Snort is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) . Snort having the ability to perform real-time traffic analysis and packet logging on Internet Protocol (IP) networks. Snort performs protocol analysis, content searching, and content matching.
The program can also be used to detect probes or attacks, including, but not limited to, operating system fingerprinting attempts, common gateway interface, buffer overflows, server message block probes, and stealth port scans. Snort can be configured in three main modes: sniffer, packet logger, and network intrusion detection.
Improvements in Snort 2.9.4.1
- Updated File processing for partial HTTP content and MIME attachments.
- Addition of new config option max_attribute_services_per_host and improve memory usage within attribute table.
- Handle excessive overlaps in frag3.
- Stream API updates to return session key for a session.
- Reduce false positives for TCP window slam events.
- Updates to provide better encoding for TCP packets generated for respond and react.
- Disable non-Ethernet decoders by default for performance reasons. If needed, use --enable-non-ether-decoders with configure.
