1

When I visited the the Snort's website to download the source code for compilation, I found there were 2 downloads available.

One was titled Snort and another was titled Snort 3.0

Has the development of Snort stopped and they've shifted to Snort 3.0 or is Snort 3.0 still in alpha phase and we should be be careful using the new version ?

What are the major differences between old Snort and Snort 3.0 ?

  • 1
    "Snort 3.0" is actually "snort-3.0.0-a4-228" which I read as Snort version 3.0.0 alpha 4 build 228. – WhiteWinterWolf Jul 27 '17 at 15:33
2

From the https://www.snort.org/snort3 web page linked to from the page you linked, they list the following:

  • Support multiple packet processing threads
  • Shared configuration and attribute table
  • Use a simple, scriptable configuration
  • Make key components pluggable
  • Autodetect services for portless configuration
  • Support sticky buffers in rules
  • Autogenerate reference documentation
  • Provide better cross platform support

Were you looking for more than this?

  • I wanted to inquire if it is safe to use the latest version because it is alpha version. Shall I resort to older version or new version ? Is new version more stable than older version ? – GypsyCosmonaut Jul 27 '17 at 16:58
  • 1
    The nice thing about Snort is that it's not in the critical path. It's sniffing, but not routing. So if it breaks, you only suffer a momentary lapse of coverage, not a system outage. For me, I'd go bleeding edge with a low-risk setup like that; but that's just me. – John Deters Jul 27 '17 at 17:06
  • Alpha versions are an experimental stage. Don't expect full functionality there. – Overmind Oct 26 '17 at 5:06
0

For more comparison Snort 3.0 alpha was introduced a while back in 2014. So the base of changes comparing 2.x to 3.x can also be found here in the VRT blog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.