USA 2001

### Overview At Black Hat Briefings 2001 in Las Vegas, the creator of Snort details the history, architecture, and current capabilities of the Snort 1.x series, followed by a roadmap for Snort 2.0. Originally conceived as a lightweight sniffer to debug a government Honeypot system, Snort evolved into an open-source, multi-mode packet analysis and network intrusion detection system (NIDS). With the recent release of Snort 1.8, the project introduced stateful inspection to its TCP stream reassembler, capable of tracking up to 64,000 concurrent sessions, while retaining broad portability across approximately 25 operating systems via libpcap.

### Key Topics - **Operational Modes and Rules Engine:** Snort functions as a packet sniffer, packet logger, forensic analysis tool, and signature-based NIDS. Its rule language separates rule headers (actions, protocols, IPs, ports) from rule options (payload inspection, flags). Snort optimizes rules internally into rule nodes and option chains. - **Pre-processors and Plugins:** The architecture relies on pre-processors (handling stream reassembly, IP defragmentation, and traffic normalization), detection plugins (checking specific packet attributes), and output plugins (supporting logging formats such as MySQL, PostgreSQL, Oracle, XML, and unified binary spools). - **Performance Realities:** While the decoder and detection engine can evaluate up to 48,000 packets per second on saturated 100 Mbps links, logging to databases or heavy output formats drops throughput to around 8,000 packets per second due to I/O bottlenecks. - **Snort 2.0 Vision:** Plans for the next major release center on decoupling output via an external spool processor called Barnyard, optimizing pattern matching, modularizing protocol decoders and acquisition interfaces, and supporting alternative intrusion detection models.

### Technical Details - **Pattern Matching Algorithms:** The 1.x series uses the Boyer-Moore algorithm, but repeated content evaluations per packet create substantial overhead. Snort 2.0 incorporates research from Silicon Defense (Aho-Corasick tree/trie matching) and Los Alamos National Laboratory (setwise Boyer-Moore-Horspool). Los Alamos demonstrated a 500% pattern matching performance boost by selecting Boyer-Moore for 3 or fewer checks, Aho-Corasick for up to 100 checks, and Boyer-Moore-Horspool for over 100 checks. - **Data Structures and Optimization:** Snort 1.x uses a three-dimensionally linked list evaluated with a "first exit" strategy. Snort 2.0 plans deeper rule tree funnels so tests like TCP flag checks are not repeated across rules, enabling a "last exit" option where all matches are alerted. - **Spooling with Barnyard:** To prevent database inserts from eating CPU, Snort 1.8/2.0 writes directly to pure binary unified alert and log spools (over 10,000 events/sec), leaving post-processing and external formatting to Barnyard in a separate process. - **Gateway and Target-Based IDS:** Moving beyond passive sniffing, Gateway IDS integrates with packet filters (such as Linux netfilter or BSD divert sockets) to scrub malformed fragments or streams and eliminate evasion. Target-based IDS integrates host scan data (e.g., from Nmap or Nessus) to suppress irrelevant rules and tailor TCP/IP reassembly specifically to target operating systems.

### Takeaways Snort's evolution addresses high-speed network demands and evasion techniques through architectural modularity. By offloading output processing to Barnyard and implementing advanced multi-pattern search algorithms, Snort aims to break past libpcap bottlenecks, handle gigabit speeds, and expand from passive network detection into host-based and inline gateway filtering.