0

How safe is 'fwsnort' compared to a real Snort / Suricata instance?

  • What's the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is that realistic, today?

  • Is it really just the rules or does Snort / Suricata provide an extra security margin, which is significant?

I'm considering using fwsnort, instead of a Suricata instance, mainly because of the very easy setup. I'm no security expert, that's why I am asking here - am I bad off with only using fwsnort?

Improve this question

1 Answer 1

Reset to default
1

Based on the description of fwsnort it is a packet level IDS using the iptables string matching feature. This means that it can not apply any rules which span multiple packets. This includes any serious application level analysis like looking into SMTP (mail) and HTTP (web) traffic.

Thus if you care mostly about attacks at the lower layers it might be enough, but it will not be able to detect attacks at the application layer except the most trivial.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .