Friday, October 2, 2015

Snort++ Build 172 Available Now

Snort++ build 172 is now available on  This is the latest monthly update available for download.  You can also get the latest updates from github (snortadmin/snort3) which is updated weekly.

Bug Fixes:

  • apply ppm.fastpath config correctly
  • fix file_decomp error logic
  • enable active response without flow
  • fix metadata:service to work like 2x
  • fixed issues when building with LINUX_SMP
  • fixed frag tracker accounting
  • fix Xcode builds
  • don't apply cooked verdicts to raw packets
  • fixed build error with valgrind build option
  • fix breakloop in file daq
  • fix plain file processing
  • fix detection of stream_user and stream_file data
  • fix chunked manual install
  • fix OpenBSD build
  • fix dev guide builds from top_srcdir
  • fixed build of chunked manual (thanks to Bill Parker for reporting the issue)
  • fixed cmake build issue with SMP stats enabled
  • fixed compiler warnings
  • fixed u2spewfoo build issue
  • dns bug fix for tcp

Doc Updates:

  • update manual related to liblzma
  • update bug list
  • update where to get dnet
  • update usage

Build Changes:

  • move extra daqs and extra hext logger to main source tree
  • move non-ethernet codecs to extras
  • removed unused control socket defines from cmake
  • cleanup *FLAGS use in
  • change compiler search order to prefer clang over gcc

Test Changes:
  • convert check unit tests to catch
  • added --catch-tags [footag],[bartag] for unit test selection
  • add cpputest for unit testing
Other Changes:
  • implement 116:281 decoder rule
  • updated snort2lua
  • log innermost proto for type of broken packets
  • new_http_inspect cookie processing updates
  • updated error messages in u2spewfoo
  • added strdup sanity checks (thanks to Bill Parker for reporting the issue)
Please submit bugs, questions, and feedback to or the Snort-Users mailing list.

Happy Snorting!
The Snort Release Team