<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Erich,<div><br></div><div>THanks for the info. I will give it a shot.</div><div>How stable is this release? good enough for production?<br><br><div>> Date: Thu, 28 Jan 2016 14:26:43 +0100<br>> From: erich.lerch@gmail.com<br>> To: oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Suricata 3.0 is out!<br>> <br>> Yasha,<br>> <br>> 1. get the zip from<br>> https://github.com/inliniac/suricata/tree/dev-detect-grouping-v174<br>> 2. unzip<br>> 3. cd suricata-dev-detect-grouping-v174<br>> 4. git clone https://github.com/ironbee/libhtp<br>> 5. ./autogen.sh<br>> <br>> And now everything as usual, "./configure" with the params you usually<br>> use/need, and "make".<br>> <br>> suricata.yaml: basically you exchange the block "detect-engine" with<br>> the new variant from the config included in the zip (now called<br>> "detect").<br>> <br>> <br>> That's it... have fun<br>> erich<br>> <br>> <br>> 2016-01-28 13:10 GMT+01:00 Yasha Zislin <coolyasha@hotmail.com>:<br>> > Can somebody advise on how to compile with this grouping? and what is it<br>> > exactly?<br>> ><br>> > Thanks.<br>> ><br>> >> Date: Wed, 27 Jan 2016 22:49:57 +0100<br>> >> From: petermanev@gmail.com<br>> >> To: gfaulkner.nsm@gmail.com<br>> >> CC: oisf-users@lists.openinfosecfoundation.org<br>> >> Subject: Re: [Oisf-users] Suricata 3.0 is out!<br>> >><br>> >> On Wed, Jan 27, 2016 at 9:37 PM, Gary Faulkner <gfaulkner.nsm@gmail.com><br>> >> wrote:<br>> >> > Thanks for the replies folks, that is what I was hoping to know.<br>> >> ><br>> >> ><br>> >> > On 1/27/16 1:45 PM, Erich Lerch wrote:<br>> >> >><br>> >> >> I have dev-detect-grouping-v174 running on one system.<br>> >> >> Seems to be as stable as 3.0RC3 (didn't run 3.0final yet), I had no<br>> >> >> problems so far. And performance is better, yes. Start-up time is<br>> >> >> spectacularly better with big custom detect groups.<br>> >> >><br>> >><br>> >> I have only seen positive performance from dev-detect-grouping-v174 as<br>> >> well.<br>> ><br>> >><br>> >><br>> >> >> Cheers,<br>> >> >> erich<br>> >> >><br>> >> >><br>> >> >><br>> >> >> On 27.01.2016 19:14, Gary Faulkner wrote:<br>> >> >>><br>> >> >>> I did take a look at Redmine, but I didn't see obvious answers to a<br>> >> >>> couple questions. Did the stuff from the dev-grouping code branch make<br>> >> >>> it into this release? The discussion about the grouping code looked<br>> >> >>> very<br>> >> >>> promising for performance, so if it didn't make it's way in, is there<br>> >> >>> an<br>> >> >>> ETA, or is there a dev branch that is fairly well synced up with<br>> >> >>> release<br>> >> >>> at this point or that folks have tried and feel is worth giving a go<br>> >> >>> in<br>> >> >>> production? Also is PF_RING ZC now supported and working correctly? I<br>> >> >>> recall seeing that NTOP had interacted with the Suricata team at one<br>> >> >>> point to resolve an issue there, but don't see anything about it in<br>> >> >>> the<br>> >> >>> release notes.<br>> >> >>><br>> >> >>> Regards,<br>> >> >>> Gary<br>> >> >>><br>> >> >>> On 1/27/16 8:14 AM, Victor Julien wrote:<br>> >> >>>><br>> >> >>>> We're proud to announce Suricata 3.0. This is a major new release<br>> >> >>>> improving Suricata on many fronts.<br>> >> >>>><br>> >> >>>> *Download*<br>> >> >>>> http://www.openinfosecfoundation.org/download/suricata-3.0.tar.gz<br>> >> >>>><br>> >> >>>><br>> >> >>>> *Features and Improvements*<br>> >> >>>><br>> >> >>>> - improved detection options, including multi-tenancy and xbits<br>> >> >>>> - performance and scalability much improved<br>> >> >>>> - much improved accuracy and robustness<br>> >> >>>> - Lua scripting capabilities expanded significantly<br>> >> >>>> - many output improvements, including much more JSON<br>> >> >>>> - NETMAP capture method support, especially interesting to FreeBSD<br>> >> >>>> users<br>> >> >>>> - SMTP inspection and file extraction<br>> >> >>>><br>> >> >>>> For a full list of features added, please see:<br>> >> >>>> https://redmine.openinfosecfoundation.org/versions/80<br>> >> >>>><br>> >> >>>><br>> >> >>>> *Upgrading*<br>> >> >>>><br>> >> >>>> Upgrades from 2.0 to 3.0 should be mostly seamless. Here are some<br>> >> >>>> notes:<br>> >> >>>><br>> >> >>>><br>> >> >>>><br>> >> >>>> https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Upgrading_Suricata_20_to_Suricata_30<br>> >> >>>><br>> >> >>>><br>> >> >>>><br>> >> >>>> *Special thanks*<br>> >> >>>><br>> >> >>>> We'd like to thank the following people and corporations for their<br>> >> >>>> contributions and feedback:<br>> >> >>>><br>> >> >>>> FireEye, ProtectWise, ANSSI, Emerging Threats /<br>> >> >>>> Proofpoint, Stamus Networks, Ntop, AFL project, CoverityScan<br>> >> >>>><br>> >> >>>> Aaron Campbell, Aleksey Katargin, Alessandro Guido,<br>> >> >>>> Alexander Gozman, Alexandre Macabies, Alfredo Cardigliano,<br>> >> >>>> Andreas Moe, Anoop Saldanha, Antti Tönkyrä, Bill Meeks,<br>> >> >>>> Darien Huss, David Abarbanel, David Cannings, David Diallo,<br>> >> >>>> David Maciejak, Duarte Silva, Eduardo Arada, Giuseppe Longo,<br>> >> >>>> Greg Siemon, Hayder Sinan, Helmut Schaa, Jason Ish,<br>> >> >>>> Jeff Barber, Ken Steele, lessyv, Mark Webb-Johnson,<br>> >> >>>> Mats Klepsland, Matt Carothers, Michael Rash, Nick Jones,<br>> >> >>>> Pierre Chifflier, Ray Ruvinskiy, Samiux A, Schnaffon,<br>> >> >>>> Stephen Donnelly, sxhlinux, Tom DeCanio, Torgeir Natvig,<br>> >> >>>> Travis Green, Zachary Rasmor<br>> >> >>>><br>> >> >>>><br>> >> >>>> *About Suricata*<br>> >> >>>><br>> >> >>>> Suricata is a high performance Network IDS, IPS and Network Security<br>> >> >>>> Monitoring engine. Open Source and owned by a community run<br>> >> >>>> non-profit<br>> >> >>>> foundation, the Open Information Security Foundation (OISF). Suricata<br>> >> >>>> is<br>> >> >>>> developed by the OISF, its supporting vendors and the community.<br>> >> >>>><br>> >> >>>> November 9-11 we'll be in Washington, DC, for our 2nd Suricata User<br>> >> >>>> Conference: http://oisfevents.net<br>> >> >>>><br>> >> >>>> If you need help installing, updating, validating and tuning Suricata<br>> >> >>>> we<br>> >> >>>> have a training program. Please see http://suricata-ids.org/training/<br>> >> >>>><br>> >> >>>> For support options also see http://suricata-ids.org/support/<br>> >> >>>><br>> >> >>> _______________________________________________<br>> >> >>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> >> >>> Site: http://suricata-ids.org | Support:<br>> >> >>> http://suricata-ids.org/support/<br>> >> >>> List:<br>> >> >>> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> >> >>> Suricata User Conference November 9-11 in Washington, DC:<br>> >> >>> http://oisfevents.net<br>> >> >><br>> >> >> _______________________________________________<br>> >> >> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> >> >> Site: http://suricata-ids.org | Support:<br>> >> >> http://suricata-ids.org/support/<br>> >> >> List:<br>> >> >> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> >> >> Suricata User Conference November 9-11 in Washington, DC:<br>> >> >> http://oisfevents.net<br>> >> ><br>> >> ><br>> >> > _______________________________________________<br>> >> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> >> > Site: http://suricata-ids.org | Support:<br>> >> > http://suricata-ids.org/support/<br>> >> > List:<br>> >> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> >> > Suricata User Conference November 9-11 in Washington, DC:<br>> >> > http://oisfevents.net<br>> >><br>> >><br>> >><br>> >> --<br>> >> Regards,<br>> >> Peter Manev<br>> >> _______________________________________________<br>> >> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> >> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> >> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> >> Suricata User Conference November 9-11 in Washington, DC:<br>> >> http://oisfevents.net<br>> ><br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > Suricata User Conference November 9-11 in Washington, DC:<br>> > http://oisfevents.net<br>> _______________________________________________<br>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net<br></div></div> </div></body>
</html>