Performance Evaluation of Snort3 and Suricata: A Comparative Study
DOI:
https://doi.org/10.59421/vs44z864الكلمات المفتاحية:
Snort3، Suricata، Network Intrusion Detection System، NIDSالملخص
Network Intrusion Detection Systems (NIDS) are crucial for safeguarding modern networks, with Snort and Suricata being the most widely used open-source solutions. Most comparative studies focus on Snort2, whose single-threaded design is outdated compared to the redesigned Snort3. Recent comparisons between Snort3 and Suricata have produced inconsistent results due to variations in rulesets, traffic conditions, and experimental setups, leaving their relative efficiency and scalability unclear. This study addresses this gap by providing a controlled and reproducible performance evaluation of the latest stable versions of Snort3 (v3.9.5.0) and Suricata (v8.0.1) under identical test conditions. Using the CIC-IDS2017 dataset, traffic was replayed at rates ranging from 100 Mbps to 1 Gbps, with rulesets varying from 10,000 to 50,000. Three performance metrics were examined: CPU utilization, memory consumption, and packet drop rate. The results indicate that Suricata consistently achieved lower CPU usage, maintained a modest memory footprint, and sustained zero packet loss across all traffic loads and ruleset sizes. Snort3, in its default mode, exhibited higher CPU usage and began dropping packets at speeds exceeding 500 Mbps. Moreover, Snort3 experienced packet drops when the rulesets surpassed 30,000 rules, whereas Suricata remained resilient. Overall, the findings reveal a clear trade-off: Snort3 offers greater efficiency when sufficient memory resources are available, whereas Suricata provides more consistent scalability and reliability, making it preferable for high-throughput and rule-intensive deployments.المراجع
[1] H. A. Salman and A. Alsajri, “The evolution of cybersecurity threats and strategies for effective protection. A review,” SHIFRA, vol. 2023, pp. 73–85, 2023.
[2] R. Adriko and J. R. Nurse, “Cybersecurity, cyber insurance and small-to-medium-sized enterprises: a systematic review,” Information & Computer Security, vol. 32, no. 5, pp. 691-710, 2024.
[3] O. H. Abdulganiyu, T. Ait Tchakoucht, and Y. K. Saheed, “A systematic literature review for network intrusion detection system (IDS),” International Journal of Information Security, vol. 22, no. 5, pp. 1125–1162, 2023.
[4] S. Zaib, “An in-depth comparative analysis and evaluation of Snort and Suricata IDS/IPS functionality in pfSense,” Global Scientific Journal (GSJ), vol. 11, no. 8, 2023.
[5] H. Asad, S. Adhikari, and I. Gashi, “A perspective retrospective analysis of diversity in signature-based open-source network intrusion detection systems,” International Journal of Information Security, vol. 23, no. 2, pp. 1331-1346, 2024.
[6] H. El-Ta, M. Fahhad, R. Abumlha, S. Showman, and Z. Saab, “A lightweight network intrusion detection system for SMEs,” International Journal of Network Security & Its Applications, vol. 17, no. 3, 73–93, May 2025. doi: 10.5121/ijnsa.2025.17306.
[7] C. Sheng, S. Zhang, Y. Liu, and H. Liao, “Regular expression implementation: a comprehensive review from software algorithms to hardware acceleration,” Z. Xiong and Z. Ning, Eds. Guangzhou, China: SPIE, Aug. 2024, p. 49.
[8] Suricata user guide—suricata 8.0.1 documentation, https://docs.suricata.io/en/suricata-8.0.1/, accessed: May 2025.
[9] A. Gupta and L. S. Sharma, “Performance evaluation of snort and suricata intrusion detection systems on ubuntu server,” in Proceedings of ICRIC 2019, 2020, pp. 811-821.
[10] F. Alsakran, G. Bendiab, S. Shiaeles, and N. Kolokotronis, “Intrusion detection systems for smart home iot devices: Experimental comparison study,” in International Symposium on Security in Computing and Communication, 2019, pp. 87-98.
[11] W. Park and S. Ahn, “Performance comparison and detection analysis in snort and suricata environment,” Wireless Personal Communications, vol. 94, pp. 241-252, 2017.
[12] A. Waleed, A. F. Jamali, and A. Masood, “Which open-source ids? snort, suricata or zeek,” Computer Networks, vol. 213, pp. 109-116, 2022.
[13] A. A. E. Boukebous, M. I. Fettache, G. Bendiab, and S. Shiaeles, “A comparative analysis of snort 3 and suricata,” in 2023 IEEE IAS Global Conference on Emerging Technologies (GlobConET). IEEE, 2023, pp. 1-6.
[14] C. Hoover, “Comparative study of snort 3 and suricata intrusion detection systems,” Computer Science and Computer Engineering Undergraduate Honors Theses Retrieved from https://scholarworks.uark.edu/csceuht/10, vol. 5, 2022.
[15] D. S. Ghazi, H. S. Hamid, M. J. Zaiter, and A. S. G. Behadili, “Snort versus suricata in intrusion detection,” Iraqi Journal of Information and Communication Technology, vol. 7, no. 2, pp. 73-88, 2024.
[16] A. P. Wahyu, K. Fauziah, A. S. Nahrowi, M. N. Faiz, and A. W. Muhammad, “Strengthening network security: Evaluation of intrusion detection and prevention systems tools in networking systems,” International Journal of Advanced Computer Science and Applications, vol. 14, no. 9, 2023.
[17] Snort setup guides for emerging threats prevention, https://www.snort.org/documents , accessed: May 2025.
[18] Proofpoint Inc., Proofpoint emerging threats rules, https://rules.emergingthreats.net/, 2025, accessed: September 2025.
[19] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), January 2018.
[20] Klassen, Tcpreplay—pcap editing and replaying utilities, https://tcpreplay.appneta.com/, accessed: July 2025.
