Which comes first - snort or pfblocker etc

randombits

I've installed Snort and pfBlocker and I wondered which one is assessed first ?
Also if I add suricata etc into the mix which order are they assessed - assuming it works like that .

JeGr

You are aware that Snort and Surricata are BOTH IDS and do nearly the same job? It would be nonsene to throw Surricata into that, too without taking out Snort first.

randombits

Indeed, I did realise that . I think Surrcata has a steeper learning curve and more fine tuning and Snort is more set and forget but both are IDS's. I just wondered which is assessed first assuming it works serially.

Grimson

@randombits said in Which comes first - snort or pfblocker etc:

Snort is more set and forget but both are IDS's.

There is no such thing as a set and forget IDS/IPS, those will always need constant monitoring and maintenance.

randombits

True enough, How do you know if your're being attacked ;) if you don't at least look at it. Using Surrcata it seems to need more tweaking to get to a sweet spot rather than Snort which keeps happy longer with longer intervals of maintenance.

Raffi_

I personally switched from Snort to Suricata for reasons mentioned here.
https://forum.netgate.com/topic/141946/to-snort-or-not-pfblocker/4

I didn't notice much difference in the GUI, configuration, or functionality aspect between the two. In terms of tuning rules, they seemed pretty much the same to me as well. In my opinion, once I figured out Snort the learning curve was not high for Suricata.