It develops a new signature to find vulnerabilities.

It detects and alerts a computer user when it finds threats such as buffer overflows, stealth port scans, CGI attacks, SMB probes and NetBIOS queries, NMAP and other port scanners, well-known backdoors and system vulnerabilities, and DDoS clients.

It encrypts the log file using the 256 bit AES encryption scheme algorithm.

It is used as a passive trap to record the presence of traffic that should not be found on a network, such as NFS or Napster connections.