Suricata vs. Snort: Similarities and Differences

Snort and Suricata are two of the most popular intrusion detection and prevention systems (IDS/IPS) in the world. Both systems use signatures, rules, and protocol analysis to detect malicious traffic on networks. This blog post will talk about the similarities and differences of Snort and Suricata software.

The History of Snort and Suricata

Snort was released in 1998. It is a mature and established solution with over 600,000 reported users. For years, engineers defaulted to Snort as a real-time monitoring solution because of its vast ruleset, high accuracy, and flourishing community support. Then, in 2010, the Open Information Security Foundation (OISF) began building Suricata. Suricata is similar in many ways and can use almost all of the same rules available in Snort. 

OISF started building Suricata with the goal of addressing the capacity limitations faced by intrusion detection and prevention systems. When the hardware of an IDS/IPS is overused, the system begins dropping packets. This opens the door to malicious traffic entering the network completely undetected. Attackers can take advantage of this limitation by intentionally overloading the system. Suricata is built to improve processing capability and protect against these types of attacks. 

Similarities between Snort and Suricata 

Multithreading

Multithreading allows the software to be broken into multiple threads and executed on different CPU cores in parallel. Multiple threads decrease the rate at which additional rules slow down processing time. This is not only valuable for protecting against overload attacks, but also offers additional general protection as processing demands on intrusion detection systems have grown alongside network traffic in recent years.

In addition to new plugins, rewritten TCP handling, and other features, Snort introduced multithreading capabilities in the Snort 3.0 release. As of Snort 3.0, both Snort and Suricata offer multithreading capabilities.

*please note that the Snort binary on pfSense is 2.9.20 at the time of this writing.

Network-Based Intrusion Detection

Both systems are network-based intrusion detection systems (NIDS). NIDS detect malicious traffic across an entire network, allowing organizations to monitor their cloud, virtual, and local network environments for suspicious events. 

Signature and Anomaly-based Intrusion Detection

Snort and Suricata both implement signature-based and anomaly-based detection. Signature-based detection measures packets against a pre-defined ruleset, allowing organizations to identify threats with great accuracy. Anomaly-based detection, on the other hand, uses machine learning to model baseline traffic patterns, and then alerts organizations of outlier traffic. This allows administrators to have visibility into unusual behavior patterns they may not have created rulesets for. Combining the two detection techniques, enables clear and comprehensive monitoring— making both Snort and Suricata very powerful solutions. 

Intrusion Prevention

For organizations looking to move beyond detection, both Snort and Suricata are equipped with intrusion prevention systems. Intrusion prevention systems take action to stop potential threats detected by intrusion detection systems. 

Differences between Snort and Suricata

At present, there are no significant differences between the two technologies. There are small differences pertaining to rulesets, new releases, etc., but again, they are minor.

For example, Snort rule sets are separated into a community ruleset and a subscriber rule set, whereas Suricata has an ETOpen ruleset and an ETPro ruleset.

Snort’s community rule set and Suricata’s ETOpen rule set are both driven forward by community contributions. Snort’s community rule set has approximately 4,000 rules and ETOpen has over 40,000. ETOpen also receives updates from an internal team, while Snort’s community rule set is exclusively updated by the community.

The subscriber rule set and ETPro on the other hand, are not open source and are developed by internal teams. Despite the difference in names, both packages separate their rule sets in the same way. The paid rule sets are designed more intentionally and cohesively than the community rule sets; they are built to strategically defend against modern malware, and do not rely solely on crowdsourced efforts. Functionally, both paid rule sets are nearly equivalent. The only difference is, depending on your use case (home or business), one option may have a lower subscription cost than the other.

Snort and Suricata in pfSense Software

Based on pfSense documentation, here are the key differences between these packages:

Rule Sets

• Snort: Split into community ruleset (~4,000 rules) and subscriber ruleset
• Suricata: Uses ETOpen ruleset (40,000+ rules) and ETPro ruleset
• ETOpen receives both community and internal team updates
• Both paid rulesets (subscriber and ETPro) offer comparable protection

Performance Considerations

• Snort binary on pfSense is version 2.9.20
• Multi-threading available in Snort 3.0 but not in current pfSense package
• Suricata offers native multi-threading support
• Both systems compatible with pfSense Plus software

Deployment Options

• Both support network-based intrusion detection
• Both offer signature and anomaly-based detection capabilities
• Both include intrusion prevention functionality
• Configuration documentation available through pfSense for both packages

The choice between Snort and Suricata on pfSense software often comes down to testing both packages in your specific environment to evaluate:

• False positive rates in your network
• Processing speed differences
• Rule compatibility requirements
• Resource usage on your hardware

Conclusion

Overall, the two packages share many more similarities than differences. There’s no definitive answer on which package your team should use. If you find yourself at a crossroads, you can always test both packages for your specific case and evaluate performance. You’ll be able to tell if one package is flagging more false positives in your network than the other, or if there’s a notable difference in speed. 

The good news is that regardless of which solution you choose, it will be compatible with pfSense Plus software. For help with the configuration process, see our documentation.

Frequently Asked Questions About Snort and Suricata IDS/IPS

What are the main differences between Suricata and Snort?

The main differences between Suricata and Snort are their processing capabilities and rulesets. Suricata offers native multi-threading and 40,000+ rules with regular updates, while Snort 2.9.20 on pfSense runs single-threaded with about 4,000 community rules.

How does Suricata's performance compare to Snort?

Suricata generally performs better in high-traffic environments due to its multi-threading capability, which distributes processing across multiple CPU cores. However, it requires more system resources than Snort's single-threaded operation on pfSense.

Is Suricata better than Snort?

Neither is definitively better. Suricata offers better performance through multi-threading and a larger ruleset, while Snort provides a more established ecosystem with extensive community support. Choose based on your specific network security needs and hardware capabilities.

What are the disadvantages of Suricata?

Suricata's main disadvantages include higher system resource requirements, more complex configuration, and a smaller community compared to Snort. It demands more CPU power and memory due to its multi-threading capabilities and advanced features.

Is Suricata an IPS or IDS?

Suricata functions as both an IPS and IDS. It can monitor network traffic and provide alerts (IDS mode) or actively block suspicious packets (IPS mode), offering both signature-based and anomaly-based threat detection.

How do you configure Snort to differentiate between incoming and outgoing traffic?

Configure Snort using the "flow" keyword in rules and define HOME_NET and EXTERNAL_NET variables. Create separate rule files for incoming and outgoing traffic, then include them in snort.conf for direction-specific monitoring.

What interface should you use to manage events with open-source implementations?

Popular open-source interfaces for managing Snort or Suricata events include Snorby (Ruby on Rails), Sguil (GUI suite), BASE (PHP-based), and Squert (real-time monitoring). Each offers different features for security monitoring.

Should I disable hardware checksum offload in pfSense?

Yes, disable hardware checksum offload when running IDS/IPS on pfSense. This ensures proper packet inspection by preventing NIC hardware from handling checksum calculations, though it may slightly increase CPU usage.

Can Suricata replace Snort?

Yes, Suricata can replace Snort in most deployments. It maintains compatibility with Snort rules while adding multi-threading and advanced protocol analysis. Consider your hardware resources and throughput requirements when making the switch.