Classic/network-based IPS solutions – Snort and Suricata

As we discussed previously, the traditional IPS story started in the 1990s when Martin Roesch wrote Snort. Snort turned into a commercial offering when Sourcefire was created, but even today, after Cisco acquired Sourcefire, Snort still has an open source version that can be installed on any Linux platform.

Because Snort was so prevalent, it was widely used both directly, within Sourcefire products, as well as being licensed in many (many) next-generation firewall (NGFW) products. This last situation changed after the Cisco acquisition; no commercial firewall wanted to have an IPS from a competing company on their platform.

Marketing aside, the "traditional" version of Snort (2.x) had several shortfalls:

• It was completely text-based, there was no GUI. However, there are several web frontend projects available for Snort.
• The messages were often cryptic – often, you'd need to be a...