Snort++ Build 239 Available Now on Snort.org

A new release of Snort++ is now available on Snort.org which includes lots of new functionality and important bug fixes.  Here is an overview of the updates since the prior release:

Important changes since the last release:

• DAQ: version 2.2.2 now required
• rules: removed sample.rules; Talos now publishes Snort 3 community rules on snort.org
• rules: promoted metadata:service to a separate option since it is not metadata
• mpse: removed Intel Soft CPM support (use Hyperscan!)
• unified2: deprecated ip4 and ip6 specific events and added a single event for both
• http_server: removed old inspector (use new http_inspect instead)
• hyperscan: now require version >= 4.4.0
• loggers: removed units options; all limits expressed in MB

Issues reported by the community:

• logging: fixed handling of out of range timeval
  thanks to kamil@frankowicz.me for reporting the issue
• rules: tolerate spaces in positional parameters
  thanks to Joao Soares for reporting the issue
• search_engine: set range for max_queue_events parameter
  thanks to Navdeep.Uniyal@neclab.eu for reporting the issue
• packet manager: ensure ether type proto ids don't masquerade as ip proto ids
  thanks to Bhargava Shastry  for reporting the issue
• codec manager: fixed off-by-1 mapping array size
  thanks to Bhargava Shastry for reporting the issue
• hyperscan: check runtime support
  thanks to justin.viiret@intel.com for submitting the patch
• mpse: fixed issue with empty pattern database
  thanks to justin.viiret@intel.com for reporting the issue

New Features:

• perf_monitor: added FlatBuffers output and JSON formatter
• also added tool to convert FlatBuffers files to yaml
• alerts: improved -A cmg formatting
• numerous control socket and shell updates
• byte_math and bitmask: ported rule option from 2X
• regex: added fast_pattern; do not use for fast pattern unless explicitly indicated
• detection: added new trace capability to debug rules
• output: added packet trace feature
• port_scan: now fully configurable

There are many other updates not mentioned.  Check the ChangeLog for a summary of changes including new features and build and bug fixes.

There are lots of enhancements and new features planned for Snort++, some of which are already in development.  As always, new downloads are posted to snort.org periodically.  You can also get the latest updates from github (snortadmin/snort3) which is updated weekly.

Please submit bugs, questions, and feedback to bugs@snort.org or the Snort-Users mailing list.

Happy Snorting!
The Snort Release Team