Download Suricata 1.4.1

Suricata is an open source network Intrusion Detections System (IDS), Intrusion Prevention System (IPS) and Network Security Monitoring engine. It can be used to monitor network traffic and alert a system administrator when something suspicious is detected. Development is overseen by the Open Information Security Foundation, with support from the community and various manufacturers. Version 1.4.1 of Suricata has now been released and its release notes can be found below:

Suricata 1.4.1 released!

The OISF development team is proud to announce Suricata 1.4.1. The most interesting new feature is the GeoIP support. It adds “geoip” rule keyword that allows you to match on source of destination of a packet per country.

New features

• GeoIP keyword, allowing matching on Maxmind’s database, contributed by Ignacio Sanchez (#559)
• Introduce http_host and http_raw_host keywords (#733, #743)
• Add python module for interacting with unix socket (#767)
• Add new unix socket commands: fetching config, counters, basic runtime info (#764, #765)

Improvements

• Big Napatech support update by Matt Keeler
• Configurable sensor id in unified2 output, contributed by Jake Gionet (#667)
• FreeBSD IPFW fixes by Nikolay Denev
• Add “default” interface setting to capture configuration in yaml (#679)
• Make sure “snaplen” can be set by the user (#680)
• Improve HTTP URI query string normalization (#739)
• Improved error reporting in MD5 loading (#693)
• Improve reference.config parser error reporting (#737)
• Improve build info output to include all configure options (#738)

Fixes

• Segfault in TLS parsing reported by Charles Smutz (#725)
• Fix crash in teredo decoding, reported by Rmkml (#736)
• fixed UDPv4 packets without checksum being detected as invalid (#760)
• fixed DCE/SMB parsers getting confused in some fragmented cases (#764)
• parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#697)
• FN: IP-only rule ip_proto not matching for some protocols (#689)
• Fix build failure with other libhtp installs (#688)
• Fix malformed yaml loading leading to a crash (#694)
• Various Mac OS X fixes (#700, #701, #703)
• Fix for autotools on Mac OS X by Jason Ish (#704)
• Fix AF_PACKET under high load not updating stats (#706)