Snort is a open-source network intrusion detection/prevention system (NIDS/NIPS).
Snort is a open source network intrusion detection/prevention system (NIDS/NIPS) that combines the benefits of signature, protocol, and anomaly-based inspection. Since it has been widely deployed, it has become the de facto standard for IPS.
Snort was created by Marty Roesch in 1998, and it is now developed by Sourcefire with Roesch now CTO. Sourcefire offers a commercial version of Snort but fully supports and embraces the open-source model.
Snort is typically installed on Linux though it's also possible to run it on OS X, Windows and many other operating systems. It can be downloaded in source format or as pre-packaged binaries, as well as being available through most package managers such as Brew, Apt etc
Most folk use a third-party tool such as Snorby, Squert, Base, Sguil (to name but a few) to analyse their Snort logs and alerts. There's a Linux distro, Security Onion, which comes with all these tools installed and so it's an excellent resource for learning about Snort and Network Security Monitoring in general (i.e. making use of Snort).
