Snort — the long-standing open-source network intrusion detection and prevention system (IDS/IPS) — inspects network traffic against a rule set that describes malicious and suspicious activity, alerts on the packets that match, and, deployed inline, drops them before they reach the target. It is developed and maintained by Cisco Talos, dates back to 1998, and remains one of the most widely deployed intrusion prevention systems in the world. Snort works in three distinct modes: as a packet sniffer comparable to tcpdump, as a packet logger for traffic debugging and forensics, and as a full intrusion prevention system on a network sensor. Snort 3 is the current generation — a substantial rewrite with a scriptable Lua-based configuration, a pluggable architecture and multi-threaded packet processing — while Snort 2.9 remains available as the legacy series for existing deployments.

Key Features

• Rule-driven detection — traffic is described in a readable rule language (header, options, content matches, PCRE, byte tests, flow and sticky buffers), so detections can be written, reviewed and version-controlled like code rather than hidden inside a black box.
• Community and Subscriber rulesets — the Community Ruleset is free, developed by the community and QA’d by Talos; the Subscriber Ruleset is produced, tested and approved by Talos and delivered to registered users and subscribers as it is released. The two rulesets carry different licences — see below.
• Inline prevention, not just alerting — run passively to detect and log, or inline (AF_PACKET, NFQUEUE) to drop matching traffic and reset sessions, so the same ruleset becomes an enforcement point.
• Multi-threaded packet processing — Snort 3 can run several packet-processing threads over a shared configuration and attribute table and a shared network map, scaling to multi-gigabit sensors where a single-threaded 2.x sensor could not.
• Scriptable configuration — the lengthy snort.conf of Snort 2.x is replaced by a structured, scriptable Lua configuration with autodetected services, which makes portless configurations and reusable policy fragments practical.
• Pluggable architecture — codecs, inspectors, loggers and other components are loadable plugins, with separate extras packages that demonstrate writing your own, so the sensor can be extended without patching the engine.
• Flexible output — console alerts, unified2 and pcap logging, and file/JSON-style logging that feeds SIEM stacks, dashboards and alert pipelines; rules reference CVE identifiers, so alerts line up with vulnerability management.
• Broad deployment — available from distribution repositories and firewall platforms such as pfSense and IPFire as well as from source, so Snort sensors fit both a home lab perimeter and a corporate DMZ.

Why Use Snort?

Snort is the reference implementation of the open-source network IDS/IPS idea, and that history is its main practical advantage: two decades of rules, integrations, documentation and hard-won operational knowledge exist around it. Detection is transparent — you can read the exact rule that fired, see which part of the packet matched, and tune it — rather than accepting an opaque verdict. Because the engine and the Community Ruleset are GPL-licensed and self-hosted, no traffic leaves your network to be analysed, which matters for regulated environments and for anyone unwilling to send packet metadata to a vendor cloud. Deployed inline, the same rules that generate an alert can drop the packet, and the three operating modes mean one tool covers sniffing, logging and prevention instead of three. The trade-off is that Snort is not a turnkey appliance: rules must be tuned to your network, and the Subscriber Ruleset — far more current than the community set for emerging threats — is licensed for non-commercial use.

Use Cases

• Run an inline IPS on the edge of a network to block exploit attempts and known-bad traffic.
• Deploy a passive IDS sensor on a mirrored port or span to alert without risking the traffic path.
• Capture and log packets for traffic debugging, incident triage and after-the-fact forensics.
• Feed alerts into a SIEM, dashboard or alerting pipeline as the network-detection layer of a monitoring stack.
• Add wire-level detection to a firewall platform: Snort is a package on pfSense and IPFire.
• Pair network detection with log and behaviour analysis — Snort sees the packets, CrowdSec watches the logs.

Similar

• Suricata — the other major open-source IDS/IPS, multi-threaded from the start and able to read Snort rules; the usual alternative when choosing a sensor engine.
• Zeek — network security monitoring that produces rich connection and protocol logs rather than signature alerts; complementary to Snort.
• CrowdSec — behaviour-based detection over logs and HTTP requests, with remediation components; works at a different layer to a packet IPS.

Platform

Linux · FreeBSD · macOS · Windows · built from source with cmake or installed from distribution and firewall-platform repositories · container-friendly for lab sensors

Licence

GPL-2.0 (Snort engine and the Community Ruleset). The Subscriber Ruleset is licensed separately under a non-commercial licence and requires registration or a subscription.

Website

snort.org · docs.snort.org · source on GitHub