## Suricata: The Multithreaded Powerhouse

**Suricata** (managed by OISF) is the modern competitor to Snort. It uses the same rule syntax (mostly) but was built for speed and deep visibility.

### Key Differences from Snort

#### 1. Multi-Threading
Suricata is natively multi-threaded. If you put it on a 64-core server, it will use all 64 cores to process traffic. This allows it to handle massive bandwidth (10Gbps, 40Gbps, 100Gbps) that would choke legacy Snort.

#### 2. Protocol Awareness (Application Layer)
Suricata doesn't just look at bytes; it understands the "App".
*   It automatically identifies HTTP, TLS, SMB, FTP, DNS.
*   Even if you run HTTP on port 8080 (non-standard), Suricata sees the handshake and says "This is HTTP."
*   **EVE.json**: Suricata produces a rich JSON log file (`eve.json`) that logs metadata for *every* flow, not just alerts.
    *   *Example*: It logs every TLS certificate exchange. You can investigate "Self-Signed Certs" or "Expired Certs" effortlessly.

#### 3. File Extraction
Suricata can automatically carve files out of the stream.
*   Configuration: `file-store: yes`
*   Result: If a user downloads a `.exe` or `.pdf`, Suricata can save a copy of that file to disk for the Malware Analysis team to sandbox later.

### Zeek (Formerly Bro)
While talking about Suricata/Snort, we must mention **Zeek**.
*   **Snort/Suricata** = "Is this bad?" (Alerting).
*   **Zeek** = "What is happening?" (Visibility).
Zeek creates transaction logs. `conn.log` (all connections), `http.log` (all web requests), `dns.log` (all resolutions).
It is less about signatures and more about generating high-quality structured data for your SIEM to hunt through.

### Which one to choose?
*   **Snort**: If you need lightweight, standard IPS.
*   **Suricata**: If you have high bandwidth and want metadata (TLS/HTTP info).
*   **Zeek**: If you want deep forensics and threat hunting capability (often run *alongside* Suricata).