Snort: Network Intrusion Detection (NIDS)

Why use Snort?

• Signature-based detection: Very effective at detecting known threats thanks to vast rule sets (official, community, or paid).
• Three operating modes: It can act as a simple packet "sniffer", a packet logger, or a full intrusion detection system.
• Mature and stable: It has decades of development and production use behind it.
• Integration: It can be integrated with other tools (firewalls, SIEM) for automated response.

Prerequisites

• A Linux server (Ubuntu/Debian) with at least two network interfaces: one for management and one for listening (monitoring).
• Root access or sudo privileges.