Introducing Snort 3.0

Over the past year our development team has led two lives. 

One life was spent maintaining the code base of Snort, which secures most of the Internet with well over 5 million downloads.  Snort has not only become the standard in intrusion detection, but the Snort rules language is used by network researchers to communicate with each other to detect bad traffic.  We’ve been releasing new features into the code base all along to push the envelope of detection farther and faster.

The other life initially emerged back in 2005 with the conceptual introduction of Snort 3.0. Marty Roesch, the original author of Snort and the founder of Sourcefire, started to rethink the concepts and architecture of Snort.  This resulted in a beta release of what we now call “SnortSP”, or the Snort Security Platform.  Some of the ideas in the original SnortSP project have made their way into the main code base of Snort over the past few releases.  Reloading without restarting, OpenAppId, gzip decompression, IP blacklisting, etc.    However, there were ideas that we’ve been playing with that we couldn’t fold into the current code base without a complete rewrite. 

So that’s what we’ve done.

We took Marty’s initial rethinking and expanded beyond that, testing different concepts of multithreading, detection, interaction, programmatic interfaces, etc. This all now culminates in the alpha release of project “Snort++”, which will become version Snort 3.0.

This Alpha release is for you to play with.  It’s for you to break, it’s for you to test and get back to us about.  We need you to break it; we want you to break it. This is not ready for production and should not be used for production, so that gives us the full freedom to work with our community to make Snort 3.0 as strong as possible.

Over the development of the project we’ll be rolling out new blog posts, white papers, webinars, documents with updates, and code all for you to test and use.  We plan on releasing often and early.  Some fantastic new features are in this new version of Snort.  I’ll list a few here, and we'll expand on all of these in the next few months.

• User-friendly design
• We wanted to make it as easy as possible for people to learn and run Snort – that means no more configuring memory, ports, arguments, etc. 
• Built-in Documentation
• Built-in configuration
• Error and Multi error support
• Verification of configuration on startup (no more having to run “-T” for test mode)
• Simpler rule language
• We’re making it simpler to write rules.
• Sticky buffers
• Custom http buffers
• Auto-Detection of all protocols
• Command Line Shell
• Secured to localhost
• Allows someone to reload a configuration
• Allows you to pause and resume detection
• Multithreaded and Multi-core
• All new design for multithreading, maintaining a single persistent configuration for many threads.

This is just a start, we have even more code and ideas we are going to build into this! We’ll be releasing consistently with new features and code over that same amount of time, and due to popular demand, our code will be public, hosted on Github. We’re excited to hear what you have to say about it and working with you as we move the ball forward.  Please stay tuned to the Snort Blog, Snort's Twitter account, and of course the Snort 3.0 webpage on Snort.org!

Please read on to Russ's Blog post about how to download it, set it up, and get the alpha working!