I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, scalability etc.

  • Hi....are you happy with my answer below? If so, can you accept it? I've answered a bunch of your questions recently and you don't seem to accept or upvote, how come? Jun 11, 2012 at 9:37
  • @MarkHillick I did accept, didn't I? Like here- security.stackexchange.com/a/15122/9778. I was just waiting for some answers with better links...But yes your answer was helpful.
    – pnp
    Jun 12, 2012 at 3:05

1 Answer 1


That's a very general question.

Your concern should not just in relation to Snort, it all depends on the platform that you install it on (o/s - yes it does run on Windows, CPU, memory etc) and what elements (pre-processors for fragmentation or stream reassembly) of Snort that you enable (look in the configuration file, typically /etc/snort.conf, for more information) and what rules you enable or add.

If you want to test it, I'd suggest downloading Security Onion (http://securityonion.blogspot.com), a Xubuntu-based Network Security Monitoring distro, as it comes with both Snort and Suricata. It is a fantastic project and so easy to learn with as everything is essentially pre-configured. (Disclaimer: I try to help out with the Security Onion project).

Snort is very scalable and I know is actively used in networks with over 20gb/s but remember the platform aspect above.

Additionally, both Snort and Suricata have active mailing lists for their users where such performance issues are actively discussed.

I'm sure vendors like Tipping Point, Sourcefire (commercial aspect of Snort), Enterasys (if they're still around), Cisco etc have comparison whitepapers on their sites but beware their bias.

Regarding the 'rule size' and 'accuracy' aspects, these are becoming like the AV industry a little now with the "I'm bigger than you argument".

Here's some links for you -



and an old one


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .