Snort

Snort (maintained by Cisco Talos) is the world’s most widely deployed open-source network intrusion detection system (NIDS) and intrusion prevention system (NIPS), engineered to perform real-time packet analysis, protocol inspection, and malicious traffic blocking across enterprise networks. Operating by inspecting raw network packets as they traverse the network interface, Snort matches packet payloads and protocol behaviors against an extensive library of modular detection rules. Backed by the global threat intelligence of Cisco Talos, Snort detects a vast spectrum of cyber threats, including buffer overflows, stealth port scans, server-side exploit attempts, malware command-and-control beacons, and protocol fuzzing attacks. In passive detection mode, Snort functions as a high-fidelity sensor that logs suspicious network events and triggers alerts for security operations centers; in active inline prevention mode, Snort drops malicious packets directly on the wire before they can compromise target network assets. With the modern Snort 3 multi-threaded architecture, the engine delivers enhanced packet processing performance, multi-core CPU scaling, simplified rule syntax, and deep inspection of modern protocols such as HTTP/2 and TLS. Snort provides network defenders with an open, battle-tested network perimeter defense foundation.