Snort mailing list archives
Snort 2.9.7 Beta is now available
From: Snort Releases <snortreleases () snort org>
Date: Tue, 01 Jul 2014 21:45:39 -0400
Snort 2.9.7 Beta is now available on snort.org at http://www.snort.org/snort-downloads/ in the Development section. A new DAQ build is also available that updates support for a few operating systems. Snort 2.9.7 includes a major new feature for to Application Identification, our openappid capability. [*] New additions * Application Identification Preprocessor, when used in conjunction with open app ID detector content, that will identify application protocol, client, server, and web applications (including those using SSL) and include the info in Snort alert data. In addition, a new rule option keyword 'appid' that can be used to constrain Snort rules based on one or more applications that are identified for the connection. See README.appid for details. * A new protected_content rule option that is used to match against a content that is hashed. It can be used to obscure the full context of the rule from the administrator. * Protocol Aware Flushing (PAF) improvements for SMTP, POP, and IMAP to more accurately process different portions of email messages and file attachments. * Added ability to test normalization behavior without modifying network traffic. When configured using na_policy_mode:inline-test, statistics will be gathered on packet normalizations that would have occurred, allowing less disruptive testing of inline deployments. * The HTTP Inspection preprocessor now has the ability to decompress DEFLATE and LZMA compressed flash content and DEFLATE compressed PDF content from http responses when configured with the new decompress_swf and decompress_pdf options. This enhancement can be used with existing rule options that already match against decompressed equivalents. * Added improved XFF support to HttpInspect. It is now possible to specify custom HTTP headers to use in place of 'X-Fowarded-For'. In situations where traffic may contain multiple XFF-like headers, it is possible to specify which headers hold precedence. * Added control socket command to dump packets. * The Stream5 preprocessor functionality is now split between the new Session and Stream preprocessors. This makes for easier tracking of sessions independent of TCP stream reassembly. [*] Improvements * Update active response to allow for responses of 1500+ bytes that span multiple TCP packets. * Check limits of multiple configurations to not exceed a maximum ID of 4095. * Updated the error output of byte_test, byte_jump, byte_extract to including details on offending options for a given rule. * Update build and install scripts to install preprocessor and engine libraries into user specified libdir. * Improved performance of IP Reputation preprocessor. * The control socket will now report success when reloading empty IP Reputation whitelists/blacklists. * All TCP normalizations can now be enabled individually. See README.normalize for details on usingthe new options. For consistency with other options, the "urp" tcp normalization keyword nowenables the normalization instead of disabling it. * Lowered memory demand of Unicode -> ASCII mapping in HttpInspect. * Updated profiler output to remove duplicate results when using multiple configurations. * Improved performance of FTP reassembly. * Improved compatibility with Mac OSX 10.9 (Mavericks), OpenBSD, FreeBSD, and DragonFlyBSD. ------------------------------------------------------------------------------ Open source business process management suite built on Java and Eclipse Turn processes into business applications with Bonita BPM Community Edition Quickly connect people, data, and systems into organized workflows Winner of BOSSIE, CODIE, OW2 and Gartner awards http://p.sf.net/sfu/Bonitasoft _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Snort 2.9.7 Beta is now available Snort Releases (Jul 01)
- <Possible follow-ups>
- Snort 2.9.7 Beta is now available Snort Releases (Jul 01)