CheckPoint Acquires Snort

bobdehnhardt writes "The Snort-announce list was burning with the news that CheckPoint has signed an agreement to acquire Sourcefire, the commercial arm of the Snort community. As part of the agreement, CheckPoint will "continue to develop and distribute Snort under the GPL, improve and document the program to stay on the cutting edge and expand the snort.org web site." Here is a message from Snort creator Marty Roesch."

Comments

" Here is a message from Snort creator Marty Roesc

[b1gk1tty]

" Here is a message from Snort creator Marty Roesch."

I'm rich I'm rich I'm filthy f*ckin rich!

Re:while snort is a fine piece of software ...

[b0r1s]

It's worth mentioning that it's possible to trigger on known attack VECTORS rather than just known attacks - that is, on some vulnerabilities, all possible attacks will have a single signature at some point in the packet, which WILL be triggered. Moreover, some PROTOCOLS will always have the same signature, which may be hit as byproducts of the attack (ie: if I see an IRC packet coming from a webserver, I'm going to alert no matter what port it's on, or where it's going, because it shouldn't be there, period).

Snort can be bypassed in many scenarios, but it's still very useful.

no big deal

[qwertphobia]

This is no big deal. Snort will continue to be GPL and freely available to the world.

I'm more worried about the recent Nessus changes, have you heard about this?
Nessus License Change Announcement

Nessus 2 will continue to be free
Nessus 3 will be a free of charge, binary only release

Re:while snort is a fine piece of software ...

[PGillingwater]

Plus you might find that a shellcode exploit requires a shellcode sled, which can be detected. And many of the people who use Snort might not know that Sourcefire has made a major innovation with RNA -- a passive traffic analysis system which tells you what hosts are in your LAN, and what ports are being used -- kind of like NTOP, but with better consolidation and reporting.