Snort is a versatile, lightweight and very useful intrusion detection system.
In this article we will look at Snort as a backup Intrusion Detection System for your enterprise network and see whether it can really scale up to the requirements of your enterprise networks. Snort is distributed under the GNU GPL license by the author Martin Roesch . Snort is a lightweight network IDS, capable of performing real-time traffic analysis and packet logging on IP networks. It can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and more. Snort uses a flexible rules language to describe traffic that it should collect or pass, and includes a detection engine utilizing a modular plug-in architecture.