Snort deployment modes: IDS vs IPS vs packet logging
Snort rule writing syntax and structure
Snort preprocessors for HTTP analysis and normalization
Snort port scan detection configuration
Snort rule options: content, offset, depth, distance, within
Snort flow tracking and session management
Snort output plugins: unified2, syslog, database logging
Snort PCAP replay for testing and tuning
Snort threshold and suppression configuration
Snort dynamic modules and shared object rules
Snort reputation-based blacklist filtering
Snort SSL/TLS inspection and decryption
Snort SMTP and email analysis preprocessor
Snort DNS response validation and detection
Snort FTP and Telnet protocol analysis
Snort rate-based attack detection with detection_filter
Snort rule benchmarking and performance tuning
Snort barnyard2 spooler for high-performance logging
Snort PulledPork rule management
Snort community rules versus registered rules
Snort Oinkcode registration for rule access
Snort VRT certified rule updates
Snort inline IPS mode with iptables NFQUEUE
Snort configuration file structure and directives
Snort variable definitions and dynamic variables
Snort rule header: action, protocol, IP, port, direction
Suricata vs Snort feature comparison
Suricata multi-threading and runmode configuration
Suricata YAML configuration file structure
Suricata rule format and custom signature creation
Suricata EVE JSON log output for SIEM integration
Suricata fast pattern analysis for performance
Suricata protocol detection and app-layer parsing
Suricata TLS/SSL fingerprinting and JA3 hashing
Suricata file extraction and file store configuration
Suricata flow load balancing and cluster configuration
Suricata IPS mode with NFQUEUE and AF_PACKET
Suricata Lua scripting for custom output and rules
Suricata anomaly detection with threshold config
Suricata reputation and IP blacklisting
Suricata ruleset management with suricata-update
Suricata memory profiling and performance tuning
Suricata dataset and string matching optimization
Suricata Hyperscan acceleration for pattern matching
Suricata DNP3 and Modbus ICS protocol support
Suricata HTTP/2 protocol inspection
Suricata VXLAN and tunnel detection
Suricata unix socket control for live configuration
Suricata multi-tenant configuration
Suricata PF_RING capture acceleration
Suricata Napatech hardware offload support