Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, scalability etc.

share|improve this question
    
Hi....are you happy with my answer below? If so, can you accept it? I've answered a bunch of your questions recently and you don't seem to accept or upvote, how come? –  Mark Hillick Jun 11 '12 at 9:37
    
@MarkHillick I did accept, didn't I? Like here- security.stackexchange.com/a/15122/9778. I was just waiting for some answers with better links...But yes your answer was helpful. –  pnp Jun 12 '12 at 3:05
    
thanks for that :) –  Mark Hillick Jun 12 '12 at 7:53

1 Answer 1

up vote 7 down vote accepted

That's a very general question.

Your concern should not just in relation to Snort, it all depends on the platform that you install it on (o/s - yes it does run on Windows, CPU, memory etc) and what elements (pre-processors for fragmentation or stream reassembly) of Snort that you enable (look in the configuration file, typically /etc/snort.conf, for more information) and what rules you enable or add.

If you want to test it, I'd suggest downloading Security Onion (http://securityonion.blogspot.com), a Xubuntu-based Network Security Monitoring distro, as it comes with both Snort and Suricata. It is a fantastic project and so easy to learn with as everything is essentially pre-configured. (Disclaimer: I try to help out with the Security Onion project).

Snort is very scalable and I know is actively used in networks with over 20gb/s but remember the platform aspect above.

Additionally, both Snort and Suricata have active mailing lists for their users where such performance issues are actively discussed.

I'm sure vendors like Tipping Point, Sourcefire (commercial aspect of Snort), Enterasys (if they're still around), Cisco etc have comparison whitepapers on their sites but beware their bias.

Regarding the 'rule size' and 'accuracy' aspects, these are becoming like the AV industry a little now with the "I'm bigger than you argument".

Here's some links for you -

http://www.aldeid.com/wiki/Suricata-vs-snort

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,7913.msg42307/topicseen,1/

and an old one

http://www.infosyssec.com/forum/viewtopic.php?t=14

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.