Snort - Network Intrusion Detection & Prevention System
Snort is the Open Source Intrusion Prevention System (IPS) globally. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.
Snort has three primary uses: As a packet sniffer like tcpdump, as a packet logger — which is helpful for network traffic debugging, or it can be used as a full-blown network intrusion prevention system. Snort can be deployed inline to stop these packets, as well. Snort can be downloaded and configured for personal and business use alike.
Features
Real-time traffic monitor.
Packet logging.
Analysis of protocol.
Content matching.
OS fingerprinting.
Can be installed in any network environment.
Creates logs.
Open Source.