I would like to understand if snort rules are applied for each packet in a flow between a source and destination separately? For instance, when packet 1 of the flow arrives at the IDS, all the rules in snort get evaluated, followed by packet 2 and so on? If this is not true, when do the rules actually get evaluated?


Stream. Here is a good document regarding how snort uses libpcap to apply heuristic and signature based anomoly detection to network traffic; http://www.pearsonhighered.com/samplechapter/157870281X.pdf and when in doubt consult the manual https://www.snort.org/faq/readme-stream5

  • 2
    To casual viewers who may not understand what you mean. What is the difference, if any, between packet, flow, and steam? Feb 2 '16 at 3:25
  • TCP, BGP, UDP, etc all generally include multiple data grams and to effectively determine if a payload includes a threat libpcap, (the packet creation and disassembly library under the hood of snort & surricata) it must utilize stream based analysis techniques. However I am not certain that all detection techniques use just a stream
    – jas-
    Feb 2 '16 at 12:04
  • Well here is the official documentation regarding the streams processing and configurable parameters snort.org/faq/readme-stream5
    – jas-
    Feb 2 '16 at 13:16
  • It may help to update your answer to reflect the requested information in my comment. :] Feb 2 '16 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.