[Oisf-devel] Suricata 1.4beta3 Available for testing!

[Victor Julien]

The OISF development team is proud to announce Suricata 1.4beta3. This
is the third beta release for the upcoming 1.4 version.

This is release has significant improvements to the packet acquisition.
The Napatech capture card support has been updated by our supporter
Npulse. The Pcap, PF_RING and AF_PACKET capture methods now feature live
drop stats.

Get the new release here:
http://www.openinfosecfoundation.org/download/suricata-1.4beta3.tar.gz

New features

- support for Napatech cards through their 3rd generation driver was
added by Matt Keeler from Npulse (#430, #619)
- support for pkt_data keyword was added
- user and group to run as can now be set in the config file
- make HTTP request and response body inspection sizes configurable per
HTTP server config (#560)
- PCAP/AF_PACKET/PF_RING packet stats are now printed in stats.log
(#561, #625)
- add stream event to match on overlaps with different data in stream
reassembly (#603)

Improvements

- add contrib directory to the dist (#567)
- performance improvements to signatures with dsize option
- improved rule analyzer: print fast_pattern along with the rule (#558)
- fixes to stream engine reducing the number of events generated (#604)
- stream.inline option new defaults to "auto", meaning enabled in IPS
mode, disabled in IDS mode (#592)
- HTTP handling in OOM condition was greatly improved (#557)
- filemagic keyword performance was improved (#585)
- updated bundled libhtp to 0.2.11
- build system improvements and cleanups

Fixes

- fixes and improvements to daemon mode (#624)
- fix drop rules not working correctly when thresholded (#613)
- fixed a possible FP when a regular and "chopped" fast_pattern were the
same (#581)
- fix a false possitive condition in http_header (#607)
- fix inaccuracy in byte_jump keyword when using "from_beginning" option
(#627)
- fixes to rule profiling (#576)
- cleanups and misc fixes (#379, #395)
- fix to SSL record parsing

Credits

We'd like to thank the following people and corporations for their
contributions and feedback:

- Matt Keeler - Npulse
- Chris Wakelin
- Rmkml
- Will Metcalf
- Ivan Ristic
- Kyle Creyts
- Michael Hoffrath

Known issues & missing features

In a beta release like this things may not be as polished yet. So please
handle with care. That said, if you encounter issues, please let us
know! As always, we are doing our best to make you aware of continuing
development and items within the engine that are not yet complete or
optimal.  With this in mind, please notice the list we have included of
known items we are working on.

See http://redmine.openinfosecfoundation.org/projects/suricata/issues
for an up to date list and to report new issues. See
http://redmine.openinfosecfoundation.org/projects/suricata/wiki/Known_issues
for a discussion and time line for the major issues.

About Suricata

Suricata is a high performance Network IDS, IPS and Network Security
Monitoring engine. Open Source and owned by a community run non-profit
foundation, the Open Information Security Foundation (OISF). Suricata is
developed by the OISF, its supporting vendors and the community.
-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------