Martin Roesch
More info
- Known for
- Snort, Sourcefire
- Affiliation
- Sourcefire, Cisco
American security engineer who wrote Snort in 1998, the open-source intrusion detection system whose rule syntax became the industry's lingua franca.
Snort started as a side project: a tcpdump-style packet sniffer with a small rule language bolted on to flag suspicious patterns. Roesch's 1999 LISA paper called it "lightweight", and that was the selling point — commercial IDS boxes cost a fortune, while Snort ran happily on a retired PC.
In 2001 he founded Sourcefire to sell support and curated rule sets around the open engine. The company bought ClamAV in 2007 and was itself bought by Cisco in 2013 for roughly $2.7 billion. Snort's rule format long outlived its exclusivity; plenty of competitors simply parse it as-is.