Skip to main content
TrustRadius
Snort

Snort

Overview

What is Snort?

Sourcefire developed Snort, an open source intrusion prevention system capable of real-time traffic analysis and packet logging. Snort was acquired (and is now supported) by Cisco in 2013.

Read more
Recent Reviews
Read all reviews

Awards

Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Return to navigation

Product Demos

SNORT Log Analysis for Computer Forensics

YouTube

Demo IDS/Snort (2.9.8.0) On Windows server 2012

YouTube

Demo IDS With Snort-Barnyard2-Pulledpork-CentOS 7

YouTube

Snort on Windows 7 Live Demo

YouTube

Snort Demo Part 1: Free Short Course - Network Security Administrator (ENSA)

YouTube

SolarWinds breach: Insights from the trenches | Live incident response demo | Cyber Work Podcast

YouTube
Return to navigation

Product Details

What is Snort?

Snort Video

Snort 101

Snort Technical Details

Operating SystemsUnspecified
Mobile ApplicationNo
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(27)

Reviews

(1-5 of 5)
Companies can't remove reviews or game the system. Here's why
Score 8 out of 10
Vetted Review
Verified User
Incentivized
Currently Snort's main use is IPS (Intrusion Detection System) which gives us the ability to give the company real-time traffic analysis along with data packet logging. This is mainly used in the main corporate environment to analysis traffic for any potential malicious activity.
  • IPS detection.
  • DoS detection.
  • Packet logging.
  • Configuration in Linux.
We have used it for packet sniffing and debugging the traffic. Most valuable situation is when we have corporate issues when traffic isn't routing properly. It gives us the ability to determine how and where traffic is routing and determine if it's going the proper way.
  • Packet sniffing.
  • Real-time traffic monitor.
  • Slow down in SQL transactions.
  • Improper routing.
Snort was chosen mainly for the ease and cost. With Snort we was able to set up in a matter of minutes without any professional services needed. If you are used to packet tracing the old fashion way, this is the product for you.
ExtraHop Performance Platform, Wireshark, Cisco Secure IPS (NGIPS)
Score 9 out of 10
Vetted Review
Verified User
Incentivized
Currently we are using Snort in the IT department as another layer of security and protection against intrusions and cyber attacks. Many companies as of late are getting hit by hackers and ransomware. Snort solves many security problems with its open source security system that can scan lots of traffic flowing through the network.
  • Catches things Admins may miss with regular network scanning
  • Keeps your network visibility high
  • Is open source so code can be reviewed easily
  • Due to its open source nature, it can be behind in updates
  • It does have quite the complex setup process and configuration
  • You don't get a whole lot of backend support included
If a colleague was looking to tighten down their network I can easily recommend Snort to them. It gives you some more peace of mind knowing that its always scanning traffic for malicious looking code. Even things your major firewalls and security hardware might miss, Snort has picked up. Its an easy recommendation for me.
  • Caught some security issues we would not have known about
  • Saved time having to configure firewalls to do its same job
  • Takes some processing time off your firewall to do the job of scanning traffic
Cisco Wireless LAN Controllers, Cisco SD-WAN, SolarWinds IP Address Manager (IPAM)
Alan Matson, CCNA:S, MCP | TrustRadius Reviewer
Score 7 out of 10
Vetted Review
Verified User
Incentivized
At my current position, we have Sourcefire deployed inline in a "layer 2" fashion to allow not only for constant threat monitoring but to also actively block threats and attacks as they occur. We utilize Sourcefire in "Stacks" allowing us to have full redundancy and Five9's up-time and protection. Prior to Sourcefire, we used TippingPoint however, their 10Gbp performance was not as efficient as Sourcefire modules allowing true 10Gbps network performance and scanning.
  • Real Time updates for security signatures via Talos
  • Great signature blocking
  • Excellent reporting via syslog to our Security Analytics collectors.
  • At times can be unstable with Cisco bugs, require frequent upgrading.
  • FTD images that are being pushed for ASAs are less efficient from an administration standpoint, no CLI.
It is well suited for a high energy environment with a lot of traffic, from an administration standpoint it can take a full time person to manage and maintain the devices.
  • The Sourcefire deployment has been very good at actively blocking threats that would have potentially caused loss or compromise.
  • It has given us great visibility to our network.
Sourcefire vs. TippingPoint was a no-brainer for us at the time of deployment. Sourcefire has a more well-defined API using REST that can be leveraged for automating tasks. TippingPoint was just releasing an API that was limited. Also at the time, TippingPoint could not meet our 10Gbps network requirements as Sourcefire could with their 8350 appliances.
Score 10 out of 10
Vetted Review
Verified User
I added SNORT and the guardian IPS to my firewall to help meet pci dss compliance. The setup was easy on my firewall - Ipfire - and I have had no problems related to its use. Before my cc terminal was changed, I had to disable guardian as it wouldn't let the old cc terminal through - I believe it was an SSL related issue. My old credit card processing company didn't seem interested in updating my terminal in a timely fashion. With the new cc terminal, I have had no issues. I sometimes leave my win xp virtual machine connected to the internet and have not seen any evidence of an intrusion. I know there are some false positives with the ruleset I use -emerging threats, but it has not blocked any traffic that has impaired any function on my network.
  • I am no IS expert, but I feel SNORT and guardian really helps keep my network safe.
  • So far it has been easy to administer.
  • SNORT and guardian are easy to install add-ons for my firewall.
  • There are plenty of false positives in the logs, but no problems noticed related to them.
It sure seems to work well in a small business network, I don't know how well it would work in a larger network.
  • Being open source, ROI on free is hard to beat for something that works.
  • I believe it greatly enhances the security of my network.
Score 10 out of 10
Vetted Review
Verified User
Incentivized
We use Sourcefire as an intrusion detection/prevention platform, but also as a form of a web filter, blocking certain types of sites. Its use is centered only in IT, as there's no need for any other part of the organization to use it. The goal of having it is to address the concern of watching web traffic and having a mechanism to aggressively block known bad sites, attacks, requests, etc.
  • The threat intelligence from Cisco TALOS is unparalleled. This is grafted into the Sourcefire application which greatly improves security visibility. With this there are a lot of groups that you can use for white listing or blacklisting, knowing its being updated in the background without additional work from you.
  • Flexible. Instead of putting a traditional firewall inline you can put a source fire appliance (or firewall with sourcefire on-board) to not only block/allow traffic, but if you insights into it, and do some forms of threat scoring.
  • In depth information. Sometimes a bit overwhelming, but you are able to do more than just see alerts, you can view the full information and packets that lead to the conclusion, though the conclusion is prepared in advance for you.
  • Due to the extensive interface, it can be quite overwhelming to try and manage the product. There are many different places to go to set up individual items. It would be nice to simplify the interface down a bit
  • Upgrades can be somewhat hazardous. I think they are working to get the upgrade process streamlined, but currently moving major version (5.x to 6.x) there was a lot of additional work outside of the UI that if not done correctly can tank the system, requiring a fresh load or restore from backup
I think in any situation where you have the IT staff to be able to manage it, Sourcefire SNORT is a good fit. Perhaps if you have a very large budget, and could get something like Palo Alto there might be a different fit, but Sourcefire works very well in our market (SMB) but would scale nicely in a larger organization, as you can use the interface to manage multiple devices. For smaller customers with less dedicated IT teams or none, Cisco Meraki offers the same level of protection with less work via the MX model of firewalls.
  • Sourcefire has given us a positive ROI. We don't really have the metrics to show this, but the cost for having it, vs the savings between blocking bad sites and the manpower to respond to malware infestations are worth it. It's hard to measure what you don't get.
For our organization, the Cisco defense in depth concept works the best. While Cisco can be made to work with other vendors, we have found the best in depth protection by integrating Cisco products for maximum visibility. We had a Barracuda Web Filter, but it was difficult to maintain when you had limited scope on what you could block, so we created a whitelist only setup which required a lot of additional manpower. This wouldn't have covered new threats with DNS spoofing and the like.

Sourcefire also integrated with our anti-malware platform (Cisco AMP) for even better visibility on what may be happening on the end users workstation. We are planning on adding in Cisco ISE to complete the approach and possibly stealthwatch to cover our bases in the future. The Palo Alto gear was interesting, but it was priced far out of our range.
Return to navigation