A brief study and comparison of Snort and Bro Open Source Network Intrusion Detection Systems

Abstract: Security administration plays a vital role in network management tasks. The intrusion detection systems are primarily designed to protect the availability, confidentiality and integrity of critical network information systems. There are plenty of IDSes to choose from, both commercial and open source. Since most of the commercial intrusion detection systems are at typically thousands of dollars and they tend to represent a significant resource requirement in themselves, for small networks, use of such IDS is not feasible. Therefore mostly open source IDS are being used. This paper provides a general working behaviour, features and comparison of two most popular open source network IDS - SNORT & BRO.

Keywords: alerts, intrusion, logging, network traffic, open source, packets