Snort

Snort is based on libpcap (for library packet capture), a tool that is widely used in TCP/IP traffic sniffers and analyzers. Through protocol analysis and content searching and matching, Snort detects attack methods, including denial of service, buffer overflow, CGI attacks, stealth port scans, and SMB probes. When suspicious behavior is detected, Snort sends a real-time alert to syslog, a separate 'alerts' file, or to a pop-up window.

NSS Group, a European network security testing organization, tested Snort along with intrusion detection system (IDS) products from 15 major vendors including Cisco, Computer Associates, and Symantec. According to NSS, Snort, which was the sole open source freeware product tested, clearly out-performed the proprietary products.

Learn more about Detecting and preventing network intrusions

Do you have something to add to this definition? Let us know. Send your comments to techterms@whatis.com

More resources from around the web: - Snort.org provides more information and downloads. - SearchSecurity.com features a Snort Technical Guide with answers to FAQs. - Mike Chapple explains the 'top-down' IPS sensor search. - Mike Rothman explains 'Best practices for purchasing a network intrusion device.' - David Jacobs discusses intrusion prevention management packages.

FILE EXTENSION AND FILE FORMAT LIST File Extension and File Format List: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z #

RELATED CONTENT The keys to locking down Windows Vista User Account Control Windows Vista's User Account Control feature can effectively lock down users' desktops. However, it's not exactly the perfect defense strategy. How to create a bit-image copy of a live server Part of your incident response plan should include the creation of a bit image copy of a live server. Free and open source tools are available to... Network-based integrity monitoring keeps website hacks in check Network integrity monitoring software brings the concept of file-based integrity monitoring, required by regulations such as PCI-DSS, to a company's...

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary intrusion detection  (SearchMidmarketSecurity.com) Intrusion detection (ID) is a type of security management system for computers and networks. An ID system gathers and analyzes information from...