[Snort-users] FLoP-1.5.1 released

Dirk Geschke dirk at ...10648...
Mon Feb 13 01:02:01 EST 2006


Hi all,

a new version of FLoP (the Fast Logging Project for Snort) was released.

This new version fixes some minor bugs and adds some new features:

  + TCP support for database access is now possible. This could 
    be useful if you run programs in chroot() environments where
    the unix socket of the database is not available.
  + A bug with the sensor name is removed, it could have happened 
    that parts of the previous connected sensor were appended with 
    a newline
  + create_postgresql and create_mysql scripts were added in the 
    contrib directory to set up the database with all available
    features (scheme 107, full payload, following of tagged packets).
  + Disabling of drop, alert (with sockserv/servsock) and following  
    of tagged packets (with getpacket) is possible.
  + Dropping without writing the alerts to the drop socket is now 
    alos possible.
  + Some more consistency checks are added.
  + A configure problem with Solaris 8 and earlier is removed and
    a bug with x86 Solaris
  + Better support for OpenBSD 3.8
  + Rewrite of the exit routines, on strange circumstances it could
    have happened that servsock got hung or the dumped alerts were
    corrupted.
  + If the connection between sensor and central server gets 
    interrupted the reconnect routine got a wait time to give the 
    central server some time to recover. Otherwise the reconnect
    was tried immediately several times.
  + The interface name can be added by the sensor and is stored in
    the appropiate database table. (-I option of sockserv)

All this can be found at

   http://www.geschke-online.de/FLoP/

Best regards

Dirk





More information about the Snort-users mailing list