3 ms·

The first major piece of software I ever wrote and pushed to production was a rules manager/updated for Suricata (essentially open source Snort). As someone who

The first major piece of software I ever wrote and pushed to production was a rules manager/updated for Suricata (essentially open source Snort). As someone who didn’t have a CS background and was self taught, it felt momentous. I have since left that position so I can’t see the code, but I am sure it was appalling. Even with that, I will also have a warm and fuzzy spot for Snort/Suricata.

tssva 4y ago
I don't know that I would describe Suricata as "essentially open source Snort" since Snort itself is licensed under the GPLv2.
- 6502nerdface 4y ago
  GP was probably referring to the closed rulesets: https://www.snort.org/products https://www.snort.org/products
- kyrra 4y ago
  (Former sourcefire / snort employee here) Both Suricata and Snort are GPLv2 (my personal speculation) Suricata was funded by DHS because Snort was used heavily within the US government and I think they were worried about having such a central tool being owned by a corporation . There were also some issues with how Snort did scaling to multiple CPUs (Snort 2 was single CPU bound, so to run on multiple CPUs, you'd have to start up an instance of snort per CPU). Snort 3 finally is out years later and has fixed this problem. I'm also guessing that it partially was started when Sourcefire was about to be bought by Checkpoint systems back in 2006 (https://www.washingtonpost.com/archive/politics/2006/03/24/purchase-by-israeli-firm-called-off/f5d28c5a-f214-4762-a38e-87e67900a200/ https://www.washingtonpost.com/archive/politics/2006/03/24/p...), which was SUPER close to happening but got killed for "reasons". To peer comment: note that many personal installs of Suricata out there still use the VRT rule sets released by the Snort/Cisco teams. Rule sets are where Sorucefire made some of its money (though most was the hardware boxes they sell to corporations). Suricata never got in the business of publishing rulesets as far as I understand.

tssva 4y ago

I don't know that I would describe Suricata as "essentially open source Snort" since Snort itself is licensed under the GPLv2.

6502nerdface 4y ago
GP was probably referring to the closed rulesets: https://www.snort.org/products https://www.snort.org/products
kyrra 4y ago
(Former sourcefire / snort employee here) Both Suricata and Snort are GPLv2 (my personal speculation) Suricata was funded by DHS because Snort was used heavily within the US government and I think they were worried about having such a central tool being owned by a corporation . There were also some issues with how Snort did scaling to multiple CPUs (Snort 2 was single CPU bound, so to run on multiple CPUs, you'd have to start up an instance of snort per CPU). Snort 3 finally is out years later and has fixed this problem. I'm also guessing that it partially was started when Sourcefire was about to be bought by Checkpoint systems back in 2006 (https://www.washingtonpost.com/archive/politics/2006/03/24/purchase-by-israeli-firm-called-off/f5d28c5a-f214-4762-a38e-87e67900a200/ https://www.washingtonpost.com/archive/politics/2006/03/24/p...), which was SUPER close to happening but got killed for "reasons". To peer comment: note that many personal installs of Suricata out there still use the VRT rule sets released by the Snort/Cisco teams. Rule sets are where Sorucefire made some of its money (though most was the hardware boxes they sell to corporations). Suricata never got in the business of publishing rulesets as far as I understand.