Snort

Snort 3 is an open-source network intrusion detection and prevention system that inspects network traffic using rule-based signatures and protocol analysis. It can operate in passive IDS mode or inline IPS mode. Snort is developed by Cisco, and Cisco Talos tests the community rule set and publishes the paid Subscriber Rule Set.

Monitoring network traffic and blocking known attack patterns on enterprise or perimeter networks.

• +Rule-based detection with a freely available community ruleset QA'd by Cisco Talos.
• +Operates as both IDS and inline IPS.
• +Pluggable component architecture with Lua-based configuration and multiple packet processing threads.

• +Rule maintenance and tuning require ongoing analyst effort.
• +Performance and memory use depend on the enabled rule set and the selected pattern search method.

Detecting and blocking malicious network traffic, malware command-and-control, and reconnaissance attempts.