start date and age|2021|12|06}}<ref>{{cite web
    | url         = https://blog.snort.org/search/label/snort
    | title       = Snort Blog: snort
    | website     = blog.snort.org
    | access-date = 2021-09-01
  }}</ref>

  | branch2  = Snort 3.x
  | version2 = 3.1.56.0
  | date2    = {{start date and age|2023|02|23}}<ref>{{cite web
    | url         = https://github.com/snort3/snort3/releases
    | title       = Releases · snort3/snort3
    | website     = github.com
    | access-date = 2023-02-23
  }}</ref>
}}
| latest release date    = 
| programming language   = [[C++ (programming language)|C++]] (since version 3.0)
| operating system       = [[Cross-platform]]<ref>{{cite web
  | url         = https://www.snort.org/#get-started
  | title       = Snort - Network Intrusion Detection & Prevention System
  | website     = snort.org
  | access-date = 2021-03-29
}}</ref>
| platform               = 
| size                   = 
| language               = 
| genre                  = {{ubl|[[Intrusion detection system]]|Intrusion prevention system}}
| license                = [[GNU General Public License#Version 2|GPLv2+]]
| website                = {{URL|https://www.snort.org}}
}}

'''Snort''' is a [[free software|free]] [[open source software|open source]] network intrusion detection system (IDS) and intrusion prevention system (IPS)<ref>{{cite web
 | url        = https://www.esecurityplanet.com/network-security/Snort-Open-Source-Network-Intrusion-Prevention-3681296.htm
 | title      = Snort: Open Source Network Intrusion Prevention
 | author     = Jeffrey Carr
 | date       = 2007-06-05
 | accessdate = 2010-06-23}}</ref> created in 1998 by [[Martin Roesch]], founder and former CTO of [[Sourcefire]].<ref>{{cite web|url=http://www.informationweek.com/news/showArticle.jhtml?articleID=186700788|title=Sourcefire Has Big Plans For Open-Source Snort|author=Larry Greenemeier|date=2006-04-25|accessdate=2010-06-23}}</ref><ref>{{cite web
 | url        = http://www.eweek.com/c/a/IT-Management/100-Most-Influential-People-in-IT/3/
 | title      = 100 Most Influential People in IT
 | author     = eWeek.com Staff
 | date       = 2008-04-04
 | accessdate = 2010-06-23}}</ref> Snort is now developed by [[Cisco]], which purchased Sourcefire in 2013.<ref>{{cite web|url=https://www.cisco.com/c/en/us/about/corporate-strategy-office/acquisitions/sourcefire.html|title=Cisco Completes Acquisition of Sourcefire|date=2013-10-07|publisher=[[Cisco Systems]]|accessdate=2020-04-13}}</ref><ref>{{cite news | url=https://dealbook.nytimes.com/2013/07/23/cisco-to-buy-sourcefire-a-cybersecurity-company-for-2-7-billion/ | title=Cisco to Buy Sourcefire, a Cybersecurity Company, for $2.7 Billion | work=The New York Times | date=23 July 2013 | accessdate=July 23, 2013}}</ref><ref>{{cite web|url=https://www.cisco.com/c/en/us/products/collateral/security/brief_c17-733286.html|title=Snort: The World's Most Widely Deployed IPS Technology|website=Cisco|language=en|access-date=2018-08-30}}</ref>

In 2009, Snort entered [[InfoWorld]]'s Open Source Hall of Fame as one of the "greatest [pieces of] open source software of all time".<ref>{{cite web
 | url        = https://www.infoworld.com/article/2631146/the-greatest-open-source-software-of-all-time.html
 | title      = The greatest open source software of all time
 | author     = Doug Dineley
 | author2    = High Mobley
 | date       = 2009-08-17
 | accessdate = 2020-04-13}}</ref>

==Uses==
Snort's open-source network-based [[Intrusion prevention system|intrusion detection/prevention system]] (IDS/IPS) has the ability to perform real-time traffic analysis and [[Packet analyzer|packet logging]] on [[Internet Protocol]] (IP) networks. Snort performs protocol analysis, content searching and matching.

The program can also be used to detect probes or [[Attack (computing)|attacks]], including, but not limited to, [[TCP/IP stack fingerprinting|operating system fingerprinting]] attempts, [[semantic URL attack]]s, [[buffer overflow]]s, [[server message block]] probes, and stealth [[Port scanner|port scans]].<ref>{{cite book|author=James Stanger|title=How to Cheat at Securing Linux|url=https://books.google.com/books?id=SdDB718VwZcC&pg=PA126|year=2011|publisher=Elsevier|location=Burlington, MA|isbn=978-0-08-055868-4|page=126}}</ref>

Snort can be configured in three main modes: 1. sniffer, 2. packet logger, and 3. network intrusion detection.<ref>{{cite web |url=http://manual.snort.org/node2.html |title=Snort Usage |author=Snort Team |date=2012-01-01}}</ref>

===Sniffer Mode===
The program will read network packets and display them on the console.

===Packet Logger Mode===
In packet logger mode, the program will log packets to the disk.

===Network Intrusion Detection System Mode===
In intrusion detection mode, the program will monitor network traffic and analyze it against a rule set defined by the user. The program will then perform a specific action based on what has been identified.<ref>{{cite web |url=http://manual.snort.org/node6.html |title=Snort Usage |author=Snort team |date=2013-04-05}}</ref>

==Third-party tools==
There are several third-party tools interfacing Snort for administration, reporting, performance and log analysis:
* Snorby – a [[GPLv3]]<ref>{{cite web |title= snorby / LICENSE  |url=https://github.com/Snorby/snorby/blob/master/LICENSE |work=[[GitHub]] |date=2013 |access-date=January 19, 2021}}</ref> [[Ruby on Rails]] application
* BASE
* [[Sguil]] (free)

==See also==
* [[List of free and open-source software packages]]
* [[Sigma (signature format)|Sigma]]
* [[Suricata (software)]]
* [[YARA]]
* [[Zeek]]

==References==
{{Reflist|30em}}

==External links==
* {{Official website|https://www.snort.org/}}


{{DEFAULTSORT:Snort (Software)}}
[[Category:Free security software]]
[[Category:Computer security software]]
[[Category:Linux security software]]
[[Category:Unix network-related software]]
[[Category:Lua (programming language)-scriptable software]]
[[Category:Intrusion detection systems]]