<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>6 sensors all around the world up to 30 Gbit of traffic in total, stable as rock.</div><div><br>On 28 Jan 2016, at 15:41, Yasha Zislin <<a href="mailto:coolyasha@hotmail.com">coolyasha@hotmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style>
<div dir="ltr">Erich,<div><br></div><div>THanks for the info. I will give it a shot.</div><div>How stable is this release? good enough for production?<br><br><div>> Date: Thu, 28 Jan 2016 14:26:43 +0100<br>> From: <a href="mailto:erich.lerch@gmail.com">erich.lerch@gmail.com</a><br>> To: <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.openinfosecfoundation.org</a><br>> Subject: Re: [Oisf-users] Suricata 3.0 is out!<br>> <br>> Yasha,<br>> <br>> 1. get the zip from<br>> <a href="https://github.com/inliniac/suricata/tree/dev-detect-grouping-v174">https://github.com/inliniac/suricata/tree/dev-detect-grouping-v174</a><br>> 2. unzip<br>> 3. cd suricata-dev-detect-grouping-v174<br>> 4. git clone <a href="https://github.com/ironbee/libhtp">https://github.com/ironbee/libhtp</a><br>> 5. ./autogen.sh<br>> <br>> And now everything as usual, "./configure" with the params you usually<br>> use/need, and "make".<br>> <br>> suricata.yaml: basically you exchange the block "detect-engine" with<br>> the new variant from the config included in the zip (now called<br>> "detect").<br>> <br>> <br>> That's it... have fun<br>> erich<br>> <br>> <br>> 2016-01-28 13:10 GMT+01:00 Yasha Zislin <<a href="mailto:coolyasha@hotmail.com">coolyasha@hotmail.com</a>>:<br>> > Can somebody advise on how to compile with this grouping? and what is it<br>> > exactly?<br>> ><br>> > Thanks.<br>> ><br>> >> Date: Wed, 27 Jan 2016 22:49:57 +0100<br>> >> From: <a href="mailto:petermanev@gmail.com">petermanev@gmail.com</a><br>> >> To: <a href="mailto:gfaulkner.nsm@gmail.com">gfaulkner.nsm@gmail.com</a><br>> >> CC: <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.openinfosecfoundation.org</a><br>> >> Subject: Re: [Oisf-users] Suricata 3.0 is out!<br>> >><br>> >> On Wed, Jan 27, 2016 at 9:37 PM, Gary Faulkner <<a href="mailto:gfaulkner.nsm@gmail.com">gfaulkner.nsm@gmail.com</a>><br>> >> wrote:<br>> >> > Thanks for the replies folks, that is what I was hoping to know.<br>> >> ><br>> >> ><br>> >> > On 1/27/16 1:45 PM, Erich Lerch wrote:<br>> >> >><br>> >> >> I have dev-detect-grouping-v174 running on one system.<br>> >> >> Seems to be as stable as 3.0RC3 (didn't run 3.0final yet), I had no<br>> >> >> problems so far. And performance is better, yes. Start-up time is<br>> >> >> spectacularly better with big custom detect groups.<br>> >> >><br>> >><br>> >> I have only seen positive performance from dev-detect-grouping-v174 as<br>> >> well.<br>> ><br>> >><br>> >><br>> >> >> Cheers,<br>> >> >> erich<br>> >> >><br>> >> >><br>> >> >><br>> >> >> On 27.01.2016 19:14, Gary Faulkner wrote:<br>> >> >>><br>> >> >>> I did take a look at Redmine, but I didn't see obvious answers to a<br>> >> >>> couple questions. Did the stuff from the dev-grouping code branch make<br>> >> >>> it into this release? The discussion about the grouping code looked<br>> >> >>> very<br>> >> >>> promising for performance, so if it didn't make it's way in, is there<br>> >> >>> an<br>> >> >>> ETA, or is there a dev branch that is fairly well synced up with<br>> >> >>> release<br>> >> >>> at this point or that folks have tried and feel is worth giving a go<br>> >> >>> in<br>> >> >>> production? Also is PF_RING ZC now supported and working correctly? I<br>> >> >>> recall seeing that NTOP had interacted with the Suricata team at one<br>> >> >>> point to resolve an issue there, but don't see anything about it in<br>> >> >>> the<br>> >> >>> release notes.<br>> >> >>><br>> >> >>> Regards,<br>> >> >>> Gary<br>> >> >>><br>> >> >>> On 1/27/16 8:14 AM, Victor Julien wrote:<br>> >> >>>><br>> >> >>>> We're proud to announce Suricata 3.0. This is a major new release<br>> >> >>>> improving Suricata on many fronts.<br>> >> >>>><br>> >> >>>> *Download*<br>> >> >>>> <a href="http://www.openinfosecfoundation.org/download/suricata-3.0.tar.gz">http://www.openinfosecfoundation.org/download/suricata-3.0.tar.gz</a><br>> >> >>>><br>> >> >>>><br>> >> >>>> *Features and Improvements*<br>> >> >>>><br>> >> >>>> - improved detection options, including multi-tenancy and xbits<br>> >> >>>> - performance and scalability much improved<br>> >> >>>> - much improved accuracy and robustness<br>> >> >>>> - Lua scripting capabilities expanded significantly<br>> >> >>>> - many output improvements, including much more JSON<br>> >> >>>> - NETMAP capture method support, especially interesting to FreeBSD<br>> >> >>>> users<br>> >> >>>> - SMTP inspection and file extraction<br>> >> >>>><br>> >> >>>> For a full list of features added, please see:<br>> >> >>>> <a href="https://redmine.openinfosecfoundation.org/versions/80">https://redmine.openinfosecfoundation.org/versions/80</a><br>> >> >>>><br>> >> >>>><br>> >> >>>> *Upgrading*<br>> >> >>>><br>> >> >>>> Upgrades from 2.0 to 3.0 should be mostly seamless. Here are some<br>> >> >>>> notes:<br>> >> >>>><br>> >> >>>><br>> >> >>>><br>> >> >>>> <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Upgrading_Suricata_20_to_Suricata_30">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Upgrading_Suricata_20_to_Suricata_30</a><br>> >> >>>><br>> >> >>>><br>> >> >>>><br>> >> >>>> *Special thanks*<br>> >> >>>><br>> >> >>>> We'd like to thank the following people and corporations for their<br>> >> >>>> contributions and feedback:<br>> >> >>>><br>> >> >>>> FireEye, ProtectWise, ANSSI, Emerging Threats /<br>> >> >>>> Proofpoint, Stamus Networks, Ntop, AFL project, CoverityScan<br>> >> >>>><br>> >> >>>> Aaron Campbell, Aleksey Katargin, Alessandro Guido,<br>> >> >>>> Alexander Gozman, Alexandre Macabies, Alfredo Cardigliano,<br>> >> >>>> Andreas Moe, Anoop Saldanha, Antti Tönkyrä, Bill Meeks,<br>> >> >>>> Darien Huss, David Abarbanel, David Cannings, David Diallo,<br>> >> >>>> David Maciejak, Duarte Silva, Eduardo Arada, Giuseppe Longo,<br>> >> >>>> Greg Siemon, Hayder Sinan, Helmut Schaa, Jason Ish,<br>> >> >>>> Jeff Barber, Ken Steele, lessyv, Mark Webb-Johnson,<br>> >> >>>> Mats Klepsland, Matt Carothers, Michael Rash, Nick Jones,<br>> >> >>>> Pierre Chifflier, Ray Ruvinskiy, Samiux A, Schnaffon,<br>> >> >>>> Stephen Donnelly, sxhlinux, Tom DeCanio, Torgeir Natvig,<br>> >> >>>> Travis Green, Zachary Rasmor<br>> >> >>>><br>> >> >>>><br>> >> >>>> *About Suricata*<br>> >> >>>><br>> >> >>>> Suricata is a high performance Network IDS, IPS and Network Security<br>> >> >>>> Monitoring engine. Open Source and owned by a community run<br>> >> >>>> non-profit<br>> >> >>>> foundation, the Open Information Security Foundation (OISF). Suricata<br>> >> >>>> is<br>> >> >>>> developed by the OISF, its supporting vendors and the community.<br>> >> >>>><br>> >> >>>> November 9-11 we'll be in Washington, DC, for our 2nd Suricata User<br>> >> >>>> Conference: <a href="http://oisfevents.net">http://oisfevents.net</a><br>> >> >>>><br>> >> >>>> If you need help installing, updating, validating and tuning Suricata<br>> >> >>>> we<br>> >> >>>> have a training program. Please see <a href="http://suricata-ids.org/training/">http://suricata-ids.org/training/</a><br>> >> >>>><br>> >> >>>> For support options also see <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>> >> >>>><br>> >> >>> _______________________________________________<br>> >> >>> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>> >> >>> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support:<br>> >> >>> <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>> >> >>> List:<br>> >> >>> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> >> >>> Suricata User Conference November 9-11 in Washington, DC:<br>> >> >>> <a href="http://oisfevents.net">http://oisfevents.net</a><br>> >> >><br>> >> >> _______________________________________________<br>> >> >> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>> >> >> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support:<br>> >> >> <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>> >> >> List:<br>> >> >> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> >> >> Suricata User Conference November 9-11 in Washington, DC:<br>> >> >> <a href="http://oisfevents.net">http://oisfevents.net</a><br>> >> ><br>> >> ><br>> >> > _______________________________________________<br>> >> > Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>> >> > Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support:<br>> >> > <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>> >> > List:<br>> >> > <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> >> > Suricata User Conference November 9-11 in Washington, DC:<br>> >> > <a href="http://oisfevents.net">http://oisfevents.net</a><br>> >><br>> >><br>> >><br>> >> --<br>> >> Regards,<br>> >> Peter Manev<br>> >> _______________________________________________<br>> >> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>> >> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>> >> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> >> Suricata User Conference November 9-11 in Washington, DC:<br>> >> <a href="http://oisfevents.net">http://oisfevents.net</a><br>> ><br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>> > Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>> > List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> > Suricata User Conference November 9-11 in Washington, DC:<br>> > <a href="http://oisfevents.net">http://oisfevents.net</a><br>> _______________________________________________<br>> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> Suricata User Conference November 9-11 in Washington, DC: <a href="http://oisfevents.net">http://oisfevents.net</a><br></div></div> </div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span>Suricata User Conference November 9-11 in Washington, DC: <a href="http://oisfevents.net">http://oisfevents.net</a></span></div></blockquote></body></html>