Snort IDS

snort -c snort.conf -i <if>

Run Snort as an IDS with its configuration and rules, detecting attacks on the interface traffic with the community signatures.

Run it when you want network detection with the classic IDS: Snort applies the rules (Community Rules, Talos with subscription, or your own) to traffic and generates alerts with the signature, source, and destination. It's the veteran of open source IDS, the reference standard from which many others derive (Suricata is the modern successor with better performance). In established environments with historical Snort configurations, it remains the choice; and for learning network detection, Snort rules are the format the whole ecosystem understands. Alert output is configured in snort.conf (syslog, unified2, or barnyard2 for the SIEM).

Don't choose it for high volumes: Snort is single-threaded in rule processing and on busy interfaces it falls behind — for modern performance, Suricata is the option. The free community rules cover the basics: for full coverage of current exploits and C2 you need Talos rules (subscription) or an updated ruleset. And watch out for noise: without tuning, generic rules constantly fire on legitimate traffic — threshold configuration and IP suppression are part of the deployment, not an extra. Snort configuration (snort.conf) is delicate: poorly defined network variables silently break rules.