3 ms·
Snort is more like a packet-filtering firewall, Bro is more like a protocol-lawyer firewall. That's a general description and misses a lot of details.
by danielweber 12y ago
Snort is more like a packet-filtering firewall, Bro is more like a protocol-lawyer firewall.
That's a general description and misses a lot of details.
- tptacek 12y agoNo offense, but it's also extremely inaccurate; that is not a good dividing line to draw between the two projects. The previous Bro thread had a decent comparison between the two projects. If I was going to deploy a network IDS/IPS somewhere (spoiler: I wouldn't), it'd be Snort. If I was going to monitor a network in general, or do network monitoring research, I'd use Bro.
- anonymousDan 12y agoWhy wouldn't you deploy a network IDS/IPS out of interest? What problems do they have and what would you advise instead?
- tptacek 12y agoSometime when we're in an unburied thread and I'm not prepping to travel out of the country the next day, I'll be happy to write a couple thousand words on this. But fair warning, I probably won't say anything you wouldn't expect me to say after reading what I wrote about it back in '98 (Google [insertion evasion]).