2.9.11.0 beta has been released!

Join us as we welcome Snort 2.9.11.0 to the family, in beta form!

Right off the bat, you will notice that we are going from 2.9.9.0 to 2.9.11.0, skipping over 2.9.10.0. Just to clarify, 2.9.10.0 was an internal only release. We decided not to ship it to the public because timing of back to back 2.9.10 and 2.9.11 releases, and thought it would be better for the community to just release one instead of two. All 2.9.10 features and fixes are in 2.9.11, so you're not missing anything, just making it easier on the community.

We will be modifying the EOL slightly, as we are going to be keeping versions around a little longer. We aren't quite sure what this will look like yet, but rest assured we will be updating the blog when we do.

Here's some release notes:

• New additions
• Changes to eliminate Snort restart when there are changes to the memory allocated for preprocessors, by releasing unused or least recently used memory when needed.

• Improvements
• Enhanced RTSP metadata parsing to match the user-agent field to detect RTSP traffic over Windows Media.
• Performance improvement when SYN rate limit has reached and drop is configured as next action
• Control-socket and side-channel support for FreeBSD platform.
• Fixed an issue where IoQ driver was getting into bad state due to non-graceful exit.
• Fixed issue in file signature lookup for retransmitted FTP packet.
• Enhanced the processing of SIP/RTP future flows without ignoring them.
• Changes made in PDF/SWF decompression by adding boundary to the size of the decompressed data.
• Added a null check to prevent copy unless debugHostIp is configured in AppId.
• Fixed issue where FTP file type block doesn't work for retried download.
• Resolved issue where Snort is inappropriately handling traffic for which AppId was creating future flow.
• Performance improvements for SIP/RTP audio and video data flow in AppId.
• Performance and stability improvements in FTP preprocessor like incorrect referencing of ftp_data_session after its pruned.
• Stability improvement by resolving valgrind reported issues in AppId.
• Improved flushing mechanism for HTTP POST header.

Check out Snort 2.9.11.0, available for download on our site.

Snort 2.9.9 Beta has been posted!

Join us as we welcome Snort 2.9.9 to the family, in beta form, with a couple really killer features!

Here's some release notes:

2016-05-12 - Snort 2.9.9 Beta
[*] New additions

 *  HTTP/2 support.
        HTTP2 SUPPORT IS STILL EXPERIMENTAL.
        By default, HTTP2 traffic is not supported. To enable it you need:
            * Install nghttp library from https://nghttp2.org/
            * If nghttp is not installed in default path, use with_libnghttp2_includes and
              with_libnghttp2_libraries to point to the correct path during "configure" step.
            * Enable HTTP2 support in http_inspect configuration with "legacy_mode no"
        Refer README.http_inspect for details.

 *  Buffer Dump feature.
        Enable buffer dump feature with "--enable-buffer-dump" configure option.

 *  Rule options - byte_math, bitmask and from_end.

[*] Improvements
 *  Performance improvements to AppID.

 *  Fixed Flash LZMA decompression issue.

 *  Added 802.11/wifi header support in ARP Preprocessor.

 *  Stability improvement for Stream6 preprocessor.

 *  Fixed multiple issues in HttpInspect preprocessor.

 *  Fixed an issue of incorrect masking of sensitive data.

Check out Snort 2.9.9, available for download on our site.  

Snort 2.9.8 Beta has been released!

Join us as we welcome the newest Snort beta, 2.9.8!  Check out the following release notes:

Snort 2.9.8 Beta

[*] New additions

• AppID is no longer experimental.
• SMBv2/SMBv3 support for file inspection. 
• Port override for metadata service in IPS rules.
• AppID Lua detector performance profiling.
• Perfmon dumps stats at fixed intervals from absolute time.
• New preprocessor alert (18:120) to detect SSH tunneling over HTTP
• New config option |disable_replace| to disable replace rule option.
• New Stream configraution |log_asymmetric_traffic| to control logging to syslog.
• New shell script in tools to create simple Lua detetors for AppID.

[*] Improvements

• sfip_t refactored to use struct in6_addr for all ip addresses.
• Post-detection callback for preprocessors.
• AppID support for multiple server/client detectors evaluting on same flow.
• AppID API for DNS packets.
• Memory optimizations throughout.
• Support sending UDP active responses.
• Fix permon tracking of pruned packets.
• Improved support for expected sessions.

You can download and use Snort 2.9.8 beta after downloading it from the Snort.org Downloads page under "Development Releases"

Feedback on Snort 2.9.8.0 Beta can be provided on the Snort-Devel mailing list!

Thank you for supporting Snort.

OpenAppID Detector Package update for 09/03/2014

Just Released:
OpenAppID Detector Package update for 09/03/2014

We welcome the introduction of the newest OpenAppID release from the Detection Team. In this release:

* Increased the coverage of our application detectors to an additional 243 detectors which brings our total coverage to 2,450 detectors. 

For more information about the list of detectors they can be viewed in the appMapping.data file.
You can download Snort 2.9.7.0 beta and the OpenAppId content at https://www.snort.org/downloads in the Development section.

Snort OpenAppID Detector Beta available!

We've released a new version of the OpenAppId content, and we wanted to share a few points about what we've added:

* Increased the coverage of our application detectors to an additional 800 detectors which brings our total coverage to 2,207 detectors. Some of those detectors include application based subclassifications such as "LinkedIn Upload", expanded coverage to protocol based detectors, different messaging platforms like the Kik Messenger and new torrent clients like uTorrent.

For more information about the list of detectors they can be viewed in the appMapping.data file.

* Improvements over the application detection that are based on SSL traffic

* Along with Snort 2.9.7.0 beta we have included the Open Source Detectors Developer Guide document which can be used for anyone that would like to write their own openappid detectors.

You can download Snort 2.9.7.0 beta and the OpenAppId content at https://www.snort.org/downloads in the Development section.

Two Things you Should Know About Snort 2.9.3.0

Among many important changes in Snort 2.9.3.0 are the changes to flowbits and outputs.  The flowbits syntax was overhauled and now supports an OR operator.  Deprecated outputs such as database have been removed.  Also, now a dynamic output plugin feature that will make it easier to maintain your favorite outputs or create something new.

Flowbits Update

Flowbits are used to track detection state across multiple packets within a session.  To set a flowbit, use flowbits:set,bitname; (often followed by flowbits:noalert;) and to check a flowbit use flowbits:isset,bitname.  You can check multiple bits within flowbits:isset,bit1; flowbits:isset,bit2; etc. because multiple isset options form a logical AND as in "bit1&&bit2" if you know a little C syntax.  However, prior to 2.9.3.0, there was no easy way to check if at least one of multiple bits was set.  You may have resorted to writing rules like this:

( sid:10; flow:to_server; content:"A"; flowbits:set,bitA; flowbits:noalert; )
( sid:20; flow:to_server; content:"B"; flowbits:set,bitB; flowbits:noalert; )
( sid:30; flow:to_client; content:"C"; flowbits:isset,bitA; )
( sid:40; flow:to_client; content:"C"; flowbits:isset,bitB; )

Note that 2 rules, sids 30 and 40, were required to handle both possibilities.  This gets messier with more options.  Snort 2.9.3.0 fixes this with the addition of the logical OR:

( sid:11; flow:to_server; content:"A"; flowbits:set,bitA; flowbits:noalert; )
( sid:21; flow:to_server; content:"B"; flowbits:set,bitB; flowbits:noalert; )
( sid:31; flow:to_client; content:"C"; flowbits:isset,bitA|bitB; )

In this case sids 30 and 40 are replaced with a single rule, sid 31, which leverages the syntax "bitA|bitB", meaning bitA OR bitB.  For even greater flexibility, you can use the optional group as follows:

( sid:12; flow:to_server; content:"A"; flowbits:set,bitA,group; flowbits:noalert; )
( sid:22; flow:to_server; content:"B"; flowbits:set,bitB,group; flowbits:noalert; )
( sid:32; flow:to_client; content:"C"; flowbits:isset,any,group; )

Now if you add a new bit to the group, say bitC, you don't need to update sid 32.

Snort 2.9.3.0 adds lots of other tweaks to flowbits, like the AND notation "bitA&bitB".  So, be sure to review the manual for details.

Changes to Output Plugins

You may have noticed that the postgresql and mysql packages are not among the 2.9.3.0 beta files on Snort.org.  You may also have noticed that the source for the aruba, prelude, mysql, oracle, and mssql outputs are gone too.  Those outputs were deprecated because of resource constraints that did not allow time to test and maintain the outputs as well as lack of communication from the original developers.

However, in their place dynamic output plugin support was added.  For best performance, you will probably want to switch to unified2 logging as described on Snort.org, but you could convert the old outputs to the new plugin structure if that is best for your deployment.

To help you get going with your own custom output, you can start with the dynamic output example package (dox-1.0.4.tar.gz).  The README therein explains the 3 simple steps to build and test the dox plugin.  You can then modify the source to obtain the output when, where, and how you want it.

There are many other improvements to Snort included with version 2.9.3.0, including an awesome overhaul of the dcerpc2 preprocessor by Todd.  Check it out.

Please submit bugs, questions, and feedback to snort-beta@sourcefire.com.