[Snort-openappid] Snort 2.9.7 Beta is now available

Snort Releases snortreleases at ...1...
Tue Jul 1 19:52:24 EDT 2014


Snort 2.9.7 Beta is now available on snort.org at
http://www.snort.org/snort-downloads/in the Development section.

A new DAQ build is also available that updatessupport for a few operating
systems.

Snort 2.9.7 includes a major new feature for to Application Identification,
our openappid capability.

[*] New additions
* Application Identification Preprocessor, when used in conjunction with
   open app ID detector content, that will identify application protocol,
   client, server, and web applications (including those using SSL) and
   include the info in Snort alert data. In addition, a new rule option
   keyword 'appid' that can be used to constrain Snort rules based on one
   or more applications that are identified for the connection.
   See README.appid for details.


* A new protected_content rule option that is used to match against a 
content
   that is hashed.  It can be used to obscure the full context of the 
rule from
   the administrator.

* Protocol Aware Flushing (PAF) improvements for SMTP, POP, and IMAP to
   more accurately process different portions of email messages and file
   attachments.

* Added ability to test normalization behavior without modifying network 
traffic.
   When configured using na_policy_mode:inline-test, statistics will be 
gathered
   on packet normalizations that would have occurred, allowing less 
disruptive
   testing of inline deployments.

* The HTTP Inspection preprocessor now has the ability to decompress
   DEFLATE and LZMA compressed flash content and DEFLATE compressed PDF
   content from http responses when configured with the new decompress_swf
   and decompress_pdf options. This enhancement can be used with 
existing rule
   options that already match against decompressed equivalents.

* Added improved XFF support to HttpInspect. It is now possible to 
specify custom
   HTTP headers to use in place of 'X-Fowarded-For'. In situations where 
traffic may
   contain multiple XFF-like headers, it is possible to specify which 
headers hold
   precedence.

* Added control socket command to dump packets.

* The Stream5 preprocessor functionality is now split between the new 
Session and
   Stream preprocessors.  This makes for easier tracking of sessions 
independent of
   TCP stream reassembly.

[*] Improvements
* Update active response to allow for responses of 1500+ bytes that span
   multiple TCP packets.

* Check limits of multiple configurations to not exceed a maximum ID of 
4095.

* Updated the error output of byte_test, byte_jump, byte_extract to
   including details on offending options for a given rule.

* Update build and install scripts to install preprocessor and engine 
libraries
   into user specified libdir.

* Improved performance of IP Reputation preprocessor.

* The control socket will now report success when reloading empty IP 
Reputation
whitelists/blacklists.

* All TCP normalizations can now be enabled individually. See 
README.normalize for
   details on usingthe new options. For consistency with other options, 
the "urp"
   tcp normalization keyword nowenables the normalization instead of 
disabling it.

* Lowered memory demand of Unicode -> ASCII mapping in HttpInspect.

* Updated profiler output to remove duplicate results when using 
multiple configurations.

* Improved performance of FTP reassembly.

* Improved compatibility with Mac OSX 10.9 (Mavericks), OpenBSD, 
FreeBSD, and DragonFlyBSD.





More information about the Snort-openappid mailing list