These weaknesses apply to Snort and all other signature based intrusion detection engines. Snort is singled out in this paper because of its popularity and its familiarity amongst the SANS community. Snort Snort is an intrusion detection system written by Martin Roesch. Snort is was written as an open source project and is available for free under the GNU public license. The software is based upon a signature comparison engine optimized for speed.
Snort offers many features that make it an ideal choice in the battle against Internet intruders.
Snort uses a flexible rules language to describe traffic that it should collect o r pass, as well as a detection engine that utilizes a modular plugin architecture. The power of Snort Snort was written to take advantage of a highly modularized design. The application can take advantage of several different pre-processors to normalize, filter, and categorize data. Because Snort is an open source project and that it has many users its signature database is updated often and are simple to update. When Snort is given an incoming packet from the packet capture driver it compares that packet to its database of known signatures.