Snort and Suricata at the same time
-
I have a use case that I am currently running where I have both IDS packages installed. I have Suricata running with certain rule sets blocking IPs. Additionally I have the snort vrt rule set running as well.
I have Snort running ONLY for OpenAppID. I only care about identifying applications.
My question is , is this a valid use case for these two packages? Can they run at the same time without conflict? Is performance degradation going to be a problem.
-
Performance degradation will certainly be an issue. It's the same as running two anti-virus packages on the same host at the same time. Everything is double-scanned.
The one place they are likely to collide is the use of the snort2
pftable used for Legacy Mode blocking in both packages. Probably will coexist fine, but just note that if you clear all blocks from either package, you will wind up clearing things that both packages may have placed in there.I'm pretty sure that if you try to run both in Inline IPS Mode on the same interface you will get a crash. I don't think the netmap device would like that setup at all.
-
@bmeeks ok so using two IDS in none blocking mode maybe work but not as an IPS. That makes sense. Was curious if snort just for OpenAppID use case could still be used but doesn’t seem like it. Ok fair enough
