Snort有三种工作模式：嗅探器、数据包记录器、网络入侵检测系统。嗅探器模式仅仅是从网络上读取数据包并作为连续不断的流显示在终端上。数据包记录器模式把数据包记录到硬盘上。网路入侵检测模式是最复杂的，而且是可配置的。我们可以让snort分析网络数据流以匹配用户定义的一些规则，并根据检测结果采取一定的动作。-Snort has three operating modes: sniffer, packet logger, network intrusion detection system. Sniffer mode simply reads the packets from the network as a continuous stream and displayed on the terminal. Packet logger mode, the data packet recorded on the hard disk. Network intrusion detection mode is the most complex, and is configurable. We can snort analyze network data stream to match some user-defined rules, based on test results to take some action.