The Story of Snort

The Story of Snort 58

Posted by CmdrTaco on Tuesday October 25, 2005 @10:07AM from the stuff-to-read dept.

gRitteR writes "HNS is running a story of Martin Roesch, the creator of Snort where he tells the entire story of Snort in his words. Roesch covers seven years of development that made this tool one of the most important security software titles ever developed. It's interesting to get all the details on how Snort was initially conceived as well as how it is expected to develop further now after Check Point acquired Sourcefire. There are many technical details and interesting tidbits not available before."

The Story of Snort

This discussion has been archived. No new comments can be posted.

Load All Comments

Search 58 Comments Log In/Create an Account

Comments Filter:

- - - cheap yoke, can't believe nobody else did it yet.. (Score:3, Funny)
      
      by Thud457 ( 234763 ) writes:
      
      Finally! I've been waiting fourty years for a sequel to "The Story About Ping"!!!!! [army.mil]
      - Re:cheap yoke, can't believe nobody else did it ye (Score:2, Insightful)
        
        by Thud457 ( 234763 ) writes:
        
        errr... an absolutely amazing quote in the link above : " If I'd known then that it would be my most famous accomplishment in life, I might have worked on it another day or two and added some more options."
      - Re:cheap yoke, can't believe nobody else did it ye (Score:1)
        
        by BushCheney08 ( 917605 ) writes:
        
        Hehehehe. I was just checking the thread to see if someone else was gonna mention it. If not, I was gonna say something about how nicely The Story of Snort would look next to The Story About Ping.
Flash audio? (Score:4, Interesting)

by stibles ( 708899 ) writes: on Tuesday October 25, 2005 @10:17AM (#13871489)

Anyone know if there's a transcript of this interview somewhere?

- Re:Flash audio? (Score:1)
  
  by Vreejack ( 68778 ) writes:
  
  "SERVER STATUS: We are currently being Slashdotted. Please check back soon. "
  This was at 11:24 EDT
- Re:Flash audio? (Score:2)
  
  by cmacb ( 547347 ) writes:
  
  Bad combo: Audio content with no transcript; flash presentation (sound only); streaming instead of downloadable; Slashdot.
  
  I wonder who comes up with this stuff. But I know that at least part of the answer is that it is people who should be doing something else (something not involving computers) for a living.
stuff-to-read dept? (Score:2, Funny)

by marcantonio ( 895721 ) writes:

I think someone didn't check this out before it was posted... By someone I mean TACO.
- Re:stuff-to-read dept? (Score:1)
  
  by KrisW ( 613034 ) writes:
  
  I think the link is correct, it seems to be the linked page that is acting screwy.
  - Re:stuff-to-read dept? (Score:3, Informative)
    
    by zootm ( 850416 ) writes:
    
    Judging by the title of your parent's post, I think he was more concerned that Taco's "department" was the "stuff-to-read" department, yet the main link is in fact an audio recording...
    - Re:stuff-to-read dept? (Score:1)
      
      by KrisW ( 613034 ) writes:
      
      Oops, my bad.
  - Re:stuff-to-read dept? (Score:1)
    
    by tomhudson ( 43916 ) writes:
    
    it seems to be the linked page that is acting screwy.
    
    Nah, it's your eyes - stop SNORTING THAT SHIT!!!
    That's what you get for Trick-or-treating in the Newark - those "pop rock candies" are crack rocks.
  - Re:stuff-to-read dept? (Score:2)
    
    by LurkerXXX ( 667952 ) writes:
    
    The link is just to a site that points to the interview. It's a flash/audio interview. Not sometehing-to-read unless you've got some sweet audio-to-text converter on your laptop that your browsing with. Last I checked most folks don't normally use Dragon-NaturallySpeeking to browse websites.
- Re:stuff-to-read dept? (Score:2, Funny)
  
  by tomhudson ( 43916 ) writes:
  
  I think someone didn't check this out before it was posted... By someone I mean TACO.
  
  Maybe the story inspired him to SNORT something ...
  Or it could just be that with Hallowe'en coming, slashdot trolls you. Since we're not giving them treats, they're giving us tricks.
- Re:Snort? (Score:4, Funny)
  
  by Anonymous Coward writes: on Tuesday October 25, 2005 @10:41AM (#13871710)
  
  Effective immediately, your geek license has been revoked.
  
Not really intended to be for international (Score:4, Informative)

by dzafez ( 897002 ) writes: on Tuesday October 25, 2005 @10:42AM (#13871726) Homepage

This seems to not be intended to be listened to by international Audience. He is talking quite fast and not too easy. a written form would be easier for people with other language backgrounds. I can live with it, as I'm used to the sound of american english, but a written form could help a lot.

- Re:Not really intended to be for international (Score:1, Funny)
  
  by kilauea ( 263775 ) writes:
  
  There is no such thing as American english!!!
  
  How I would love to see "the Queens English" on a software installer...
  
  Gaz
  - Re:Not really intended to be for international (Score:4, Funny)
    
    by Anonymous Coward writes: on Tuesday October 25, 2005 @11:43AM (#13872234)
    
    You have indicated that you wish to bin these dossiers. Shall we?
    
    [ Right Then ] [ Rubbish ]
    
    And in a cruel twist of fate, "Rubbish" would cancel the operation.
    
  - Re:Not really intended to be for international (Score:1)
    
    by RexxFiend ( 261662 ) writes:
    
    I thought she was german! [wikipedia.org]
Snort made easy... (Score:5, Informative)

by fak3r ( 917687 ) writes: on Tuesday October 25, 2005 @10:43AM (#13871727) Homepage

Let me be the first to recommend n00bs pick up Snort for Dummies [amazon.com], perhaps the best "for Dummies" book I've read; a perfect primer. "If you want to get your feet wet or you've been tasked with deploying a snort system, this is a good way to start. In the typical, humorous, "for dummies" style, this book walks you through getting, setting up and using Snort and the ACID console. The book also covers how to maintain and tweak the system, once it is up and running. A good effort by the authors." For work or for home, there's really no reason not to learn an enterprise level IDS.

- Re:Snort made easy... (Score:5, Informative)
  
  by martyroesch ( 589524 ) writes: on Tuesday October 25, 2005 @11:36AM (#13872154) Homepage
  
  Please, do NOT use ACID!
  
  ACID is no longer being actively maintained, if you want ACID's functionality you should go get BASE [sourceforge.net]! Better yet, go get SGUIL [sourceforge.net] and use Snort as part of a Network Security Monitoring [amazon.com], you'll be glad you did.
  
  - Re:Snort made easy... (Score:5, Funny)
    
    by diamondsw ( 685967 ) writes: on Tuesday October 25, 2005 @12:06PM (#13872424)
    
    Please, do NOT use ACID!
    
    Too late, dude. Whoa.
    
What it probably says... (Score:5, Informative)

by xxxJonBoyxxx ( 565205 ) writes: on Tuesday October 25, 2005 @10:48AM (#13871770)

I had the chance to chat with Marty in Baltimore in May 2001 and he basically said this about Snort:

1) I wrote it over a couple of weekends because I wasn't happy with TCPDump and the commercial tools at hand

2) Someday I hope to rewrite it

3) The extensible plug-in architecture saved my ass

4) I wish the commercial guys would quit ripping it off

However, it looks like an audio interview...don't have that kind of time anymore.

- - Re:What it probably says... (Score:2)
    
    by xxxJonBoyxxx ( 565205 ) writes:
    
    I tried this, involuntarily, during the last year I was earning my comp sci degree. I have two kids now, so I've learned to appreciate a good 8 (OK, 6) hours of sleep a night.
It begins like this... (Score:2, Funny)

by utexaspunk ( 527541 ) writes:

"So we had made this 'cocaine' stuff, and we had tried various methods of getting it into our bloodstream, but none of them seemed to be quick and easy. Then Martin gets this brilliant idea..."
- Re:It begins like this... (Score:1, Funny)
  
  by Anonymous Coward writes:
  
  "So we had made this 'cocaine' stuff, and we had tried various methods of getting it into our bloodstream, but none of them seemed to be quick and easy. Then Martin gets this brilliant idea..."
  
  You do what Stevie Nicks allegedly did, and have it blown up your ass?
Snort Exploit! (Score:2, Informative)

by Anonymous Coward writes:

Links to information:
First report: http://isc.sans.org/diary.php?storyid=770 [sans.org]
Infocon Yellow: http://isc.sans.org/diary.php?storyid=772 [sans.org]
Intrusion Detection: http://isc.sans.org/diary.php?storyid=782 [sans.org]
Tool: http://isc.sans.org/diary.php?storyid=791 [sans.org]

Hope everyone is safe..
- Re:Snort Exploit! (Score:1)
  
  by Slashcrap ( 869349 ) writes:
  
  Hope everyone is safe..
  
  This happens all the time. Which is why anyone with half a brain sets up their Snort box with a "one way" Ethernet cable - inbound traffic only, no ability for the Snort box to talk to anything else if compromised.
  
  Of course, there are a lot of people running Snort on their home DSL line because watching the huge list of attacks bouncing off their firewall gives them a woody. They're probably screwed, but at least it will be educational for them.
Snort is... (Score:2, Funny)

by Viree ( 214760 ) writes:

probably one of the best tools ever developed for open-source / security community. I've got a bad feeling from this whole Check Point acquisition, especially with the major revamp in http://snort.org/ [snort.org]. Thankfully there's still http://nessus.org/ [nessus.org]....wait. Fuck!
non flash (Score:1)

by furrywithwings ( 851094 ) writes:

Is there a working transcript or a non-flash link? I'm not installing the key to pretty BLINKING annoyances just to read something interesting.
Snort stories (Score:2)

by SeaFox ( 739806 ) writes:

I get the feeling one of the main draws to posting stories about Snort isn't so much the software but so they can make joke headlines and comments about narcotics.

Checkpoint Aquires Snort [slashdot.org] - Oct. 6, 2005

Snort up For Revamp, says Creator [slashdot.org] - May 24, 2004

Using Snort Stealthily [slashdot.org] - Sept. 13, 2002

Snort Creator Makes Good [slashdot.org] - July 1, 2002

Guardent To Sell Snort And Nessus [slashdot.org] - Dec. 14, 2001
Snot? (Score:1)

by bettlebrox ( 264668 ) writes:

For a minute there I thought the title of the story was:

The History of Snot

For just a second I was envisoning: Slashdot, news for nerds, boogers shat matters ...
Picture with Martin (Score:1)

by uan ( 882245 ) writes:

I got to meet Martin Roesch a month ago and got some pictures of us shaking hands to take home!
Using BASE to analyze Snort data (Score:1)

by vaiism ( 773625 ) writes:

BigAdmin has an article that describes storing Snort alert output in a MySQL database and using the web front end BASE to analyze the data. Sounded pretty interesting... http://www.sun.com/bigadmin/features/articles/snor t_base.html [sun.com]

There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.

The Story of Snort 58

The Story of Snort More Login

The Story of Snort

cheap yoke, can't believe nobody else did it yet.. (Score:3, Funny)

Re:cheap yoke, can't believe nobody else did it ye (Score:2, Insightful)

Re:cheap yoke, can't believe nobody else did it ye (Score:1)

Flash audio? (Score:4, Interesting)

Re:Flash audio? (Score:1)

Re:Flash audio? (Score:2)

stuff-to-read dept? (Score:2, Funny)

Re:stuff-to-read dept? (Score:1)

Re:stuff-to-read dept? (Score:3, Informative)

Re:stuff-to-read dept? (Score:1)

Re:stuff-to-read dept? (Score:1)

Re:stuff-to-read dept? (Score:2)

Re:stuff-to-read dept? (Score:2, Funny)

Re:Snort? (Score:4, Funny)

Not really intended to be for international (Score:4, Informative)

Re:Not really intended to be for international (Score:1, Funny)

Re:Not really intended to be for international (Score:4, Funny)

Re:Not really intended to be for international (Score:1)

Snort made easy... (Score:5, Informative)

Re:Snort made easy... (Score:5, Informative)

Re:Snort made easy... (Score:5, Funny)

What it probably says... (Score:5, Informative)

Re:What it probably says... (Score:2)

It begins like this... (Score:2, Funny)

Re:It begins like this... (Score:1, Funny)

Snort Exploit! (Score:2, Informative)

Re:Snort Exploit! (Score:1)

Snort is... (Score:2, Funny)

non flash (Score:1)

Snort stories (Score:2)

Snot? (Score:1)

Picture with Martin (Score:1)

Using BASE to analyze Snort data (Score:1)

Related Links Top of the: day, week, month.

Slashdot Top Deals

Slashdot