Snort 2.9.4 RC released - open source network intrusion prevention and detection system (IDS/IPS)

Snort® is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and nearly 400,000 registered users, Snort has become the de facto standard for IPS.

Snort 2.9.4 includes changes for the following:

[*] New additions

* Consolidation of IPv6 -- now only a single build supports both IPv4 & IPv6, and removal of the IPv4 "only" code paths.

* File API and improvements to file processing for HTTP downloads and email attachments via SMTP, POP, and IMAP to facilitate broader file support

* Use of address space ID for tracking Frag & Stream connections when it is available with the DAQ

* Logging of packet data that triggers PPM for post-analysis via Snort event

* Decoding of IPv6 with PPPoE

[*] Improvements

* Update to Stream5 PAF for handling gaps in the sequence numbers of packets being reassembled.

* Selection of the Stream TCP policy based on the server rather than the destination of first packet seen by Snort

* Allow disabling of global thresholds via a count of -1

* Prevent blocking duplicate SYNs when using inline normalization

* Add SSLv3 backwards compatibility support for SSLv2 ClientHello messages

* Allow active responses to packets without data (eg, a TCP SYN)

* Changed logic of option evaluations for shared library rules that use a custom evaluation function to match that of the builtin logic when the NOT_FLAG is used. The 'NOT' matching now happens within each of the individual rule option evaluation functions.

Please see the Release Notes and ChangeLog for more details.

The purpose of this beta program is to allow people to get exposure to the technology and to use the code in real-world environments – and as an opportunity to solicit feedback on the design and user experience of the new Snort code as it evolves.