Snort 2.9.7 RC is now available

[Snort Releases <snortreleases () snort org>]

Snort 2.9.7 RC is now available on snort.org at
https://www.snort.org/downloads in the Development Release section.

A new DAQ build is also available that updates support for a few 
operating systems.

Snort 2.9.7 includes a major new feature for to Application 
Identification, our openappid capability.

[*] New additions
* Application Identification Preprocessor, when used in conjunction with
   open app ID detector content, that will identify application protocol,
   client, server, and web applications (including those using SSL) and
   include the info in Snort alert data. In addition, a new rule option
   keyword 'appid' that can be used to constrain Snort rules based on one
   or more applications that are identified for the connection.  Separate
   prepackaged RPMs with App Open ID are available.  See README.appid
   for further details.

* A new protected_content rule option that is used to match against a
   content that is hashed.  It can be used to obscure the full context
   of the rule from the administrator.

* Protocol Aware Flushing (PAF) improvements for SMTP, POP, and IMAP to
   more accurately process different portions of email messages and file
   attachments.

* Added ability to test normalization behavior without modifying
   network traffic.  When configured using na_policy_mode:inline-test,
   statistics will be gathered on packet normalizations that would have
   occurred, allowing less disruptive testing of inline deployments.

* The HTTP Inspection preprocessor now has the ability to decompress
   DEFLATE and LZMA compressed flash content and DEFLATE compressed PDF
   content from http responses when configured with the new
   decompress_swf and decompress_pdf options. This enhancement can be
   used with existing rule options that already match against
   decompressed equivalents.

* Added improved XFF support to HttpInspect. It is now possible to
   specify custom HTTP headers to use in place of 'X-Forwarded-For'. In
   situations where traffic may contain multiple XFF-like headers, it is
   possible to specify which headers hold precedence.

* Added additional support for Heartbleed detection within the SSL
   preprocessor to improve performance.

* Added control socket command to dump packets.

* Added an option to suppress configuration information logging to
   output.

* The Stream5 preprocessor functionality is now split between the new
   Session and Stream6 preprocessors.


[*] Improvements
* Maximum IP6 extensions decoded is now configurable.

* Update active response to allow for responses of 1500+ bytes that span
   multiple TCP packets.

* Check limits of multiple configurations to not exceed a maximum ID of
   4095.

* Updated the error output of byte_test, byte_jump, byte_extract to
   including details on offending options for a given rule.

* Update build and install scripts to install preprocessor and engine
   libraries into user specified libdir.

* Improved performance of IP Reputation preprocessor.

* The control socket will now report success when reloading empty IP
   Reputation whitelists/blacklists.

* All TCP normalizations can now be enabled individually. See
   README.normalize for details on using the new options. For
   consistency with other options, the "urp" tcp normalization keyword
   now enables the normalization instead of disabling it.

* Lowered memory demand of Unicode -> ASCII mapping in HttpInspect.

* Updated profiler output to remove duplicate results when using
   multiple configurations.

* Improved performance of FTP reassembly.

* Improved compatibility with Mac OSX 10.9 (Mavericks), OpenBSD,
   FreeBSD, and DragonFlyBSD

* Stability improvements in Stream6 preprocessor and FTP preprocessor.


------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!