Skip to content
Emacs major mode for editing Snort rules
Emacs Lisp
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.

Snort Major Mode for Emacs

About SNORT®

Snort is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire.

Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide.

With millions of downloads and nearly 400,000 registered users, Snort has become the de facto standard for IPS.


GNU Emacs is an extensible, customizable text editor—and more. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing.


Support for syntax highlighting, commenting and indentation.

Validate the syntax of the current file with snort-validate and test it against a PCAP-file with snort-test-pcap.

Jump between rules with snort-next-rule and snort-previous-rule. Kill the rule at the point with snort-kill-rule.

Customizable variables

Variables are in the snort group.

  • snort-basic-offset: the indentation level
  • snort-executable: path to the Snort executable



  • Remove word lists when regexp are created (free memory?)
  • Does not support user created rule actions (dynamically?)
  • Variable modifiers
  • Extend the syntax table


  • snort-expand, snort-contract, snort-expand-all, snort-contract-all: toggle between one-line and multiline rules (one modifier per line)
  • snort-create-rule: create skeleton for common rules (e.g. dns query, http-requests, ping)
You can’t perform that action at this time.