Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Years back we set up an IDS solution by placing a tap in front of our exterior firewall, piping all the traffic on our DS1 through an IDS box and then sending the results off to a logging server running ACiD. This was around 2005-ish. I've been asked to revamp the solution and expand on it and looking around, I see that the last release of ACiD was from 2003 and I can't seem to find anything else that seems even remotely up-to-date. While these things may be feature complete, I worry about library conflicts, etc. Can anyone give me suggestions for a Linux/OpenBSD based solution using somewhat modern tools?

Just to be clear, I know that Snort is still actively developed. I guess I'm more in the market for a modern open-source web console to consolidate the data. Of course if people have great experiences with IDS' other than Snort I'm happy to hear about it.

share|improve this question

closed as off-topic by Michael Hampton Oct 1 '15 at 2:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 5 down vote accepted

I think the best open source combinations are:

For NIDS: Snort with BASE for the web ui


I also use OSSEC to consolidade the NIDS data into a single place (like a SIEM OSSEC does log analysis, file integrity checking and rootkit detection).


share|improve this answer
Exactly what I was looking for. Thank you! – MattC Oct 28 '09 at 16:58


OSSIM consolidates all that kind of stuff. OSSEC, Snort, etc.

Open source & Free.

OSSIM has the following software components:

Arpwatch – used for MAC anomaly detection.
P0f – used for passive OS detection and OS change analysis.
Pads – used for service anomaly detection.
Nessus – used for vulnerability assessment and for cross correlation (IDS vs Security Scanner).
Snort – the IDS, also used for cross correlation with nessus.
Spade – the statistical packet anomaly detection engine. Used to gain knowledge about attacks without signatures.
Tcptrack – used for session data information which can prove useful for attack correlation.
Ntop – which builds an impressive network information database from which we can identify aberrant behavior/anomaly detection.
Nagios – fed from the host asset database, it monitors host and service availability information.
Osiris – a great HIDS.
OCS-NG – cross-platform inventory solution.
OSSEC – integrity, rootkit, registry detection, and more.


share|improve this answer
This is a huge help. Thank you! – MattC Oct 28 '09 at 16:58

You can use a open-source and free solution based on Prelude-IDS

  • Prelude IDS is a SIM (Security Information Management) system / IDS Framework.

  • Snort can be used as NIDS

  • Prelude LML as HIDS : rulesets for SSH, Cisco PIX, Netfilter IPFW, Postfix, Sendmail...

  • Prewikka is is the official Prelude User Interface : Web GUI based on Python =>

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.