Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

Who have used both? Which do you recommend?

has suricata a web interface?

Thanks

share|improve this question
For starters, suricata is still in beta. Snort has been mature/stable for years. – gravyface Feb 25 '11 at 22:07
have you tried suricata? – Andre Feb 25 '11 at 22:10
2  
@gravyface Suricata 1.1 is in beta; 1.0X is stable (though you are correct in pointing out that Snort is a much more mature product) – Cocowalla Mar 29 '11 at 6:55

2 Answers

up vote 0 down vote

Depends on what your priorities are. Suricata has some features like File Extraction that from what last seen are yet to be implemented by Snort.

I would say that although Snort continues to be a more mature product and with a larger userbase both are ready for production. To make your choice easier, groups like EmergingThreats continue to support both IDSs.

Suricata also can be managed with OinkMaster and also integrated into web based log analysis like Snorby or Sguil (limited functionality).

share|improve this answer
up vote 0 down vote

Snort is multi-threaded so if you are going to be processing a lot of traffic, this may be your bigger selling point.

However, if you are new to this, consider starting with SNORT as it is older and more documented.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.