Work on Snort 3 has been ongoing since at least December 2014, a major rewrite and re-thinking of how IPS/IDS works and preforms. Roesch said that Snort 3 is largely feature complete at this point and is now going though its beta development cycle.
“It’s pretty much a re-write,” Roesch said of the Snort 3 codebase. “There were sins of my youth in the original Snort engine, reflected in things like the Snort rule language and configuration system.”