Softpedia >Mac >Security >Snort >  Changelog

Snort Changelog

What's new in Snort 3.1.32.0

Jun 17, 2022
  • appid: config for logging eve process to client mappings
  • dce_smb: reduce smb_max_credit range to avoid uint16_t overflow
  • detection: remove redundant FIXIT
  • ftp_telnet: correct the implementation for check_encrypted and encrypted_data config, handle form-feed as non-encrypted traffic
  • ftp_telnet: handle all space characters as a seperator between FTP request command and arguments
  • http_inspect: add explicit check for HTML script opening tag ending
  • http_inspect: remove unneeded header inclusions and improve cleanup before trailers
  • ips_options: improve ips_hash and ips_cvs code coverage
  • log: Fixed missing include for Clear Linux build.
  • logger: added reload function to create new files when snort reloads
  • main: add null check for scratch handler
  • mime: cleanup
  • modules: resolve int type mismatch in config options
  • netflow: fix build on MacOS
  • netflow: implement RNA integration for host/service discovery
  • netflow: support memcap reconfiguration upon reload
  • openssl: Openssl minimum version is set to 1.1.1
  • profiler: fix issue with negative number cast to unsigned for max_depth
  • rna: reduce range for ttl, fix cast for df, minor and major options. Thanks to liangxwa01 for pointing this out.
  • stream_tcp: fix splitter abort handling
  • stream_tcp: flip the server_side flag in fallback() and assert what it should be
  • utils, parser: remove redundant fixits
  • utils: remove curly brace parsing from regex literals
  • utils: remove redundant checks in regex groups
  • wizard: use const reference instead of copying

New in Snort 3.1.31.0 (Jun 3, 2022)

  • appid: add lock_guard to prevent data race on reload
  • appid: do not delete third-party connection when third-party reload is in progress and the context swap is not complete
  • dce_rpc: convert tree tracker to shared ptr
  • doc: add class track description to user doc
  • filters: add correct handling of by_src and by_dst. Thanks to Albert O'Balsam for reporting the bug.
  • host_tracker: rename generic files and classes
  • http2_inspect: add alert and infraction for non-Data frame too long
  • http_inspect: add Content-Type header validation for Enhanced JS Normalizer
  • http_inspect: add field for raw_body
  • http_inspect: add handling of binary, octal and big integers to JS Normalizer
  • http_inspect: change js processed data tracking
  • http_inspect: implement general approach of checking Content-Type header
  • hyperscan: reallocate hyperscan scratch space when patterns are reloaded during appid detector reload
  • netflow: enforce memcap for session record and template LRU caches
  • perf_monitor: fix timestamp for idle processing
  • utils: add keyword new support and object tracking
  • utils: allow script closing tag in single-line comments

New in Snort 3.1.30.0 (Jun 3, 2022)

  • build: Update dependent libdaq version to 3.0.7
  • doc: update clone link in README. Thanks to billchenchina.
  • doc: user documentation update for obfuscate_pii and --help-module
  • framework: add method to get unquoted string from configuration value
  • http2_inspect: Templatize variable length integer decoding of integer and string
  • http_inspect: add ignoring defined object properties for Enchanced JS normalizer
  • http_inspect: avoid sending compressed data to JS normalizer
  • http_inspect: check if input available before JavaScript normalization
  • mime: set partial_header to null after deletion
  • perf_monitor: remove unused flatbuffers support
  • piglets: remove unused test harness
  • smb: handle file context cleanup
  • snort3: remove SMB detection from service_netbios.cc
  • stream: refactor flush_queued_segments
  • stream_tcp: add null check for get_current_wire_packet() in dce too
  • stream_tcp, pop: add sync_on_start method to StreamSplitter
  • stream_tcp: provide a context and a wire packet where needed, when calling into reassembly from outside regular processing (handle_timeouts)
  • utils: add Latin-1 decoding of JavaScript unescape-like functions
  • utils: allow regex literals after operator
  • utils: fix regex char classes parsing
  • utils: turn debug-build assertion into a product-build code
  • wizard: fix code style

New in Snort 3.1.29.0 (May 20, 2022)

  • appid: add alpn matchers
  • dce_rpc: update address space id in the smb keys
  • doc: rule text updates
  • flow, network_inspectors, policy_selectors, stream: make address space id 32 bits and add a tenant id to the daq header
  • flow, side_channel, utils: fix clang issues
  • flow: add inline cppcheck suppressions
  • flow: change the padding and bits in the flow key to make it more clear
  • http_inspect: install header files, create a virtual base class for http_inspect and http_stream_splitter
  • http_inspect: move mime processing outside of file and detect depth
  • main: update analyzer command log message to copy the variable arguments before using them for the remote response
  • wizard: update glob storage due to shared memory

New in Snort 2.9.19 (Dec 6, 2021)

  • New Additions:
  • Added support for Appid to detect login success and failure for IMAP and POP3 protocols.
  • Improvements / Fix:
  • Fixed an issue where verdict will be applied onto next session when timeout occurs in some scenarios.
  • Removed an excessively flooding log.
  • Fixed possible integer overflow.
  • Added fix to GCC compiled snort to use AC-BNFA-Q search-method when Intel-cpm is enabled.
  • Fixed terminology to be bias-free in log/error messages.
  • Fixed a potential race condition.
  • Added fix to not to drop packets when window size is 0 by TCP normalizer and Added new alert with GID 129 and SID 21 when such packets are seen.

New in Snort 2.9.18.1 (Sep 2, 2021)

  • Improvements / Fix:
  • Fixed possible memory corruption in SMB preprocessor.

New in Snort 2.9.18 (Jun 15, 2021)

  • New Additions:
  • Added range field support in HTTP preprocessor.
  • Added alert for http chunk size mismatch.
  • Added support to detect snmp 'report pdu'.
  • Added additional stats for SMB preprocessor.
  • Improvements / Fix:
  • Fixed a condition in which alert would not be generated.
  • Fixed possible memory corruption in SMB preprocessor.
  • Fixed handling ICMP error code -4 .
  • Fixed an error when debugmsgs option enabled in compilation.

New in Snort 2.9.17.1 (Mar 30, 2021)

  • src/preprocessors/Stream6/snort_stream_tcp.c: Fixed wrong reference to configuration during reload.
  • src/dynamic-preprocessors/appid/fw_appid.c: Fixed possible memleak in appid.
  • src/detect.c, src/preprocessors/snort_httpinspect.c: Fixed a race-condition in http preproc and IPS.
  • configure.in: Fixed compilation issues when intel-soft-cpm is enabled.
  • src/preprocessors/Stream6/snort_stream_tcp.c, src/preprocessors/Stream6/stream_common.h, src/preprocessors/spp_stream6.c: Fixed a race-condition in stream preproc.

New in Snort 2.9.17 (Nov 22, 2020)

  • src/preprocessors/Stream6/snort_stream_tcp.c,
  • src/preprocessors/spp_stream6.c
  • Fixed Memory leak in reassembly networks and ports config during reload.
  • src/file-process/file_resume_block.c,
  • src/file-process/file_service.c,
  • src/file-process/file_lib.c,
  • src/file-process/file_lib.h
  • Fixed resume-block for SMBv2 partial content retry and pending verdicts.
  • src/win32/WIN32-Prj/snort_installer.nsi
  • Added user visible message to choose 4.1.1 or any higher version of winpcap, in windows 32 installer.
  • src/win32/WIN32-Prj/snort_installer_x64.nsi,
  • src/win32/WIN32-Prj/snort_installer.nsi
  • Fixed popup message that was not honoring windows silent uninstaller option.
  • src/preprocessors/snort_httpinspect.c
  • Fix to populate original client IP for drop events, when inline normalization is disabled.
  • src/dynamic-preprocessors/appid/luaDetectorApi.c
  • Fixed AppID caching proxy IP instead of tunneled IP in the dynamic cache during ultrasurf traffic.
  • src/detection-plugins/sp_react.c,
  • src/dynamic-preprocessors/sdf/spp_sdf.c,
  • src/parser.c,
  • src/preprocessors/Stream6/snort_stream_tcp.c,
  • tools/u2streamer/Unified2File.c,
  • src/dynamic-preprocessors/appid/luaDetectorApi.c,
  • src/dynamic-preprocessors/appid/appInfoTable.c,
  • snort/src/dynamic-plugins/sf_dynamic_plugins.c,
  • src/memory_stats.c,
  • src/sfutil/sfportobject.c,
  • src/snort.h :
  • Fixed multiple static analysis issues.
  • src/dynamic-preprocessors/appid/appInfoTable.c
  • Fixed a potential race condition.
  • configure.in,
  • src/reload.c
  • Fix to not rely on the last-modified-time for loading the dynamic detection libs.
  • src/dynamic-preprocessors/appid/detector_plugins/detector_smtp.c,
  • src/file-process/file_capture.c,
  • src/file-process/file_resume_block.c,
  • src/file-process/file_segment_process.c,
  • src/file-process/file_service.c
  • Added debug messages in file-process packet flow.
  • src/dynamic-preprocessors/appid/detector_plugins/detector_smtp.c
  • Fix to address cases of ambiguous codes between SMTP & FTP and when SMTP server does not support EHLO.
  • src/file-process/file_segment_process.c
  • Fixed issue of generating multiple events for a single file transfer over SMB.
  • src/dynamic-preprocessors/appid/appIdConfig.h,
  • src/dynamic-preprocessors/appid/appInfoTable.c,
  • src/dynamic-preprocessors/appid/appInfoTable.h,
  • src/dynamic-preprocessors/appid/flow.h,
  • src/dynamic-preprocessors/appid/fw_appid.c,
  • src/dynamic-preprocessors/appid/flow.h
  • Fixed false positives for ultrasurf.
  • src/dynamic-preprocessors/sip/spp_sip.c
  • Fixed SIP pre-processor to detect SSL encrypted SIP traffic better.
  • src/dynamic-preprocessors/appid/luaDetectorApi.c,
  • etc/gen-msg.map,
  • preproc_rules/preprocessor.rules,
  • src/file-process/file_service.c,
  • src/generators.h,
  • src/preprocessors/HttpInspect/client/hi_client.c,
  • src/preprocessors/HttpInspect/event_output/hi_eo_log.c,
  • src/preprocessors/HttpInspect/include/hi_client.h,
  • src/preprocessors/HttpInspect/include/hi_eo_events.h,
  • src/preprocessors/HttpInspect/include/hi_server.h,
  • src/preprocessors/HttpInspect/server/hi_server.c,
  • src/preprocessors/snort_httpinspect.c,
  • src/preprocessors/snort_httpinspect.h
  • Added support for HTTP range field parsing to detect if HTTP response/request is indeed partial or full content.
  • src/preprocessors/spp_session.c
  • Fixed TCP memcap oversize.
  • src/dynamic-preprocessors/dcerpc2/dce2_stats.h,
  • src/dynamic-preprocessors/dcerpc2/snort_dce2.c,
  • src/dynamic-preprocessors/dcerpc2/spp_dce2.c,
  • src/dynamic-preprocessors/ftptelnet/ftpp_si.c,
  • src/dynamic-preprocessors/ftptelnet/pp_ftp.c,
  • src/dynamic-preprocessors/ftptelnet/spp_ftptelnet.c,
  • src/dynamic-preprocessors/ftptelnet/spp_ftptelnet.h,
  • src/preprocessors/HttpInspect/client/hi_client.c,
  • src/preprocessors/HttpInspect/client/hi_client_norm.c,
  • src/preprocessors/HttpInspect/include/hi_include.h,
  • src/preprocessors/HttpInspect/include/hi_paf.h,
  • src/preprocessors/HttpInspect/utils/hi_paf.c,
  • src/preprocessors/Stream6/snort_stream_icmp.c,
  • src/preprocessors/Stream6/snort_stream_icmp.h,
  • src/preprocessors/Stream6/snort_stream_ip.c,
  • src/preprocessors/Stream6/snort_stream_ip.h,
  • src/preprocessors/Stream6/snort_stream_tcp.c,
  • src/preprocessors/Stream6/snort_stream_tcp.h,
  • src/preprocessors/Stream6/snort_stream_udp.c,
  • src/preprocessors/Stream6/snort_stream_udp.h,
  • src/preprocessors/Stream6/stream_common.h,
  • src/preprocessors/snort_httpinspect.c,
  • src/preprocessors/snort_httpinspect.h,
  • src/preprocessors/spp_httpinspect.c,
  • src/preprocessors/spp_httpinspect.h,
  • src/preprocessors/spp_stream6.c,
  • src/dynamic-preprocessors/appid/fw_appid.c,
  • src/dynamic-preprocessors/appid/fw_appid.h,
  • src/dynamic-preprocessors/appid/spp_appid.c
  • Enhanced statistics dumped during snort exit and SIGUSR1.
  • src/dynamic-preprocessors/imap/imap_paf.c,
  • src/dynamic-preprocessors/imap/snort_imap.h,
  • src/dynamic-preprocessors/pop/pop_paf.c,
  • src/dynamic-preprocessors/pop/snort_pop.h,
  • src/dynamic-preprocessors/sip/spp_sip.h,
  • src/dynamic-preprocessors/smtp/smtp_paf.c,
  • src/dynamic-preprocessors/smtp/snort_smtp.h,
  • src/dynamic-preprocessors/appid/flow.h,
  • src/dynamic-preprocessors/appid/service_plugins/service_ssl.c,
  • src/dynamic-preprocessors/dcerpc2/dce2_list.h,
  • src/dynamic-preprocessors/ftptelnet/ftpp_si.h,
  • src/file-process/file_segment_process.h,
  • src/file-process/libs/file_lib.h,
  • src/preprocessors/sip_common.h,
  • src/preprocessors/snort_httpinspect.h
  • Optimized structures in several preprocessors.
  • src/dynamic-preprocessors/dcerpc2/dce2_smb.c,
  • src/dynamic-preprocessors/dcerpc2/dce2_smb.h
  • src/file-process/file_service.c
  • Fixed SMBv1 file block for pending verdict retry packets.
  • src/dynamic-preprocessors/dcerpc2/dce2_smb.c :
  • Fixed SMBv1 unknown file size upload block.
  • src/detect.c,
  • src/detect.h,
  • src/parser.c,
  • src/parser.h,
  • src/preprocessors/Session/session_common.h,
  • src/preprocessors/Stream6/snort_stream_udp.c,
  • src/preprocessors/Stream6/snort_stream_udp.h,
  • src/preprocessors/spp_stream6.c,
  • src/preprocessors/Stream6/stream_common.c,
  • src/preprocessors/Stream6/stream_common.h,
  • src/preprocessors/spp_stream6.c,
  • src/reload.c,
  • src/snort.c,
  • src/snort.h
  • Fixed incorrect filtering of UDP traffic when "ignore_any_rules" is configured.
  • src/detection-plugins/sp_session.c,
  • src/detection-plugins/sp_session.h,
  • src/sfutil/util_jsnorm.c
  • Fixed GCC 10.1.1 compilation issues.
  • src/decode.c,
  • src/decode.h,
  • src/log_text.c,
  • src/log.c,
  • src/preprocessors/Stream6/snort_stream_tcp.c
  • Added support to detect TCP Fast Open packets.
  • src/preprocessors/Stream6/snort_stream_tcp.c
  • Fixed TCP segment queue hole issue as per the RFC793 recommendation for OOO Ack packet handling.
  • src/detection-plugins/detection_leaf_node.c,
  • src/detection-plugins/detection_options.c,
  • src/dynamic-preprocessors/appid/appInfoTable.c,
  • src/dynamic-preprocessors/appid/fw_appid.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_base.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_ftp.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_rexec.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_rpc.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_rshell.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_snmp.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_tftp.c,
  • src/dynamic-preprocessors/ftptelnet/ftpp_si.c,
  • src/dynamic-preprocessors/ftptelnet/pp_ftp.c,
  • src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c,
  • src/dynamic-preprocessors/ftptelnet/spp_ftptelnet.c,
  • src/fpcreate.c,
  • src/parser.c,
  • src/preprocessors/Session/session_common.h,
  • src/preprocessors/spp_session.c,
  • src/reload.c,
  • src/snort.c
  • Fixed build when some configure options were disabled.
  • src/detection-plugins/sp_byte_math.c
  • Fixed byte_math operation for multiplication integer overflow.
  • src/dynamic-preprocessors/appid/appId.h,
  • src/dynamic-preprocessors/appid/service_plugins/service_ssl.c
  • Fix to include 853 port in SSL detector for DNS over TLS runs on SSL.
  • src/dynamic-plugins/sf_dynamic_plugins.c,
  • src/dynamic-plugins/sf_dynamic_preprocessor.h,
  • src/dynamic-preprocessors/appid/Makefile_defs,
  • src/dynamic-preprocessors/appid/luaDetectorApi.c,
  • src/dynamic-preprocessors/appid/util/common_util.h
  • Fix for excessive logging of lua detector invalid LUA (null).
  • snort/src/detection-plugins/sp_byte_check.c,
  • src/detection-plugins/sp_byte_extract.c,
  • src/detection-plugins/sp_byte_jump.c,
  • src/detection-plugins/sp_byte_math.c,
  • src/detection-plugins/sp_byte_math.h,
  • src/detection-plugins/sp_isdataat.c,
  • src/detection-plugins/sp_pattern_match.c
  • Added support for allowing common names across rule options.
  • src/memory_stats.c
  • Removed a redundant log.
  • spp_sip.c
  • Fixed handling encrypted traffic by SIP preprocessor.
  • snort/configure.in,
  • snort/doc/README.s7commplus,
  • snort/etc/sf_rule_options,
  • snort/etc/sf_rule_validation.conf,
  • snort/src/dynamic-preprocessors/Makefile.am,
  • snort/src/dynamic-preprocessors/s7commplus/Makefile.am,
  • snort/src/dynamic-preprocessors/s7commplus/s7comm_decode.c,
  • snort/src/dynamic-preprocessors/s7commplus/s7comm_decode.h,
  • snort/src/dynamic-preprocessors/s7commplus/s7comm_paf.c,
  • snort/src/dynamic-preprocessors/s7commplus/s7comm_paf.h,
  • snort/src/dynamic-preprocessors/s7commplus/s7comm_roptions.c,
  • snort/src/dynamic-preprocessors/s7commplus/s7comm_roptions.h,
  • snort/src/dynamic-preprocessors/s7commplus/spp_s7comm.c,
  • snort/src/dynamic-preprocessors/s7commplus/spp_s7comm.h,
  • snort/src/generators.h,
  • snort/src/preprocids.h
  • Added support for s7Commplus protocol.
  • src/preprocessors/Stream6/snort_stream_tcp.c
  • Fixed out of order FIN packet leading to segment trimming.
  • src/output-plugins/spo_unified2.c,
  • src/preprocessors/Stream6/snort_stream_tcp.c
  • Fix to populate original IP in dropped events when inline normalization is enabled.
  • snort/src/sfutil/sf_ip.h
  • Fixed compiler warnings.
  • src/dynamic-preprocessors/appid/detector_plugins/detector_dns.c
  • Fixed DNS application detector failing to detect DNS traffic in some scenarios.

New in Snort 2.9.16.1 (Aug 5, 2020)

  • New Additions:
  • Added support for GCC version 10.1.1.
  • Improvements / Fix:
  • Added packet counters to make sure flows with one-way data don't pend forever.
  • Fixed potential race condition between reload and exit path.

New in Snort 2.9.15.1 (Feb 25, 2020)

  • New Additions:
  • Added support for glibc version 2.30.
  • Improvements / Fix:
  • Fixed snort core seen during ssl re-configuration.
  • Fixed file access issues on files from SMB share.

New in Snort 2.9.15 (Oct 11, 2019)

  • src/snort.c,
  • src/control/sfcontrol.c,
  • src/preprocessors/Session/stream5_ha.c,
  • src/preprocessors/session_api.h,
  • src/dynamic-plugins/sp_dynamic.c: Fixed a potential race condition.
  • src/detect.c: Fixed static analysis issues.
  • src/detect.c,
  • src/detect.h,
  • src/file-process/file_service.c,
  • src/reload.c,
  • src/sfdaq.h,
  • src/snort.c,
  • src/snort.h: Added new debugs to print detection, file_processing and Preproc time consumption info and verdict.
  • src/dynamic-preprocessors/appid/fw_appid.c: Added NULL check before dereferencing tcp_header.
  • src/file-process/libs/file_lib.h, src/sfdaq.h: Fix to make daq_pktHdr globally visible and removed the extra Packet variable from the FILE_PKT_DEBUG macro.
  • snort/etc/file_magic.conf: Added support to detect new Korean file formats .egg and .alz to the file preprocessor.
  • src/dynamic-preprocessors/gtp/gtp_parser.c,
  • src/dynamic-preprocessors/gtp/spp_gtp.h: Fix to generate ALERT if TEID value is zero in GTP v1 and v2 packets.
  • src/detect.c: Added a check before printing the Packet latency trace when detection is enabled or not.
  • src/file-process/file_capture.c,
  • src/file-process/file_mime_process.c,
  • src/file-process/file_resume_block.c,
  • src/file-process/file_segment_process.c,
  • src/file-process/file_service.c,
  • src/file-process/libs/file_lib.c,
  • src/file-process/libs/file_lib.h,
  • src/sfdaq.h: Added debug messages in file-process packet flow.
  • src/dynamic-plugins/sp_dynamic.c,
  • src/reload.c,
  • src/reload.h,
  • src/snort.c: Fixed dynamic rules from getting disabled after multiple reloads.
  • src/pkt_tracer.c: Fix to print packet trace information in the direction of the packet on the wire.
  • etc/file_magic.conf: Added new file magic to detect RAR file-type.
  • src/dynamic-plugins/sf_dynamic_preprocessor.h: Updated preproc version.
  • src/dynamic-plugins/sf_dynamic_preprocessor.h: Provided an API to query non-flow related information from DAQ.
  • src/dynamic-plugins/sf_dynamic_plugins.c,
  • src/dynamic-plugins/sf_dynamic_preprocessor.h,
  • src/sfdaq.c,
  • src/sfdaq.h: Added a generic api DAQ_Ioctl for dynamic preprocs to use for various daq clis.
  • src/dynamic-preprocessors/appid/Makefile_defs,
  • src/dynamic-preprocessors/appid/detector_plugins/detector_imap.c,
  • src/dynamic-preprocessors/appid/detector_plugins/detector_pop3.c,
  • src/dynamic-preprocessors/appid/detector_plugins/detector_smtp.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_base.h,
  • src/dynamic-preprocessors/appid/service_plugins/service_ftp.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_netbios.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_nntp.c: Fix to whitelist ftp data sessions when no file policy exists.
  • src/dynamic-preprocessors/appid/fw_appid.c: Fixed -Wparentheses warning.
  • src/dynamic-preprocessors/appid/fw_appid.c: Fixed the algorithm that triggers port only detection.
  • src/preprocessors/HttpInspect/client/hi_client.c,
  • src/preprocessors/HttpInspect/include/hi_paf.h,
  • src/preprocessors/HttpInspect/utils/hi_paf.c: Fixed an issue where HTTP was wrongly processing non HTTP traffic on port 443.
  • src/dynamic-preprocessors/appid/appIdConfig.h,
  • src/dynamic-preprocessors/appid/fw_appid.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_base.c,
  • src/dynamic-preprocessors/appid/service_plugins/service_base.h: Fixed IPS alerts generation for ICMP packets.
  • src/file-process/file_resume_block.c: Fixed signature lookup when the context is not present.
  • src/preprocessors/HttpInspect/utils/hi_paf.c: Added a new state to handle HTTP responses, having no status message followed by status code.
  • src/dynamic-plugins/sf_dynamic_plugins.c,
  • src/dynamic-plugins/sf_dynamic_preprocessor.h,
  • src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.c,
  • src/dynamic-preprocessors/ftptelnet/snort_ftptelnet.h: Added DPD callbacks for receiving ftp transfer mode before generating file events.
  • snort/etc/file_magic.conf: Fixed RTF file magic to a more generic value to prevent evasions.
  • src/preprocessors/spp_httpinspect.c: Added debug logs during HTTP Reload.
  • src/dynamic-preprocessors/reputation/shmem/shmem_mgmt.c: Fix to bypass munmap if shmemSegptr points to zeroSegptr.
  • src/parser.c: Added rule SID check during Snort validation.
  • src/pkt_tracer.c: Corrected endianness representation for some of the parameters in the debug log.

New in Snort 2.9.14.1 (Aug 5, 2019)

  • src/sfdaq.c :
  • Fixed packet drop scenario.

New in Snort 2.9.14 (Jul 19, 2019)

  • New Additions:
  • Added support for wild card port numbers in host cache and overwriting port service AppId.
  • Added new client patterns to prompt client validation.
  • Added SMTP Microsoft Outlook client for Mac.
  • Added a new preprocessor alert 120:27 to alert if there is not proper end of header.
  • Improvements:
  • Improved appId detection for proxied traffic.
  • Fix to ensure Snort is ready for packet commencing before DAQ starts.
  • Fix for enabling flow profiling mode without restarting snort detection engine.

New in Snort 2.9.13 (Apr 12, 2019)

  • New Additions:
  • Snort now supports reload on snort rules update.
  • Addition of a scenario to add a packet to blacklist verdict to ensure new session will be allowed.
  • Handled a new pre-processor alert in case of improper end of HTTP header.
  • Improvements:
  • Modified the calculation of file hash for FTP/HTTP with offset values.
  • Fixed portal authentication connection stuck in half closed state.
  • Updated UDP global timeout for non-standard port.

New in Snort 3.0.0 Beta (Aug 30, 2018)

  • Configuration — We use LuaJIT for configuration. The config syntax is simple, consistent, and executable. LuaJIT plugins for rule options and loggers are supported, too.
  • Detection — We have worked closely with Cisco Talos to update rules to meet their needs, including a feature they call "sticky buffers." With the use of the Hyperscan search engine, regex fast patterns make rules faster and more accurate.
  • HTTP — We have a new and stateful HTTP inspector that currently handles 99 percent of the HTTP Evader cases, and will soon cover all of them. There are many new features, as well, including new rule options. HTTP/2 support is under development.
  • Performance — We have substantially increased performance for deep packet inspection. Snort 3 supports multiple packet-processing threads, and scales linearly with a much smaller amount of memory required for shared configs, like rule engines.
  • JSON event logging — These can be used to integrate with tools such as the Elastic Stack. See this blog post for more details.
  • Plugins — Snort 3 was designed to be extensible and there are over 225 of plugins of various types. It is easy to add your own codec, inspector, rule action, rule option, or logger. SO rules are plugins, too, and it is much easier to add your own.

New in Snort 2.9.11.1 (Jan 6, 2018)

  • New Additions:
  • Added support to block portscan. In addition to tracking the scanning packets, action(drop/sdrop/reject) will be taken for all the packets, which means snort will block the packet and generate logs.
  • Added support to re-evaluate reputation after reputation update for all flows except those that have already been blacklisted.
  • Improvements:
  • Fixed issue to detect RTP upto two SSRC switches in each traffic direction.
  • Fixed issues related to HTTP POST header flushing, calling file processing directly if it is not a multipart header and changes to avoid expensive copy of segment data by not splitting them when flushing headers.
  • Fixed issue of triggering protocol sweep alert when there are multiple destinations from single source ip protocol scan.
  • Added changes to fix IP portscan for protocol other than ICMP and fixed issue of bad fragment size event not being generated for oversized packets.
  • Added changes to use raw data in case of PDF and SWF files during file processing for SHA calculation and Malware Cloud Lookup.
  • Fixed issue of correct session matching for TCP SYN packets without window scale option so that FTP data channels match the same rule as FTP control channels.
  • Fixed issue of applying new configuration in file inspection after snort reload.

New in Snort 3.0.0 Build 239 Alpha (Oct 14, 2017)

  • rules: remove sample.rules; Talos will publish Snort 3 rules on snort.org
  • logging: fix handling of out of range timeval thanks to [email protected] for reporting the issue
  • wizard: fix direction issue
  • wizard: fix imap spell
  • check: update hyperscan and regex tests
  • cpputests: clean up some header include issues
  • daq_socket: update to support query of pci
  • detection: fix debug print of fast pattern only
  • detection: rule evaluation trace utility
  • doc: update concepts and differences
  • file_api: memory leak fixed
  • file_id: fixes for file capture exit
  • http_inspect: added 119:97 for lower case letters in version field
  • http_inspect: alert 119:96 added for unsolicited 206 response.
  • http_inspect: specific alert added 119:95 for Content-Encoding chunked.
  • ipv6: fix flow label access method; thanks to schrx3b6 for the patch
  • loggers: remove units options; all limits expressed in MB
  • mpse: Remove Intel Soft CPM support
  • mpse: make regex capability generic
  • mpse: only use literals for fast patterns if search_method is not hyperscan
  • output: add packet trace feature
  • perf_monitor: fixed main table (perf_monitor) having same name as pegs for
  • perfmon field
  • regex: fix pass through of mpse flags to hyperscan
  • replace: do not trip over fast pattern only
  • rpc: revert to positional params, fix tcp logic, clean up formatting
  • rules: promote metadata:service to a separate option since it is not metadata
  • snort2lua: Fixed incorrect file names errors
  • snort2lua: move footprint to stream from stream_tcp
  • spell check: fix message and comment typos
  • stream: add ip_proto as part of flow key
  • stream: fix user dependency on flush bucket
  • text logs: fix default unlimited file size
  • u2: add event3 to u2spewfoo
  • u2: convert thread local buffers to heap
  • u2: deprecate ip4 and ip6 specific events and add a single event for both
  • u2: remove obsolete configurations
  • u2: support mixed IP versions
  • build: add support for appending EXTRABUILD to the BUILD string
  • build: Clean up some ICC 2017 warnings
  • build: clean up some GCC 7 warnings
  • build: support OpenSSL 1.1.0 API
  • build: clean up some cppcheck warnings
  • appid: port some missing 2.9.X FEAT_OPEN_APPID code
  • appid: fix thread-unsafe sharing of HTTP pattern tables
  • DAQ: fix leaking instance memory when configure fails
  • daq_hext and daq_file: pass PCI via query method
  • icmp6: reject non-ip6, raise 116:474
  • http_inspect: header normalization improvements
  • http_inspect: port fixes for UTF decoding
  • http_inspect: added 119:87 - 119:90 for expect / continue issues
  • http_inspect: added 119:91 for Transfer-Encoding header not valid for HTTP 1.0
  • http_inspect: added 119:92 for Content-Transfer-Encoding
  • http_inspect: added 119:93 for issues with chunked message trailers
  • PDF decompression: fix missing reset in state machine transition
  • ftp_server: implement splitter to improve EOF processing
  • port_scan: merge global settings into main module and other improvements
  • perf_monitor: add JSON formatter
  • ssl: add splitter to improve PDU processing
  • detection: fix segfault in DetectionEngine::idle sans thread_init
  • rules: tolerate spaces in positional parameters thanks to Joao Soares for reporting the issue
  • ip and tcp options: fix max length handling and clean up logging
  • cmg: improved alert formatting
  • doc: updates re control channel
  • snort2lua: added line number and file name to error output
  • snort2lua: fix removal of ignore_ports in stream_tcp.small_segments
  • snort2lua: fix heap-use-after-free for preprocessors and configs with no arguments
  • snort2lua: update for port_scan
  • appid: clean up shutdown stats
  • appid: fix memory leak
  • conf: update defaults
  • decode: updated ipv6 valid next headers
  • detection: avoid superfluous leaf nodes in detection option trees
  • http_inspect: improved handling of badly terminated chunks
  • http_inspect: improved transfer-encoding header processing
  • ips options: add validation for range check types such as dsize
  • perf_monitor: add more tcp and udp peg counts
  • perf_monitor: update cpu tracker output to thread_#.cpu_*
  • port_scan: alert on all scan attempts so blocking is possible
  • port_scan: make fully configurable
  • sip: fix get body buffer for fast patterns
  • ssl: use stop-and-wait splitter (protocol aware splitter is next)
  • stream_ip: fix 123:7
  • http_inspect: improve handling of improper bare r separator
  • appid: fix bug where TNS detector corrupted the flow data object
  • search_engine: set range for max_queue_events parameter thanks to [email protected] for reporting the issue
  • arp_spoof: reject non-ethernet packets
  • stream_ip: remove dead code and tweak formatting
  • ipproto: remove unreachable code
  • control_mgmt: add support for daq module reload
  • control_mgmt: add support for unix sockets
  • doc: update default manuals
  • doc: update differences section
  • doc: update README
  • byte_math: port rule option from 2X and add feature documentation
  • pgm: don't calculate checksum if header length is not divisible by 4
  • appid: fix sip event handling, http pattern lists, thread locals
  • build: fix issues with OpenSolaris and FreeBSD builds
  • cmake: fix issues with libpcap and miscellaneous
  • offload: refactor for initial (experimental) version of regex offload to other threads
  • cmg: revamp hex buffer dump format with 16 or 20 bytes per line
  • rules: reject positional parameters containing spaces
  • packet manager: ensure ether type proto ids don't masquerade as ip proto ids thanks to Bhargava Shastry for reporting the issue
  • codec manager: fix off-by-1 mapping array size thanks to Bhargava Shastry for reporting the issue
  • codec: fix extraction of ether type from cisco metadata
  • appid: add new unit tests to the cmake build, fix missing lib reference to sfip
  • sfghash: clean up and add unit tests
  • http: fix 119:38 false positive
  • main: fix compiler warnings when SHELL is not enabled
  • perf_monitor: fix flatbuffers handling of empty strings
  • modbus: port fix for false positives on length field
  • http: port simple UTF decoding w/o byte order mark
  • build: updated code to resolve cppcheck warnings
  • cleanup: fix typos in source code string literals and comments
  • doc: fix typos
  • build: clean up Intel compiler warnings and remarks
  • build: fix FreeBSD compilation issues
  • cmake: fix building with and without flatbuffers present
  • autoconf: check for lua.hpp as well as luajit.h to ensure C++ support
  • shell: make commands non-blocking
  • shell: allow multiple remote connections
  • snort2lua: fix generated stream_tcp bindings
  • snort2lua: fix basic error handling with non-conformant 2.X conf
  • decode: fix 116:402
  • dnp3: fix 145:5
  • appid: numerous fixes and cleanup
  • http_server: removed (use new http_inspect instead)
  • byte_jump: add bitmask and from_end (from 2.9.9 Snort)
  • byte_extract: add bitmask (from 2.9.9 Snort)
  • flatbuffers: add version to banner if present
  • loggers: build alert_sf_socket on all platforms
  • add decode of MPLS in IP
  • add 116:171 and 116:173 cases (label 0 or 2 in non-bottom of stack)
  • cleanup: remove dead code
  • require hyperscan >= 4.4.0, check runtime support thanks to [email protected] for submitting the patch
  • fix search tool issue with empty pattern database thanks to [email protected] for reporting the issue
  • fix sip_method to error out if sip not instantiated
  • major appid overhaul to address lingering concerns: refactor, cleanup, simplify
  • major detection overhaul to address lingering concerns: refactor, cleanup, release memory ASAP
  • add FlatBuffers output format to perf_monitor also added tool to convert FlatBuffers files to yaml
  • add regex.fast_pattern; do not use for fast pattern unless explicitly indicated
  • update copyrights to 2017
  • fixed mpse to ensure all search methods return consistent results
  • updated search tool to use fast pattern config's search method (benefits appid, http_inspect, imap, pop, and smtp)
  • snort2lua parsing bug fixes to recognize incomplete constructs
  • http_inspect: added alert 119:81 for nonprinting character in header name
  • http_inspect: added alert 119:82 for bad Content-Length value
  • http_inspect: added alert 119:83 for header wrapping; CR and LF parsed as whitespace

New in Snort 2.9.11 (Oct 14, 2017)

  • New additions:
  • Changes to eliminate Snort restart when there are changes to the memory allocated for preprocessors, by releasing unused or least recently used memory when needed.
  • Added support for storing filenames in Unicode for SMB protocol.
  • Added implementation of hostPortCache versioning for unknown flows in AppID to detect and block BitTorrent.
  • Improvements:
  • Enhanced RTSP metadata parsing to match the user-agent field to detect RTSP traffic over Windows Media.
  • Performance improvement when SYN rate limit has reached and drop is configured as next action
  • Control-socket and side-channel support for FreeBSD platform.
  • Fixed issue in file signature lookup for retransmitted FTP packet.
  • Enhanced the processing of SIP/RTP future flows without ignoring them.
  • Changes made in PDF/SWF decompression by adding boundary to the size of the decompressed data.
  • Added a null check to prevent copy unless debugHostIp is configured in AppId.
  • Fixed issue where FTP file type block doesn't work for retried download.
  • Resolved issue where Snort is inappropriately handling traffic for which AppId was creating future flow.
  • Performance improvements for SIP/RTP audio and video data flow in AppId.
  • Performance and stability improvements in FTP preprocessor like incorrect referencing of ftp_data_session after its pruned.
  • Stability improvement by resolving valgrind reported issues in AppId.
  • Improved flushing mechanism for HTTP POST header.
  • Added changes to display AppId for IPv6 unified events.
  • Fixed issues with printing of messages for out-of-order packets.
  • Fixed issue in increment of detection filter counter when rule is used in multiple configurations.
  • Fixed dynamic preprocessor compilation failure in OpenBSD platform.
  • Added changes to improve performance of ipvar list comparison.
  • Enhanced SMTP client detection by allowing line folding and all authentication methods.

New in Snort 2.9.11 Beta 1 (Aug 11, 2017)

  • New additions:
  • Changes to eliminate Snort restart when there are changes to the memory allocated for preprocessors, by releasing unused or least recently used memory when needed.
  • Improvements:
  • Enhanced RTSP metadata parsing to match the user-agent field to detect RTSP traffic over Windows Media.
  • Performance improvement when SYN rate limit has reached and drop is configured as next action
  • Control-socket and side-channel support for FreeBSD platform.
  • Fixed an issue where IoQ driver was getting into bad state due to non-graceful exit.
  • Fixed issue in file signature lookup for retransmitted FTP packet.
  • Enhanced the processing of SIP/RTP future flows without ignoring them.
  • Changes made in PDF/SWF decompression by adding boundary to the size of the decompressed data.
  • Added a null check to prevent copy unless debugHostIp is configured in AppId.
  • Fixed issue where FTP file type block doesn't work for retried download.
  • Resolved issue where Snort is inappropriately handling traffic for which AppId was creating future flow.
  • Performance improvements for SIP/RTP audio and video data flow in AppId.
  • Performance and stability improvements in FTP preprocessor like incorrect referencing of ftp_data_session after its pruned.
  • Stability improvement by resolving valgrind reported issues in AppId.
  • Improved flushing mechanism for HTTP POST header.

New in Snort 3.0.0 Build 228 Alpha 4 (Mar 3, 2017)

  • update hypercsan mpse: print error message and erroneous pattern when compilation fails
  • update rule parser: add multiple byte orders warning
  • fix pid file: create regardless of priv drop settings
  • fix dce_rpc: mark generated iface patterns as literal
  • snort2lua: mark appid conf and thirdparty_appid_dir as unsupported (temporary)
  • snort2lua: fix a couple of typos in table API output
  • snort2lua: fix sticky buffer following uricontent
  • doc: add DAQ configuration documentation
  • doc: move LibDAQ README to Reference, update, and fix typos
  • doc: update default manuals
  • allow arbitrary / unused gids in text rules
  • support DAQs w/o explicit sources (nfq, ipfw)
  • fix up peg help (remove _)
  • fix u2 logging of PDUs
  • add PDF/SWF decompression to http_inspect
  • add connectors to generated reference parts of manual
  • add feature documentation for HA, side_channel, and connectors
  • add feature documentation for http_inspect
  • update default manuals
  • fix privilege dropping and chroot behavior
  • fix perf_monitor segfault when tterm is called before tinit
  • fix stream_tcp counter underflow bug and handle max and instant stats
  • fix lzma length calculation bug
  • fix bogus 129:20 alerts
  • fix back orifice compiler warning with -O3
  • fix bug that could cause hang on ctl-C
  • fix memory leak after reload w/o changing search engine
  • fix off by one error when reassembling after TCP FIN received
  • fix cmake doc build to include plugins on SNORT_PLUGIN_PATH
  • fix compiler warnings in dce_http_server and dce_http_proxy
  • fix appid reload issue
  • snort2lua - changes for rpc over http
  • snort2lua - changes to convert config alertfile:
  • snort2lua - changes to add file_id when smb file inspection is on
  • snort2lua - add deprecated option stream5_tcp: log_asymmetric_traffic

New in Snort 2.9.9.0 (Feb 2, 2017)

  • NEW ADDITIONS:
  • New rule option for byte_math. See the Snort manual for details.
  • Added bitmask and from_end operations to byte_test. See the Snort manual for details.
  • Added a Buffer Dump utility to trace all of the buffers used by snort during inspection. Enable this by --enable-buffer-dump option to configure prior to building. See the Snort manual for details.
  • Added new HTTP preprocessor alerts to detect multiple content encoding and multiple content length.
  • Added support for SMTP Traffic detection over SSL (SMTPS).
  • IMPROVEMENTS:
  • Fixed an issue which reduces extra service discovery to improve performance.
  • Fixed mime data processing issue in SMTP stateless inspection.
  • Added support to decode packets that contains VLAN with Secure Group Tag (SGT).
  • Fixed Issue related to DLL-Load in Snort on windows platforms for CVE-2016-1417.
  • Fixed multiple issues in AppID:
  • Reconstructed the call to port-service detection.
  • Fixed issue where AppId for Facebook over SPDY/HTTP 1.1 was incorrect.
  • Preventing third-party application identification for expected connections.
  • Stability improvement for Stream preprocessor:
  • Addressed incorrect flushing of packets whose size is greater than MAXIMUM_PAF_MAX.
  • Fixed an issue where incorrect length argument in memcpy caused out of bound memory access.
  • Fixed multiple issues in HttpInspect preprocessor:
  • Handling chunk encoding followed by rrrn and nnnrrn.
  • Fixed an issue with LZMA flash decompression.

New in Snort 3.0.0 Build 225 Alpha 4 (Feb 2, 2017)

  • implement RPC over HTTP by adding dce_http_server and dce_http_proxy
  • port disable_replace option from snort 2.x and add snort2lua support
  • port ssh tunnel over http detection
  • fix stream splitter handling during final flush of session data
  • fix appid to use HTTP inspection events to detect webdav methods
  • fix unit test build to work w/o REG_TEST
  • fix shell to add missing newline to Lua execution error responses
  • fix support for content strings with escaped quotes ("foo"bar"). thanks to [email protected] for reporting the issue
  • fix various reload issues
  • fix various thread sanitizer issues
  • fix session disposal to always be after logging
  • fix appid pattern matching issues
  • fix appid dns flow counts
  • fix shell resume after command line --pause
  • fix sd_pattern validation boundary conditions
  • build: don't disable asserts when compiling with code coverage
  • autoconf: update to latest versions of autoconf-archive macros
  • main: add asynchronous, broadcastable analyzer commands
  • add salt to flow hash
  • normalize peg names to lower snake_case
  • update default manuals
  • fix various stream_tcp flush issues
  • fix various cmake issues
  • fix appid counting of kerberos flows
  • fix expected flow leak when expiring nodes during lookup. thanks to João Soares for reporting the issue
  • fix autoconf retrieving PCRE cppflags from pkg-config
  • fix stream_user reassembly
  • remove unused appid.thirdparty_appid_dir
  • build and install plugins as modules instead of libraries
  • obfuscate stream rebuilt payload
  • updates for latest zlib
  • disable smb2 processing when file service is disabled
  • refactor includes; prune the set of installed headers
  • don't build alert_sf_socket on OSX
  • added CPP flags used to build Snort to snort.pc for extras and other plugins to use

New in Snort 3.0.0 Build 223 Alpha 4 (Dec 24, 2016)

  • port 2983 smb active response updates
  • fix reload crash with file inspector
  • fix appid service dispatch handling issue thanks to João Soares for reporting the issue
  • fix paf-type flushing of single segments thanks to João Soares for reporting the issue
  • fix daemonization thanks to João Soares for reporting the issue
  • also fixes double counting of reassembled buffers
  • fix fallback from paf to atom splitter if flushing past gap
  • fix thread termination segfaults after DAQ module initialization fails
  • fix non-x86 builds - do not build tsc clock scaling
  • added appid to user manual features
  • update default user manuals
  • minor refactor of flush loop for clarity
  • improve http_inspect Field class
  • refactor plugin loading
  • add JavaScript Normalization to http_inspect
  • fix appid service check dispatch list
  • fix modbus_data handling to not skip options thanks to [email protected] for reporting the issue
  • fix sensitive data filtering documentation issues
  • build: Illumos build fixes
  • build: Address some cppcheck concerns
  • miscellaneous const tweaks
  • reformat builtin rule text for consistency
  • reformat help text for consistency
  • refactor user manual for clarity
  • update default user manuals
  • fix appid handling of sip inspection events
  • fix wizard to prevent use-after-free of service name
  • fix various issues reported by cppcheck
  • fix reload race condition
  • fix cmake + clang builds
  • add padding guards around hash key structs
  • update manual for dce_* inspectors
  • refactor IP address handling
  • fixed uu and qp decode issue
  • fixed file signature calculation for ftp
  • fixed file resume blocking
  • fix 135:2 to be upon completion of 3-way handshake
  • fix memory leak with libcrypto use
  • fix multithreaded use of libcrypto
  • fix default snort2lua output for gtp and modbus
  • fix Lua ordering issue with net and port vars
  • fix miscellaneous multithreading issues with appid
  • fix comment in snort.lua re install directory use; thanks to Yang Wang for sending the pull request
  • add alternate fast patterns for dce_udp endianness
  • removed underscores from all peg counts
  • document sensitive data use
  • user manual refactoring and updates
  • add dce auto detect to wizard
  • add MIME file processing to new http_inspect
  • add chapters on perf_monitor and file processing to user manual
  • appid refactoring and cleanup
  • many appid fixes for leaks, sanitizer, and analyzer issues
  • fix appid pattern matching for http
  • fix various race conditions reported by thread sanitizer
  • fix out-of-order FIN handling
  • fix cmake package name used in HS and HWLOC so that REQUIRED works
  • fix out-of-tree doc builds
  • fix image sizes to fit page; thanks to wyatuestc for reporting the issue
  • fix fast pattern selection when multiple designated thanks to [email protected] for reporting the issue
  • change -L to -K in README and manual; thanks to jncornett for reporting the issue
  • support compiling catch tests in standalone source files
  • create pid file after dropping privileges
  • improve detection and use of CppUTest in non-standard locations
  • fix shutdown stats
  • fix misc appid issues
  • rewrite appid loading of lua detectors
  • add sip inspector events for appid
  • update default manuals

New in Snort 2.9.9 RC 1 (Nov 14, 2016)

  • New additions:
  • Snort manual for Buffer Dump feature.
  • Snort manual for rule options - byte_math, bitmask and from_end.
  • Added new HTTP Preprocessor alerts.
  • Added SMTP detection to AppID.
  • Improvements:
  • Performance improvements to AppID.
  • Fixed multiple issue in AppID.
  • Stability improvement for Stream6 preprocessor.
  • Fixed multiple issues in HttpInspect preprocessor.
  • Fixed mime data processing issue in SMTP stateless inpection.
  • Able to decode packets that contains VLAN and SGT.
  • Fixed few issues in byte_math rule option.

New in Snort 3.0.0 Build 217 Alpha 4 (Oct 31, 2016)

  • update appid to 2983
  • add inspector events from http_inspect to appid
  • fix appid error messages
  • fix flow reinitialization after expiration
  • fix release of blocked flow
  • fix 129:16 false positive
  • add build configuration for thread sanitizer
  • port dce_udp fragments
  • build: clean up some ICC warnings
  • fix various unit test leaks
  • fix -Wmaybe-uninitialized issues
  • fix related to appid name with space and SSL position
  • added module trace facility
  • port block malware over ftp for clients/servers that support REST command
  • port dce_udp packet processing
  • change search_engine.debug_print_fast_pattern to show_fast_patterns
  • overhaul appid for multiple threads, memory leaks, and coding style
  • fix various appid patterns and counts
  • fix fast pattern selection
  • fix file hash pruning issue
  • fix rate_filter action config and apply_to clean up

New in Snort 3.0.0 Build 213 Alpha 4 (Sep 29, 2016)

  • ported full retransmit changes from snort 2X
  • fixed carved smb2 filenames
  • fixed multithread hyperscan mpse
  • fixed sd_pattern iterative validation
  • add dce udp snort2lua
  • add file detection when they are transferred in segments in SMB2
  • fix another case of CPPUTest header order issues
  • separate idle timeouts from session timeouts counts
  • close tcp on rst in close wait, closing, fin wait 1, and fin wait 2
  • doc: update style guide for 'using' statements and underscores
  • packet_capture: Include top-level pcap.h for backward compatibility
  • main: remove unused -w commandline option
  • lua: fix conflict with _L macro from ctype.h on OpenBSD
  • cmake: clean dead variables out of config.cmake.h
  • build: fix 32-bit compiler warnings
  • build: fix illumos/OpenSolaris build and remove SOLARIS/SUNOS defines
  • build: remove superfluous LINUX and MACOS definitions
  • build: remove superfluous OPENBSD and FREEBSD definitions
  • build: entering 'std' namespace should be after all headers are included
  • build: clean up u_int*_t usage
  • build: remove SPARC support
  • build: clean up some DAQ header inclusion creep.
  • fix hyperscan detection with nocase
  • fix shutdown sequence
  • fix --dirty-pig
  • fix FreeBSD build re appid / service_rpc
  • started dce_udp porting
  • added HA details to stream/* dev_notes
  • added stream.ip_frag_only to avoid tracking unwanted flows
  • updated default stream cache sizes to match 2.X
  • fixed tcp_connector_test for OSX build
  • fixed binder make files to include binder.h
  • fixed double counting of ip and udp timeouts and prunes
  • fixed clearing of SYN - RST flows
  • add dce iface fast pattern for tcp
  • add --enable-tsc-clock to build/use TSC register (on x86)
  • update latency to use ticks during runtime
  • tcp stream reassembly tweaks
  • fix inverted detection_filter logic
  • fix stream profile stats parents
  • fix most bogus gap counts
  • unit test fixes for high availability, hyperscan, and regex
  • fixed for TCP high availability
  • fixed install of file_decomp.h for consistency between Snort and extras
  • added smtp client counters and unit tests
  • ported Smbv2/3 file support
  • ported mpls encode fixes from 2983
  • cleaned up compiler warnings
  • ported smb file processing
  • ported the 2.9.8 ciscometadata decoder
  • ported the 2.9.8 double and triple vlan tagging changes
  • use sd_pattern as a fast-pattern
  • rewrite and fix the rpc option
  • cleanup fragbits option implementation
  • finish up cutover to the new http_inspect by default
  • added appid counts for rsync
  • added http_inspect alerts for Transfer-Encoding and Content-Encoding abuse
  • moved file capture to offload thread
  • numerous fixes, cleanup, and refactoring for appid
  • numerous fixes, cleanup, and refactoring for high availability
  • fixed regex as fast pattern with hyperscan mpse
  • fixed http_inspect and tcp valgrind errors
  • fixed extra auto build from dist

New in Snort 3.0.0 Build 206 Alpha 4 (Aug 12, 2016)

  • ported appid rule option as "appids"
  • moved http_inspect (old) to http_server (in extras)
  • moved new_http_inspect to http_inspect
  • added smtp.max_auth_command_line_len
  • fixed asn1:print help
  • fixed event queue buffer log size
  • fixed make distcheck; thanks to jack jackson for reporting the issue

New in Snort 2.9.9 Beta 1 (Jul 12, 2016)

  • NEW ADDITIONS:
  • Buffer Dump feature: Enable buffer dump feature with "--enable-buffer-dump" configure option.
  • Rule options - byte_math, bitmask and from_end.
  • HTTP/2 support: HTTP2 SUPPORT IS STILL EXPERIMENTAL.
  • By default, HTTP2 traffic is not supported. To enable it you need:
  • Install nghttp library from https://nghttp2.org/
  • If nghttp is not installed in default path, use with_libnghttp2_includes and with_libnghttp2_libraries to point to the correct path during "configure" step.
  • Enable HTTP2 support in http_inspect configuration with "legacy_mode no"
  • Refer README.http_inspect for details.
  • IMPROVEMENTS:
  • Performance improvements to AppID.
  • Fixed Flash LZMA decompression issue.
  • Added 802.11/wifi header support in ARP Preprocessor.
  • Stability improvement for Stream6 preprocessor.
  • Fixed multiple issues in HttpInspect preprocessor.
  • Fixed an issue of incorrect masking of sensitive data.

New in Snort 3.0.0 Build 201 Alpha 4 (Jun 26, 2016)

  • initial appid port - in progress
  • add configure --enable-hardened-build
  • add configure --pie (position independent executable)
  • add new_http_inspect alert for loss of sync
  • add peg counts for new_http_inspect
  • add peg counts for sd_pattern
  • add file_log inspector to log file events
  • add filename support to file daq
  • add high availability support for udp and icmp
  • add support for safe C library
  • continue porting of dce_rpc - smb transaction processing (part 2)
  • various snort2lua updates and fixes
  • fix default prime tables for internal hash functions
  • fix new_http_inspect bounds issues
  • fix icc warnings
  • miscellaneous cmake and auto tools build fixes
  • openssl is now a mandatory dependency

New in Snort 3.0.0 Build 200 Alpha 4 (Jun 26, 2016)

  • continued porting of dce_rpc - smb transaction processing
  • tweaked autotools build foo
  • add / update unit tests
  • fix additional memory leaks
  • fix compiler warnings
  • fix static analysis issues
  • fix handling of bpf file failures

New in Snort 3.0.0 Build 199 Alpha 4 (Jun 26, 2016)

  • add new http_inspect alerts abusive content-length and transfer-encodings
  • add b matching to sensitive data
  • add obfuscation for sensitive data
  • add support for unprivileged operation
  • fix link with dynamic DAQ
  • convert legacy allocations to memory manager for better memory profiling

New in Snort 3.0.0 Build 198 Alpha 4 (Jun 26, 2016)

  • add double-decoding to new_http_inspect
  • add obfuscation support for cmg and unified2
  • cleanup compiler warnings and memory leaks
  • fixup cmake builds
  • update file processing configuration
  • prevent profiler double counting on recursion
  • additional unit tests for high availability
  • fix multi-DAQ instance configuration

New in Snort 2.9.8.3 (Jun 22, 2016)

  • Improvements:
  • Stability improvement for Stream6 preprocessor
  • Fixed multiple issues in HttpInspect preprocessor
  • Fixed an issue of incorrect masking of sensitive data

New in Snort 3.0.0 Build 197 Alpha 4 (May 4, 2016)

  • fix build of extras
  • fix unit tests

New in Snort 3.0.0 Build 196 Alpha 4 (May 4, 2016)

  • overhaul cmake foo
  • update extras to better serve as examples
  • cleanup use of protocol numbers and identifiers
  • continued stream_tcp refactoring
  • continued dce2 port
  • more static analysis memory leak fixes

New in Snort 3.0.0 Build 195 Alpha 4 (May 4, 2016)

  • added packet_capture module
  • initial high availability for UDP
  • changed memory_manager to use absolute instead of relative cap
  • cmake and pkgconfig fixes
  • updated catch headers to v1.4.0
  • fix stream_tcp config leak
  • added file capture stats
  • static analysis updates
  • DAQ interface refactoring
  • perf_monitor refactoring
  • unicode map file for new_http_inspect

New in Snort 3.0.0 Build 194 Alpha 4 (May 4, 2016)

  • added iterative pruning for out of memory condition
  • added preemptive pruning to memory manager
  • dce segmentation changes
  • dce smb header checks port - non segmented packets
  • added thread timing stats to perf_monitor
  • fixed so rule input / output
  • fixed protocol numbering issues
  • fixed 129:18
  • update extra version to alpha 4 - thanks to Henry Luciano for reporting the issue
  • remove legacy/unused obfuscation api
  • fixed clang, gcc, and icc, build warnings
  • fixed static analysis issues
  • fixed memory leaks (more to go)
  • clean up hyperscan pkg-config and cmake logic

New in Snort 3.0.0 Build 193 Alpha 4 (May 4, 2016)

  • fix session parsing abort handling
  • fix shutdown memory leaks
  • fix building against LuaJIT using only pkg-config
  • fix FreeBSD build
  • perf_monitor config and format fixes
  • cmake - check all dependencies before fatal error
  • new_http_inspect unicode initialization bug fix
  • new_http_inspect %u encoding and utf 8 bare byte
  • continued tcp stream refactoring
  • legacy search engine cleanup
  • dcd2 port continued - add dce packet fragmentation
  • add configure --enable-address-sanitizer
  • add configure --enable-code-coverage
  • memory manager updates

New in Snort 3.0.0 Build 192 Alpha 4 (May 4, 2016)

  • use hwloc for CPU affinity
  • fix process stats output
  • add dce rule options iface, opnum, smb, stub_data, tcp
  • add dce option for byte_extract/jump/test
  • initial side channel and file connector for HA
  • continued memory manager implementation
  • add UTF-8 normalization for new_http_inspect
  • fix rule compilation for sticky buffers
  • host_cache and host_tracker config and stats updates
  • miscellaneous warning and lint cleanup
  • snort2Lua updates for preproc sensitive_data and sd_pattern option

New in Snort 2.9.8.2 (Mar 30, 2016)

  • New additions:
  • Future-flow and DNS API exposed to lua detector.
  • Double VLAN tagging support.
  • Improvements:
  • Performance improvements to AppID.
  • Stability improvements to file and ftp_telnet preprocessor.
  • Fixed several issues with SDF and obfuscation.
  • Resolved an issue of improper handling of malformed DNS host in AppID.
  • HTTP PAF accepts all tokens between method and version strings in a request URI.
  • Resolved snort build issue with "--disable-perfprofiling" configure option.
  • Enhanced mime parsing by adding support for detecting files after unknown headers and no headers.
  • Fixed issue with gzip decompression. If the server response specifies Content-Encoding as GZIP, but no Content-Length field for HTTP ver 1.0.
  • End of Header(EOH) identification for HTTP response header spanning multiple packets.
  • Improved packet reassembly for HTTP.
  • Fixed Flash LZMA decompression issue.

New in Snort 3.0.0 Build 191 Alpha 4 (Mar 8, 2016)

  • fix perf_monitor stats output at shutdown
  • initial port of sensitive data as a rule option
  • fix doc/online_manual.sh for linux
  • fix console close and remote control disconnect issues
  • added per-thread memcap calculation
  • add statistics counters to host_tracker module
  • new_http_inspect basic URI normalization with configuration options
  • format string cleanup for parser logging
  • fix conf reload by signal
  • snort2lua for dce2 port (in progress)
  • replace ppm with latency
  • added rule latency
  • fixed more address sanitizer bugs
  • fixed use of debug vs debug-msgs
  • add missing ips option hash and == methods
  • perf_monitor configuration
  • fix linux + clang build errors
  • trough rewrite
  • added delete/delete[] replacements for nothrow overload. thanks to Ramya Potluri for reporting the issue
  • fixed a detection option comparison bug which wasted time and space
  • disable perf_monitor by default since the reporting interval should be set
  • memory manager updates
  • valgrind and unsanitary address fixes
  • snort2lua updates for dce2
  • build issue fix - make non-GNU strerror_r() the default case
  • packet latency updates
  • perfmon updates
  • file capture added - initial version writes from packet thread
  • added support for http 0.9 to new_http_inspect
  • added URI normalization of headers, cookies, and post bodies to new_http_inspect
  • configure_cmake.sh updates to better support scripting
  • updated catch header (used for some unit tests)
  • continued dce2 port
  • fixed misc clang and dynamic plugin build issues
  • fixed static analysis issues and crash in new_http_inspect
  • fixed tcp paws issue
  • fixed normalization stats
  • fixed issues reported by Bill Parker
  • refactoring updates to tcp session
  • refactoring updates to profiler

New in Snort 3.0.0 Build 186 Alpha 4 (Feb 2, 2016)

  • update copyright to 2016, add missing license blocks
  • fix xcode builds
  • fix static analysis issues
  • update default manuals
  • host_module and host_tracker updates
  • start perf_monitor rewrite - 1st of many updates
  • start dce2 port - 1st of many updates
  • remove --enable-ppm - always enabled

New in Snort 3.0.0 Build 182 Alpha 3 (Dec 14, 2015)

  • added memory profiling feature
  • added regex fast pattern support
  • ported reputation preprocessor from 2X
  • synced to 297-262
  • removed '_q' search method flavors - all are now queued
  • removed PPM_TEST
  • build and memory leak fixes
  • perf profiling enhancements
  • fixed build issues and memory leaks
  • continued pattern match refactoring
  • fix spurious sip_method matching
  • ported dnp3 preprocessor and rule options from 2.X
  • fixed various valgrind issues with stats from sip, imap, pop, and smtp
  • fixed captured length of some icmp6 types
  • added support for hyperscan search method using rule contents (regex to follow)
  • fixed various log pcap issues
  • squelch repeated ip6 ooo extensions and bad options per packet
  • fixed arp inspection bug
  • user manaul updates
  • fix perf_monitor.max_file_size default to work on 32-bit systems, thanks to [email protected] for reporting the issue
  • fix bogus 116:431 events
  • decode past excess ip6 extensions and bad options
  • add iface to alert_csv.fields
  • add hyperscan fast pattern search engine - functional but not yet used
  • remove --enable-perf-profiling so it is always built
  • perf profiling changes in preparation for memory profiling
  • remove obsolete LibDAQ preprocessor conditionals
  • fix arp inspection
  • search engine refactoring
  • document runtime link issue with hyperscan on osx
  • fix pathname generation for event trace file
  • new_http_inspect tweaks
  • remove --enable-ppm-test
  • sync up auto tools and cmake build options

New in Snort 2.9.8.0 (Dec 1, 2015)

  • New additions:
  • SMBv2/SMBv3 support for file inspection.
  • Port override for metadata service in IPS rules.
  • AppID Lua detector performance profiling.
  • Perfmon dumps stats at fixed intervals from absolute time.
  • New preprocessor alert (120:18) to detect SSH tunneling over HTTP
  • New config option |disable_replace| to disable replace rule option.
  • New Stream configuration |log_asymmetric_traffic| to control logging to syslog.
  • New shell script in tools to create simple Lua detectors for AppID.
  • Improvements:
  • sfip_t refactored to use struct in6_addr for all ip addresses.
  • Post-detection callback for preprocessors.
  • AppID support for multiple server/client detectors evaluating on same flow.
  • AppID API for DNS packets.
  • Memory optimizations throughout.
  • Support sending UDP active responses.
  • Fix perfmon tracking of pruned packets.
  • Stability improvements for AppID.
  • Stability improvements for Stream6 preprocessor.
  • Added improved support to block malware in FTP preprocessor.
  • Added support to differentiate between active and passive FTP connections.
  • Improvements done in Stream6 preprocessor to avoid having duplicate packets in the DAQ retry queue.
  • Resolved an issue where reputation config incorrectly displayed 'blacklist' in priority field even though 'whitelist' option was configured.
  • Added support for multiple expected sessions created per packet
  • Active response now supports MPLS

New in Snort 3.0.0 Build 177 Alpha 2 (Nov 6, 2015)

  • idle processing cleanup
  • fixed teredo payload detection
  • new_http_inspect cleanup
  • update old http_inspect to allow spaces in uri
  • added null check suggest by Bill Parker
  • fix cmake for hyperscan
  • ssl and dns stats updates
  • fix ppm config
  • miscellanous code cleanup
  • tcp reassembly refactoring
  • profiler rewrite
  • added gzip support to new_http_inspect
  • added regex rule option based on hyperscan
  • ported gtp preprocessor and rule options from 2.X
  • ported modbus preprocessor and rule options from 2.X
  • fixed 116:297
  • added unit test build for cmake (already in autotools builds)
  • fixed dynamic builds (187 plugins, 138 dynamic)
  • legacy daemonization cleanup
  • decouple -D, -M, -q
  • delete -E
  • initial rewrite of profiler
  • don't create pid file unless requested
  • remove pid lock file
  • new_http_inspect header processing, normalization, and decompression tweaks
  • convert README to markdown for pretty github rendering (contributed by [email protected])
  • perfmonitor fixes
  • ssl stats updates
  • added pkt_num rule option to extras
  • fix final -> finalize changes for extras
  • moved alert_unixsock and log_null to extras
  • removed duplicate pat_stats source from extras
  • prevent tcp session restart on rebuilt packets thanks to rmkml for reporting the issue
  • fixed profiler configuration
  • fixed ppm event logging
  • added filename to reload commands
  • fixed -B switch
  • reverted tcp syn only logic to match 2X
  • ensure ip6 extension decoder state is reset for ip4 too since ip4 packets may have ip6 next proto
  • update default manuals

New in Snort 3.0.0 Build 172 Alpha 1 (Oct 2, 2015)

  • Bug Fixes:
  • apply ppm.fastpath config correctly
  • fix file_decomp error logic
  • enable active response without flow
  • fix metadata:service to work like 2x
  • fixed issues when building with LINUX_SMP
  • fixed frag tracker accounting
  • fix Xcode builds
  • don't apply cooked verdicts to raw packets
  • fixed build error with valgrind build option
  • fix breakloop in file daq
  • fix plain file processing
  • fix detection of stream_user and stream_file data
  • fix chunked manual install
  • fix OpenBSD build
  • fix dev guide builds from top_srcdir
  • fixed build of chunked manual (thanks to Bill Parker for reporting the issue)
  • fixed cmake build issue with SMP stats enabled
  • fixed compiler warnings
  • fixed u2spewfoo build issue
  • dns bug fix for tcp
  • Doc Updates:
  • update manual related to liblzma
  • update bug list
  • update where to get dnet
  • update usage
  • Build Changes:
  • move extra daqs and extra hext logger to main source tree
  • move non-ethernet codecs to extras
  • removed unused control socket defines from cmake
  • cleanup *FLAGS use in configure.ac
  • change configure.ac compiler search order to prefer clang over gcc
  • Test Changes:
  • convert check unit tests to catch
  • added --catch-tags [footag],[bartag] for unit test selection
  • add cpputest for unit testing
  • Other Changes:
  • implement 116:281 decoder rule
  • updated snort2lua
  • log innermost proto for type of broken packets
  • new_http_inspect cookie processing updates
  • updated error messages in u2spewfoo
  • added strdup sanity checks (thanks to Bill Parker for reporting the issue)

New in Snort 2.9.7.6 (Oct 1, 2015)

  • New additions:
  • Added support for detecting 'SSH tunneling over HTTP'.
  • Improvements:
  • Behavioral change in file processing to block malware files in inline-test mode also.
  • Improvements to XFF handling in case of pipelined HTTP requests.
  • Stability improvements for Stream6 preprocessor.
  • Resolved an issue where min_ttl decoder was dropping packets in alert mode also.
  • Added improved support to inspect unlimited packets in HTTP.
  • Resolved an issue where reputation config incorrectly displayed 'blacklist' in priority field even though 'whitelist' option was configured.

New in Snort 3.0.0 Build 167 Alpha 2 (Sep 10, 2015)

  • Fix xcode warnings

New in Snort 2.9.8.0 Beta 1 (Aug 17, 2015)

  • New additions:
  • AppID is no longer experimental.
  • SMBv2/SMBv3 support for file inspection.
  • Port override for metadata service in IPS rules.
  • AppID Lua detector performance profiling.
  • Perfmon dumps stats at fixed intervals from absolute time.
  • New preprocessor alert (18:120) to detect SSH tunneling over HTTP
  • New config option |disable_replace| to disable replace rule option.
  • New Stream configraution |log_asymmetric_traffic| to control logging to syslog.
  • New shell script in tools to create simple Lua detetors for AppID.
  • Improvements:
  • sfip_t refactored to use struct in6_addr for all ip addresses.
  • Post-detection callback for preprocessors.
  • AppID support for multiple server/client detectors evaluting on same flow.
  • AppID API for DNS packets.
  • Memory optimizations throughout.
  • Support sending UDP active responses.
  • Fix permon tracking of pruned packets.
  • Improved support for expected sessions.

New in Snort 3.0.0 Build 163 Alpha 2 (Aug 15, 2015)

  • numerous piglet fixes and enhancements
  • BitOp rewrite
  • added more private IP address
  • fixed endianness in private IP address check
  • fix build of dynamic plugins

New in Snort 2.9.7.5 (Jul 24, 2015)

  • Improvements:
  • Added improved support to the Stream preprocessor for asynchronous TCP traffic.
  • Active response no longer sets the FIN flag on the last segment sent.

New in Snort 3.0.0 Build 160 Alpha 2 (Jul 7, 2015)

  • fixed duplicate patterns in file_magic.lua
  • warn about rules with no fast pattern
  • warn if file rule has no file_data fp
  • run fast patterns according to packet type
  • update / expand shutdown output for detection
  • binder sets service from inspector if not set
  • allow abbreviated rule headers
  • fix cmake build on linux w/o asciidoc
  • add bugs list to manual
  • fix memory leaks
  • fix valgrind issues
  • fix xcode analyzer issues

New in Snort 3.0.0 Build 155 Alpha 1 (Jun 2, 2015)

  • New Features:
  • ported smtp inspector from Snort
  • ported file capture from Snort
  • added file_magic.lua
  • added socket DAQ to input payload only with flow tuple
  • added hext DAQ to for packet input in hex and plain text
  • added file DAQ for plain file input (w/o packets)
  • added socket codec for use with above DAQs
  • added stream_user for payload only processing
  • added stream_file for file inspection and processing
  • Enhancements:
  • changed new_http_inspect parsing and event handling
  • changed stream_tcp to reassemble payload only
  • changed -K to -L (log type)
  • changed hex dumps to 20 hex bytes per line instead of 16
  • rewrote alert_csv with all new default format
  • Bug fixes:
  • fixed dns inspector typo for tcp checks
  • fixed config error for inspection of rebuilt packets
  • fixed autotools build of manual wrt plugins
  • fixed xcode static analysis issues
  • fixed other misc bugs
  • Other Changes:
  • updated default manuals
  • updated usage from blog
  • updated unified2 to support data only packets
  • deleted alert_test
  • deleted obsolete REG_TEST logging

New in Snort 3.0.0 Build 150 Alpha 1 (May 1, 2015)

  • fixed xcode static analysis issues
  • updated default manuals
  • added packet processing section to manual
  • additional refactoring and cleanup
  • fix http_inspect mpse search
  • fixed urg rule option
  • change daq.var to daq.vars to support multiple params reported by Sancho Panza
  • ensure unknown sources are analyzed
  • pop and imap inspectors ported
  • fixed build issue with extras
  • fixed default validation issue reported by Sancho Panza
  • refactored snort and snort_config modules
  • file id refactoring and cleanup
  • added publish-subscribe handling of data events
  • added data_log plugin example for pub-sub
  • change PT_DATA to IT_PASSIVE; supports named instances, reload, and consumers
  • added build of snort_manual.text if w3m is installed
  • added default_snort_manual.text w/o w3m
  • add Flow pointer to StreamSplitter::finish()
  • nhttp clear() and related changes
  • abort PAF in current direction only
  • added StreamSplitter::finish()
  • allow relative flush point of zero
  • added Inspector::clear()
  • new http refactoring and cleanup
  • new http changes - events from splitter
  • fix dns assertion; remove unused variables

New in Snort 3.0.0 Build 144 Alpha 1 (Apr 1, 2015)

  • New features:
  • ported dns inspector
  • ported ssh inspector
  • added doc/usage.txt
  • Bug fixes and enhancements:
  • reworked autotools generation of api_options.h
  • updated default manuals
  • apply service from hosts when inspector already bound to flow
  • ensure direction and service are applied to packet regardless of flow state
  • enable active for react / reject only if used in configuration
  • eliminate dedicated nhttp chunk buffer
  • minor nhttp cleanup in StreamSplitter
  • fixed host lookup issue
  • folded classification.lua and reference.lua into snort_defaults.lua
  • apply defaults from parameter tables instead of relying on ctors etc.
  • fix static analysis issues reported by xcode
  • change policy names with a-b form to a_b for consistency
  • make all warnings optional
  • fix ip and tcp policy defines
  • fix ip and icmp flow client/server ip init
  • added build foo for lzma; refactored configure.ac
  • enhancements for checking compatibility of external plugins

New in Snort 2.9.7.2 (Mar 13, 2015)

  • New additions:
  • Application Identification Preprocessor, when used in conjunction with open app ID detector content, that will identify application protocol, client, server, and web applications (including those using SSL) and include the info in Snort alert data. In addition, a new rule option keyword 'appid' that can be used to constrain Snort rules based on one or more applications that are identified for the connection. See README.appid for details.
  • A new protected_content rule option that is used to match against a content that is hashed. It can be used to obscure the full context of the rule from the administrator.
  • Protocol Aware Flushing (PAF) improvements for SMTP, POP, and IMAP to more accurately process different portions of email messages and file attachments.
  • Added ability to test normalization behavior without modifying network traffic. When configured using na_policy_mode:inline-test, statistics will be gathered on packet normalizations that would have occurred, allowing less disruptive testing of inline deployments.
  • The HTTP Inspection preprocessor now has the ability to decompress DEFLATE and LZMA compressed flash content and DEFLATE compressed PDF content from http responses when configured with the new decompress_swf and decompress_pdf options. This enhancement can be used with existing rule options that already match against decompressed equivalents.
  • Added improved XFF support to HttpInspect. It is now possible to specify custom HTTP headers to use in place of 'X-Fowarded-For'. In situations where traffic may contain multiple XFF-like headers, it is possible to specify which headers hold precedence.
  • Added control socket command to dump packets.
  • The Stream5 preprocessor functionality is now split between the new Session and Stream preprocessors.
  • Added decoding capability for Cisco FabricPath
  • Improvements:
  • Update active response to allow for responses of 1500+ bytes that span multiple TCP packets.
  • Check limits of multiple configurations to not exceed a maximum ID of 4095.
  • Updated the error output of byte_test, byte_jump, byte_extract to including details on offending options for a given rule.
  • Update build and install scripts to install preprocessor and engine libraries into user specified libdir.
  • Improved performance of IP Reputation preprocessor.
  • The control socket will now report success when reloading empty IP Reputation whitelists/blacklists.
  • All TCP normalizations can now be enabled individually. See README.normalize for details on using the new options. For consistency with other options, the "urp" tcp normalization keyword now enables the normalization instead of disabling it.
  • Lowered memory demand of Unicode -> ASCII mapping in HttpInspect.
  • Updated profiler output to remove duplicate results when using multiple configurations.
  • Improved performance of FTP reassembly.
  • Improved compatibility with Mac OS X 10.9 (Mavericks), OpenBSD, FreeBSD, and DragonFlyBSD

New in Snort 3.0.0 Build 140 Alpha 1 (Mar 3, 2015)

  • uncrustify, see crusty.cfg
  • updated documentation on new HTTP inspector, binder, and wizard
  • additional http_inspect cleanup
  • documented gotcha regarding rule variable definitions in Lua
  • sync 297 http xff, swf, and pdf updates
  • sync ftp with 297; replace stream event callbacks with FlowData virtuals
  • updated manual from blog posts and emails
  • normalization refactoring, renaming
  • fixed icmp4 encoding
  • methods in codec_events and ip_util namespaces are now protected Codec methods
  • 297 sync of active and codecs
  • fix up encoders
  • sync stream with 297
  • fix encoder check for ip6 extensions
  • sync normalizations with 297

New in Snort 3.0.0 Build 135 Alpha 1 (Jan 30, 2015)

  • fix default hi profile name
  • updated default snort manuals

New in Snort 3.0.0 Build 130 Alpha 1 (Jan 30, 2015)

  • User-friendly design:
  • We wanted to make it as easy as possible for people to learn and run Snort – that means no more configuring memory, ports, arguments, etc.
  • Built-in Documentation
  • Built-in configuration
  • Error and Multi error support
  • Verification of configuration on startup (no more having to run “-T” for test mode)
  • Simpler rule language:
  • We’re making it simpler to write rules.
  • Sticky buffers
  • Custom http buffers
  • Auto-Detection of all protocols
  • Command Line Shell:
  • Secured to localhost
  • Allows someone to reload a configuration
  • Allows you to pause and resume detection
  • Multithreaded and Multi-core:
  • All new design for multithreading, maintaining a single persistent configuration for many threads.

New in Snort 2.9.7.0 (Oct 28, 2014)

  • updating build number to 149 - src/build.h
  • Fixed issue in which AppID would be disabled after a reload - src/dynamic-preprocessors/appid/spp_appid.c
  • Added dependency for OpenSSL when building with --enable-openappid
  • doc/:README.http_inspect, snort_manual.pdf, snort_manual.tex - configure.in
  • Added documentation for the new Extended X-Forwarded-For capabilities
  • Reused the TcpSessionCleanup logic to add a function to flush queued unacked segments - src/preprocessors/Stream6/snort_stream_tcp.c

New in Snort 2.9.5.5 (Sep 23, 2013)

  • src/preprocessors/Stream5/snort_stream5_tcp.c: disable all detection (not just content-base) for packets on previously blocked sessions
  • src/preprocessors/perf.c: Write perfmon entry when both packet count and time conditions are met, rather than waiting for a multiple of the packet count after the time is reached.
  • src/dynamic-preprocessors/smtp/snort_smtp.c: Stop inspection of the entire session when TLS data is present with ignore_tls_data enabled in SMTP - Check for midstream pickups and gaps when we miss server hello, and stop inspection as soon as we get client hello when ignore_tls_data is turned on
  • src/dynamic-plugins/sf_engine/sf_snort_plugin_pcre.c: changed pcre relative match with HTTP buffers to be not allowed in .so rules (same as in text rules)

New in Snort 2.9.5 (Jul 4, 2013)

  • New additions:
  • Added tracking of FTP data channel for file transfers as file_data for Snort rules.
  • Add support for doing PAF based on services loaded thru the attribute table and hardened PAF code/removed --disable-paf
  • Added decoding support for Cisco ERSPAN
  • Added tracking of HTTP uploads as file_data for Snort rules.
  • Added ability to use event filters with PPM rules
  • Added a control channel command to reload the Snort configuration to give feedback on new configuration. This improves on the older sigHUP which would just result in Snort exiting and restarting if the new configuration required a restart.
  • Added a configuration option to perfmon to write flow-ip data to a file
  • New decoding alert for IPv6 Routing type 0 header.
  • Added the ability to sync basic session state from one Snort to another via a side channel communication between the two Snort instances. NOTE: This is currently experimental.
  • Improvements:
  • Improved Stream's midstream pickup handling for TCP state processing, sequence validation, and reassembly.
  • Improved HTTP PAF reassembly capabilities to be better aligned on PDU boundaries, terminate if not actually HTTP, and to include all appropriate line feeds.
  • Hardened the code related to dynamic modules. Removed --disable-dynamicplugin configuration option since rule and preprocessor shared libraries are here to stay.
  • Added a parse error for a rule if there is a relative content used after a content that is 'fast_pattern only'.
  • Improved parsing of IP lists for reputation
  • Update to Teredo processing and Snort rule evaluation when the inner IPv6 packet doesn't have payload
  • Improved logging of packets associated with alerts when a Stream reassembled packet triggers multiple Snort rules.
  • Improvements to the Snort manual including documentation of specific rule options and configuration items.
  • Removed a bunch of dead code paths, updated to use more current memory functions for easier code maintenance and portability.
  • Deletions:
  • Remove deprecated unified support, use unified2 for all of your logging needs.

New in Snort 2.9.4.6 (Apr 25, 2013)

  • Improvements:
  • Improved support for DAQ verdicts of whitelist and blacklist for 6in4 and 4in6 encapsulated traffic (similar to Teredo & GTP). See the Snort manual for configuration details.
  • Avoid changing the length of IP options in frag3 when receiving duplicate 0-offset fragments that have IP options.

New in Snort 2.9.4.5 (Apr 11, 2013)

  • Improvements:
  • Removed proxy information from normalized HTTP Uri to enable correct matching of patterns.
  • Update to log packets to unified2 across all alerts on stream reassembled packets.

New in Snort 2.9.4.1 (Mar 6, 2013)

  • Improvements:
  • Updated File processing for partial HTTP content and MIME attachments.
  • Addition of new config option max_attribute_services_per_host and improve memory usage within attribute table.
  • Handle excessive overlaps in frag3.
  • Stream API updates to return session key for a session.
  • Reduce false positives for TCP window slam events.
  • Updates to provide better encoding for TCP packets generated for respond and react.
  • Disable non-ethernet decoders by default for performance reasons.
  • If needed, use --enable-non-ether-decoders with configure.

New in Snort 2.9.4.0 (Dec 8, 2012)

  • New additions:
  • Consolidation of IPv6 -- now only a single build supports both IPv4 & IPv6, and removal of the IPv4 "only" code paths.
  • File API and improvements to file processing for HTTP downloads and email attachments via SMTP, POP, and IMAP to facilitate broader file support
  • Use of address space ID for tracking Frag & Stream connections when it is available with the DAQ
  • Logging of packet data that triggers PPM for post-analysis via Snort event
  • Decoding of IPv6 with PPPoE
  • Add an API call to add a service to a host in the attribute map. Remove the unused live attribute map.
  • Improvements:
  • Update to Stream5 PAF for handling gaps in the sequence numbers of packets being reassembled.
  • Selection of the Stream TCP policy based on the server rather than the destination of first packet seen by Snort
  • Allow disabling of global thresholds via a count of -1
  • Prevent blocking duplicate SYNs when using inline normalization
  • Add SSLv3 backwards compatibility support for SSLv2 ClientHello messages
  • Allow active responses to packets without data (eg, a TCP SYN)
  • Changed logic of option evaluations for shared library rules that use a custom evaluation function to match that of the builtin logic when the NOT_FLAG is used. The 'NOT' matching now happens within each of the individual rule option evaluation functions.
  • Updated SMTP preprocessor to better handle commands that have corresponding data on a subsequent line to reduce false positives. 3 commands fall into this category - X-EXPS, XEXCH50, and BDAT.
  • Improve support for encapsulated & tunneling protocols to block or fastpath a connection within the tunnel rather applying that to the whole tunnel.

New in Snort 2.9.3.1 (Aug 11, 2012)

  • src/build.h:
  • Updated build number to 40
  • src/sfutil/acsmx2.c:
  • Release memory during return.
  • src/dynamic-preprocessors/sip/sip_config.c:
  • Free method struct when method->methodName is NULL.
  • src/: detection-plugins/detection_options.c,
  • detection-plugins/sp_byte_check.c,
  • detection-plugins/sp_byte_extract.c,
  • detection-plugins/sp_byte_jump.c, dynamic-plugins/sp_dynamic.c,
  • dynamic-plugins/sp_preprocopt.c:
  • Fix constant expression in hashing routines for 64bit platforms.
  • src/dynamic-preprocessors/dcerpc2/dce2_smb.c:
  • Fix Samba chained OpenAndX -> Write command handling.
  • src/active.c:
  • Check for TCP RST flag regardless of other flags to block resetting
  • resets.
  • src/: active.c, decode.c, detection-plugins/sp_pcre.c,
  • dynamic-plugins/sf_convert_dynamic.c,
  • dynamic-plugins/sf_dynamic_plugins.c,
  • dynamic-plugins/sf_dynamic_preprocessor.h,
  • dynamic-plugins/sp_dynamic.c,
  • dynamic-preprocessors/dnp3/dnp3_map.c,
  • dynamic-preprocessors/reputation/reputation_config.c,
  • dynamic-preprocessors/sdf/spp_sdf.c,
  • dynamic-preprocessors/sip/sip_config.c,
  • dynamic-preprocessors/sip/sip_roptions.c,
  • dynamic-preprocessors/smtp/spp_smtp.c,
  • output-plugins/spo_alert_unixsock.c,
  • preprocessors/spp_httpinspect.c, preprocessors/spp_perfmonitor.c,
  • preprocessors/HttpInspect/client/hi_client.c,
  • preprocessors/HttpInspect/server/hi_server.c,
  • sfutil/bnfa_search.c, sfutil/sf_iph.c,
  • target-based/sf_attribute_table_parser.l:
  • Parse time memory cleanup
  • src/dynamic-preprocessors/dcerpc2/dce2_utils.h:
  • Fixed issue on big endian systems where behaviour was incorrect.

New in Snort 2.9.3.0 (Jul 21, 2012)

  • Updates to http_inspect client PAF handling and server flow_depth handling.
  • Logging updates to the smtp preprocessor.

New in Snort 2.9.2.3 (May 17, 2012)

  • Update to GTP preprocessor to better handle GTPv1 data.
  • Update to DNP3 preprocessor to add stricter checking on packets before processing by dnp3. Improved checking on reassembly buffer
  • Update to PCRE rule option processing to prevent issues seen w/ libpcre-8.30 and certain rules.
  • Update to dcerpc2 to not abort reassembly if target-based protocol is undefined.

New in Snort 2.9.2.2 (Mar 29, 2012)

  • Improvements:
  • Updates to HTTP Inspect to handle normalization with large number of directories, eliminate false positives when chunks span multiple packets, and remove the upper limit on the gzip memcap.
  • Update stream handling for TCP session cleanup with RSTs and other TCP state tracking.
  • Update for responses to fragmented IPv6 traffic and to the react page configuration.
  • Updates SIP preprocessor to limit false positives.
  • Update for correct logging in unified2 when interface is passive.
  • Add stats for SMTP preprocessor at termination.
  • State tracking improvements to SMB processing in the dcerpc2 preprocessor when missing packets on a session.

New in Snort 2.9.2.1 (Jan 24, 2012)

  • New Additions:
  • Added new alerts for HTTP (undefined methods & HTTP 0.9 simple requests).
  • Improvements:
  • Updates to Stream preprocessor in TCP session tracking to avoid requeuing retransmitted data that was already flushed. Also varies tweaks for PAF flushing.
  • Updates to reputation preprocessor to handle shared memory switching.
  • Updates to the SCADA preprocessors in handling PAF flushing and modbus request/response length checking. Also tweaks in alert for reserved DNP3 functions.
  • Updates to flowbit groups to always use the group when some rules refer to a flow group while others do not refer to a group for the same flowbit.
  • Updates to GTP preprocessor to check invalid extension header length for GTPv1.
  • Updates to sfrt library in calculating memory allocated and support for IPv6.

New in Snort 2.9.2 (Dec 16, 2011)

  • New Additions:
  • SCADA (DNP3 and Modbus) preprocessors. Added two new preprocessors to support writing rules for detecting attacks for control systems. New rule keywords are supported, and DNP3 leverages Stream5 PAF support for TCP reassembly. See the Snort Manual, README.dnp3 and README.modbus for details of the configurations and new rule options.
  • GTP decoding and preprocessor. Updated the Snort packet decoders and added a preprocessor to support detecting attacks over GTP (GPRS Tunneling Protocol). Snort's GTP support handles multiple versions of GTP and has a rich configuration set. See the Snort Manual and README.GTP for details.
  • Updates to the HTTP preprocessor to normalize HTTP responses that include javascript escaped data in the HTTP response body. This expands Snort's coverage in detecting HTTP client-side attacks. See the Snort Manual and README.http_inspect for configuration details.
  • Added Protocol-Aware Flushing (PAF) support for FTP.
  • Improvements:
  • Updates to Stream preprocessor to be able to track and store "stream" data for non TCP/UDP flows. Also improvements to handle when memory associated with a blocked stream is released and usable for other connections.
  • Updates to dce_stub_data to make it act the same as file_data and pkt_data rule option keywords in how it interacts with subsequent content/pcre/etc rule options.
  • Updates to how Snort handles and processes signals received from the OS.
  • Enabled logging of normalized JavaScript to unified2 without the use of the --enable-sourcefire configuration option.
  • Improved handling of gaps and overlaps for "first" and "vista" policies in Stream5.
  • Added support for signal handler customization. At compile-time, Snort can be customized to use different signal numbers. This allows problems with overlapping signals to be fixed on a per-platform basis, which is especially helpful for the BSDs. See the Snort Manual for more details.
  • Perfmonitor's output files ("now" files) are now created after Snort drops privileges. Output files will now be owned by the user and group specified with "-u" and "-g" at the command line.

New in Snort 2.9.2 RC (Dec 8, 2011)

  • New Additions:
  • SCADA (DNP3 and Modbus) preprocessors. Added two new preprocessors to support writing rules for detecting attacks for control systems. New rule keywords are supported, and DNP3 leverages Stream5 PAF support for TCP reassembly. See the Snort Manual, README.dnp3 and README.modbus for details of the configurations and new rule options.
  • GTP decoding and preprocessor. Updated the Snort packet decoders and added a preprocessor to support detecting attacks over GTP (GPRS Tunneling Protocol). Snort's GTP support handles multiple versions of GTP and has a rich configuration set. See the Snort Manual and README.GTP for details.
  • Updates to the HTTP preprocessor to normalize HTTP responses that include javascript escaped data in the HTTP response body. This expands Snort's coverage in detecting HTTP client-side attacks. See the Snort Manual and README.http_inspect for configuration details.
  • Added Protocol-Aware Flushing (PAF) support for FTP.
  • Improvements:
  • Updates to Stream preprocessor to be able to track and store "stream" data for non TCP/UDP flows. Also improvements to handle when memory associated with a blocked stream is released and usable for other connections.
  • Updates to dce_stub_data to make it act the same as file_data and pkt_data rule option keywords in how it interacts with subsequent content/pcre/etc rule options.
  • Updates to how Snort handles and processes signals received from the OS.
  • Enabled logging of normalized JavaScript to unified2 without the use of the --enable-sourcefire configuration option.
  • Improved handling of gaps and overlaps for "first" and "vista" policies in Stream5.
  • Added support for signal handler customization. At compile-time, Snort can be customized to use different signal numbers. This allows problems with overlapping signals to be fixed on a per-platform basis, which is especially helpful for the BSDs. See the Snort Manual for more details.

New in Snort 2.9.1.2 (Dec 8, 2011)

  • Improvements:
  • Fixed an issue where Snort would sometimes stop processing traffic in a persistent HTTP 1.1 connection with a UTF-32 encoded response followed by a UTF-16 encoded response.

New in Snort 2.9.1 (Aug 30, 2011)

  • New Additions:
  • HTTP aware TCP reassembly support within HTTP Inspect andStream5, allowing Snort to more intelligently inspect HTTPrequests and responses.See README.stream5 subsectionrelated to Protocol Aware Flushing (PAF).
  • SIP preprocessor to identify SIP call channels and providerule access via new rule option keywords.See the SnortManual and README.sip for details.
  • POP3 & IMAP preprocessors to decode email attachments inBase64, Quoted Printable, and uuencode formats, and updatesto SMTP preprocessor for decoding email attachments encodedas Quoted Printable and uuencode formats.See the SnortManual, README.pop, README.imap, and README.SMTP for details.
  • Add support for reading large pcap files.
  • IP Reputation preprocessor, allowing Snort to blacklist orwhitelist packets based on their IP addresses. Thispreprocessor is still in an experimental state, so pleasereport any issues to the Snort team.See README.reputation for more information.
  • DCE aware TCP reassembly has been added to the dcerpc2 preprocessor.See README.stream5 subsection related to Protocol Aware Flushing (PAF).
  • Improvements:
  • Logging of HTTP URL (host and filename), SMTP attachmentfilenames and email recipients when Snort generates eventson related traffic.
  • Updates to give shared library rules direct access to gzipdecoding capabilities.
  • Rule Option Improvements:
  • Updates to content modifier http_cookie to not includethe HTTP header names themselves in the buffer.This changemay affect existing rules that leverage this keyword.
  • Updates to the file_data and base64_data rule option keywordsand added a pkt_data rule option keyword that sets the bufferto be used for subsequent content/pcre/etc rule options.
  • Updates to the tcp flag rule option keyword to support 'C'and 'E' for CWR and ECN bits.
  • Updates to byte_extract rule option keyword to supportthe same string formats as with byte_test and byte_jump.
  • Updates to Snort's build infrastructure and autoconf scriptfor portability and improved checks for library dependencies.
  • Many updates and improvements to the Snort documentation.Specialthanks to all of the contributors from the Snort community forworking with us and making the documentation more accurate andusable.
  • Updates to the sensitive data preprocessor for handling HTTPtraffic and reducing false positives.
  • Updates to Snort's config parsing to give more meaningfulerror messages relating to snort.conf errors and configurationdisplay at startup.
  • Updates to Snort's active response packets whether via responsekeyword or part of inline normalization.
  • Improvements to HTTP Inspect processing of chunked HTTP data.
  • Updates to the statistics Snort prints to console or syslogat exit for different preproessors.
  • To facilitate easier building of Snort on many of the differentplatforms supported, Snort now uses pkg-config to check forcertain library locations. Obtain pkg-config from freedesktop.org.
  • HTTP Inspect has new options to detect the following anomalies: Excessive whitespace in a folded header line Series of HTTP chunks with small lengths
  • SIP preprocessor has new alerts for the following anomalies: Invalid SIP version Unknown SIP method SIP method mis-match Missing content-type header
  • Several bug fixes for Stream5's Protocol Aware Flushing
  • Fixed a bug where the socket output plugin sent the wrong data whenIPv6 was enabled
  • Other bug fixes

New in Snort 2.9.0.5 (Apr 8, 2011)

  • Improvements:
  • The normalization perprocessor now has options to configure packet trimming and TOS clearing. Packets injected by the preprocessor will now appear in Snort's packet statistics. TCP timestamps are now only normalized if a session is established without timestamp negotiation. See ChangeLog or README.normalize for more details.
  • Added a "config vlan_agnostic" setting that globally disables Stream's use of vlan tags in session tracking.
  • Fixed some issues in the packet decoder, including one where IPv6 fragments were being decoded incorrectly.
  • Updated the default snort.conf to enable unlimited decompression of gzipped HTTP server responses.

New in Snort 2.9.0.4 (Feb 11, 2011)

  • Improvements:
  • Added the Razorback "Snort as a Collector" (SaaC) dynamic preprocessor. This is for experimental use only! Enable it by compiling with --enable-rzb-saac.
  • Fixed false positives in HTTP traffic, which were caused by large HTTP chunks split across two packets.
  • Made several updates to the Snort manual and READMEs.
  • Fixed a false positive on Stream5 rule 129:15, caused by a RST following a FIN.

New in Snort 2.9.0.3 (Dec 22, 2010)

  • Improvements:
  • Fixed an issue where "uricontent" didn't behave correctly with "depth", "offset", "distance", and "within" modifiers.
  • Fixed overlapping flags in the Shared Object rule API.
  • Improved error checking for invalid combinations of "depth", "offset", "distance", and "within" modifiers in rules. Rules that mix relative and non-relative options on the same content will now cause errors.
  • Updated the documentation to fix some inconsistencies.

New in Snort 2.9.0.2 (Dec 4, 2010)

  • The HTTP Inspect "server_flow_depth" option is now applied once per HTTP session, instead of once per packet. This will improve performance by inspecting fewer packets.
  • Fixed an issue with the handling of TCP urgent data.
  • Fixed an issue with using file_data:mime within shared library rules.
  • Fixed an issue with TCP reassembly of single packets
  • Fixed an issue with DAQ building when using “–disable-bundled-modules” combined with other enables.

New in Snort 2.9.0.1 (Nov 3, 2010)

  • Improvements:
  • Fixed maximum flowbits configuration parsing to specify the number of bits in accordance with the Snort manual, rather than number of bytes. If you have 'config flowbits_size' in your snort.conf, double check that it has the correct setting.
  • Fixed a packet size issue with the IPQ and NFQ DAQs.
  • Updated the version of LibPCRE bundled with the Windows installer. This update fixes a bug that caused some PCRE matches to fail on Windows.

New in Snort 2.9.0 (Oct 5, 2010)

  • Feature rich IPS mode including improvements to Stream for inline deployments. Additionally a common active response API is used for all packet responses, including those from Stream, Respond, or React. A new response module, respond3, supports the syntax of both resp & resp2, including strafing for passive deployments. When Snort is deployed inline, a new preprocessor has been added to handle packet normalization to allow Snort to interpret a packet the same way as the receiving host.
  • Use of a Data Acquisition API (DAQ) that supports many different packet access methods including libpcap, netfilterq, IPFW, and afpacket. For libpcap, version 1.0 or higher is now required. The DAQ library can be updated independently from Snort and is a separate module that Snort links. See README.daq for details on using Snort and the new DAQ./li>
  • Updates to HTTP Inspect to extract and log IP addresses from X-Forward-For and True-Client-IP header fields when Snort generates events on HTTP traffic.
  • A new rule option 'byte_extract' that allows extracted values to be used in subsequent rule options for isdataat, byte_test, byte_jump, and content distance/within/depth/offset.
  • Updates to SMTP preprocessor to support MIME attachment decoding across multiple packets.
  • Ability to "test" drop rules using Inline Test Mode. Snort will indicate a packet would have been dropped in the unified2 or console event log if policy mode was set to inline.
  • Two new rule options to support base64 decoding of certain pieces of data and inspection of the base64 data via subsequent rule options.
  • Updates to the Snort packet decoders for IPv6 for improvements to anomaly detection.
  • Added a new pattern matcher that supports Intel's Quick Assist Technology for improved performance on supported hardware platforms. Visit http://www.intel.com to find out more about Intel Quick Assist. The following document describes Snort's integration with the Quick Assist Technology: http://download.intel.com/embedded/applications/networksecurity/324029.pdf.
  • Reference applications for reading unified2 output that handle all unified2 record formats used by Snort.

New in Snort 2.9.0 Beta (Aug 23, 2010)

  • New Additions:
  • Feature rich IPS mode including improvements to Stream for inline deployments. Additionally a common active response API is used for all packet responses, including those from Stream, Respond, or React. A new response module, respond3, supports the syntax of both resp & resp2, including strafing for passive deployments. When Snort is deployed inline, a new preprocessor has been added to handle packet normalization to allow Snort to interpret a packet the same way as the receiving host.
  • Use of a Data Acquisition API (DAQ) that supports many different packet access methods including libpcap, netfilterq, IPFW, and afpacket. For libpcap, version 1.0 or higher is now required. The DAQ library can be updated independently from Snort and is a separate module that Snort links to.
  • A new rule option 'byte_extract' that allows extracted values to be used in subsequent rule options for isdataat, byte_test, byte_jump, and content distance/within/depth/offset.
  • Two new rule options to support base64 decoding of certain pieces of data and inspection of the base64 data via subsequent rule options.
  • Added a new pattern matcher that supports Intel's Quick Assist Technology for improved performance on supported hardware platforms. Visit http://www.intel.com to find out more about Intel Quick Assist.
  • Improvements:
  • Updates to HTTP Inspect to extract and log IP addresses from X-Forward-For and True-Client-IP header fields when Snort generates events on HTTP traffic.
  • Updates to SMTP preprocessor to support MIME attachment decoding across multiple packets.
  • Updates to the Snort packet decoders for IPv6 for improvements to anomaly detection.

New in Snort 2.8.6.1 (Jul 23, 2010)

  • Updates:
  • Fix installer packages to include correct version of sensitive data preprocessor for linux and Windows
  • Eliminate false positives when using fast_pattern:only and having only one http content in the pattern matcher.
  • Address false positives in FTP preprocessor with string format verification. Also addressed issue with handling of response codes to data transfer commands where the response code didn't contain a message.

New in Snort 2.8.6 (Apr 27, 2010)

  • New Additions:
  • HTTP Inspect now splits requests into 5 components - Method, URI, Header (non-cookie), Cookies, Body. Content and PCRE rule options can now search one or more of these buffers.
  • HTTP server-specific configurations to normalize the HTTP header and/or cookies have been added.
  • Support gzip decompression across multiple packets.
  • Added a Sensitive Data preprocessor, which performs detection of Personally Identifiable Information (PII). A new rule option is available to define new PII. See README.sensitive_data and the Snort Manual for configuration details.
  • Added a new pattern matcher and related configurations. The new pattern matcher is optimized to use less memory and perform at AC speed.
  • Improvements:
  • Addressed problem to resolve output obfuscation affecting packets when Snort is inline.
  • Preprocessors with memcap settings can now be configured in a "disabled" state. This allows you to configure that memcap globally, but only enable the preprocessor in targeted configurations.

New in Snort 2.8.6 Beta (Jan 15, 2010)

  • Slight change to indicate that filters were introduced in 2.8.5, which is no longer the current version.

New in Snort 2.8.5.2 (Jan 4, 2010)

  • Improvements:
  • Improvements to HTTP Inspect for handling of pipelined requests and chunked encodings.
  • Updated the documentation for output plugins and log limits.
  • Fixed building on AIX 6.
  • Fixed reloading of auto-iface variables when privileges had been dropped.
  • Fixed issues at startup and perfstats rotation with old versions of libc (2.2, 2.3) & linux threads.

New in Snort 2.8.5 (Sep 24, 2009)

  • New Additions:
  • Ability to load a new snort.conf without stopping & restarting Snort.
  • Ability to specify different Snort configurations based on VLAN tags or CIDR blocks.
  • Detection, Rate, and Event filtering. The 'threshold' keyword is now deprecated.
  • Improvements:
  • Updated the handling of .so rules to use the Rule Option Tree, where possible.
  • Updated SSH preprocessor. The config options have changed slightly. The preprocessor is no longer considered "experimental".

New in Snort 2.8.4 (Apr 10, 2009)

  • New Additions:
  • Revised DCE/RPC preprocessor to provide new rule options, additional SMB command support, and updated defragmentation models
  • Support for IPv6 with Frag3 and all application preprocessors (SMTP, FTP/Telnet, DCE/RPC, SSL, DNS, Portscan)
  • Improved target-based support within application preprocessors
  • Addition to automatically pre-filter traffic that is not explicitly configured for inspection to improve performance.
  • HttpInspect update to limit number of HTTP Header fields and alert if limit is reached.
  • Support for multiple IP Addresses and/or CIDRs in HTTP Inspect and FTP/Telnet Server/Client specific configurations
  • Improvements:
  • Update to allow rules with only negated content

New in Snort 2.8.3.2 (Jan 21, 2009)

  • Improvements:
  • Fix issue with target based/attribute table and false positives for rules that dont have service metadata.
  • Fix target based/attribute table compatability with older versions of bison and to not exit when exceeding the configured limit on attribute table reload.
  • Update Stream5 to better handle out-of-sequence server responses that contain data when not doing server-side reassembly. Also add configurable limits on the amout of data queued for a single connection.

New in Snort 2.8.4 Beta (Oct 29, 2008)

  • New Additions:
  • Revised DCE/RPC preprocessor to provide new rule options, additional SMB command support, and updated defragmentation models
  • Support for IPv6 with Frag3 and all application preprocessors (SMTP, FTP/Telnet, DCE/RPC, SSL, DNS, Portscan)
  • Improved target-based support within application preprocessors
  • Addition to automatically pre-filter traffic that is not explicitly configured for inspection to improve performance.
  • HttpInspect update to limit number of HTTP Header fields and alert if limit is reached.
  • Support for multiple IP Addresses and/or CIDRs in HTTP Inspect and FTP/Telnet Server/Client specific configurations
  • Improvements:
  • Update to allow rules with only negated content

New in Snort 2.8.3.1 (Oct 29, 2008)

  • Improvements:
  • Update rule latency thresholding.
  • Notes:
  • The flow and stream4 preprocessors will be deprecated in a future release.