Snort analyzes network traffic in real time against thousands of signature rules to detect attacks, port scans, and other malicious patterns — one of the oldest and most widely deployed open-source IDS engines, backed by a continuously updated rule community.