12

Chapter 1     Introduction to Intrusion Detection and Snort

1.3 Components of Snort

Snort is logically divided into multiple components. These components work together

to detect particular attacks and to generate output in a required format from the detec 

tion system. A Snort based IDS consists of the following major components:

  Packet Decoder

  Preprocessors

  Detection Engine

  Logging and Alerting System

  Output Modules

Figure 1 5 shows how these components are arranged. Any data packet coming

from the Internet enters the packet decoder. On its way towards the output modules, it is

either dropped, logged or an alert is generated.

Figure 1 5 Components of Snort.