Download Suricata 2.0 Beta 1

Suricata is an open source network intrusion detections system (IDS), intrusion prevention system (IPS), and network security monitoring engine. It can be used to monitor network traffic and alert a system administrator if anything suspicious is detected. Development is overseen by the Open Information Security Foundation, with support from the community and various manufacturers. This first beta of version 2.0 has a number of new features, including a dns parser, and a number of improvements:

New features

• Luajit flow vars and flow ints support (#593)
• DNS parser, logger and keyword support (#792), funded by Emerging Threats
• deflate support for HTTP response bodies (#470, #775)

Improvements

• update to libhtp 0.5 (#775)
• improved gzip support for HTTP response bodies (#470, #775)
• redesigned transaction handling, improving both accuracy and performance (#753)
• redesigned CUDA support (#729)
• Be sure to always apply verdict to NFQ packet (#769)
• stream engine: SACK allocs should adhere to memcap (#794)
• stream: deal with multiple different SYN/ACK’s better (#796)
• stream: Randomize stream chunk size for raw stream inspection (#804)
• Introduce per stream thread ssn pool (#519)
• “pass” IP-only rules should bypass detection engine after matching (#718)
• Generate error if bpf is used in IPS mode (#777)
• Add support for batch verdicts in NFQ, thanks to Florian Westphal
• Update Doxygen config, thanks to Phil Schroeder
• Improve libnss detection, thanks to Christian Kreibich

Fixes

• Fix a FP on rules looking for port 0 and fragments (#847), thanks to Rmkml
• OS X unix socket build fixed (#830)
• bytetest, bytejump and byteextract negative offset failure (#827)
• Fix fast.log formatting issues (#771), thanks to Rmkml
• Invalidate negative depth (#774), thanks to Rmkml
• Fixed accuracy issues with relative pcre matching (#791)
• Fix deadlock in flowvar capture code (#802)
• Improved accuracy of file_data keyword (#817)
• Fix af-packet ips mode rule processing bug (#819), thanks to Laszlo Madarassy
• stream: fix injecting pseudo packet too soon leading to FP (#883), thanks to Francis Trudeau