Functionality of the IP reputation inspector
The IP reputation module is implemented as an inspector module in Snort 3. Specifically, it is implemented as a network inspector. The functionality of this inspector is straightforward; we will discuss it in this section. Snort parses all the information and stores it in its memory using some efficient data structures (this is the IP reputation data). When the traffic is inspected, the inspector matches the source and destination IP addresses of the packet against the IP reputation data (that is, the blocklists and allowlists), and if there is a match, the corresponding decision is enforced (that is, the packet is dropped, allowed, or monitored).
Let’s look at these processing stages in a bit more detail.
Data structure for storing IP reputation scores
The IP reputation module needs to store the IP addresses provided as blocklists and allowlists (for interfaces) in the memory, so that every analyzed packet can be compared...
