When I visited the the Snort's website to download the source code for compilation, I found there were 2 downloads available.

One was titled Snort and another was titled Snort 3.0

Has the development of Snort stopped and they've shifted to Snort 3.0 or is Snort 3.0 still in alpha phase and we should be be careful using the new version ?

What are the major differences between old Snort and Snort 3.0 ?

  • 1
    "Snort 3.0" is actually "snort-3.0.0-a4-228" which I read as Snort version 3.0.0 alpha 4 build 228. Commented Jul 27, 2017 at 15:33

2 Answers 2


From the https://www.snort.org/snort3 web page linked to from the page you linked, they list the following:

  • Support multiple packet processing threads
  • Shared configuration and attribute table
  • Use a simple, scriptable configuration
  • Make key components pluggable
  • Autodetect services for portless configuration
  • Support sticky buffers in rules
  • Autogenerate reference documentation
  • Provide better cross platform support

Were you looking for more than this?

  • I wanted to inquire if it is safe to use the latest version because it is alpha version. Shall I resort to older version or new version ? Is new version more stable than older version ? Commented Jul 27, 2017 at 16:58
  • 1
    The nice thing about Snort is that it's not in the critical path. It's sniffing, but not routing. So if it breaks, you only suffer a momentary lapse of coverage, not a system outage. For me, I'd go bleeding edge with a low-risk setup like that; but that's just me. Commented Jul 27, 2017 at 17:06
  • Alpha versions are an experimental stage. Don't expect full functionality there.
    – Overmind
    Commented Oct 26, 2017 at 5:06

For more comparison Snort 3.0 alpha was introduced a while back in 2014. So the base of changes comparing 2.x to 3.x can also be found here in the VRT blog.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .