Sourcefire is a Hit

Sourcefire was founded in 2001 by Martin Roesch, the creator of Snort. The company created a commercial version of the Snort software, the Sourcefire 3D System, which evolved into the company’s Firepower line of network security products. Sourcefire was acquired by Cisco for $2.7 billion in July 2013.

What is Snort?

Snort’s open source network-based intrusion detection system (IDS) has the ability to perform real-time traffic analysis and packet logging on Internet Protocol networks. Snort performs protocol analysis, content searching and matching.

The program can also be used to detect probes or attacks, including, but not limited to, operating system fingerprinting attempts, semantic URL attacks, buffer overflows, server message block probes, and stealth port scans.

Snort can be configured in three main modes: sniffer, packet logger, and network intrusion detection.

• In sniffer mode, the program will read network packets and display them on the console.
• In packet logger mode, the program will log packets to the disk.
• In intrusion detection mode, the program will monitor network traffic and analyze it against a rule set defined by the user. The program will then perform a specific action based on what has been identified.

The Cisco Sourcefire Integration

Cisco began integrating the Sourcefire technology into various Cisco appliances as soon as possible. For example, the ASA 5500-X and ISR routers began offering Sourcefire capabilities soon after the acquisition.

Cisco also began releasing new hardware platforms to showcase the technology including the:

• Firepower 2100 Series
• Firepower 4100 Series
• Firepower 9300 Series

Today, the excitement revolved around the latest implementation of the Sourcefire technology in what Cisco has named Firepower Threat Defense (FTD). FTD represents the convergence of the Cisco ASA software and the Sourcefire technology into a central code base.

Get ready for more detailed posts on this exciting technology!