[Oisf-users] Suricata RC1 Released!

[Matt Jonkman]

The OISF development team is proud to introduce the first release
candidate of Suricata, the Open Source Intrusion Detection and
Prevention engine. We're working towards our first stable release,
currently scheduled for July 1st, 2010.

Get the new release here:
http://www.openinfosecfoundation.org/download/suricata-0.9.0.tar.gz



New features

- Support for the http_headers keyword was added

- libhtp was updated to version 0.2.3

- Privilege dropping using libcap-ng is now supported

- Proper support for "pass" rules was added

- Inline mode for Windows was added



Improvements

 - A regression in the detection engine causing false negatives was fixed

- Many accuracy and stability improvements have been made



Known issues & missing features

The OISF has made significant progress towards reaching the first full
(non-beta) release of Suricata.  Your feedback is always important to us
and we appreciate your time and effort. As always, we are doing our best
to make you aware of continuing development and items within the engine
that are not yet complete.  With this in mind, please notice the list we
have included of known items currently being addressed.



- Using the http_cookie keyword seems to cause a match on all packets.

- Currently we don't support the dce option for byte_test and byte_jump.

- Stream reassembly is currently only performed for app-layer code.

- Inconsistent time stamps in http log file due to handling & updating
of the http state.

- DCE/RPC over udp is not currently supported.

- dce_stub_data does not respect relative modifiers.

- Engine does not work properly on big endian platforms.

- Time based stats are not calculated correctly.



See https://redmine.openinfosecfoundation.org/projects/suricata/issues
for an up to date list and to report new issues.




----------------------------------------------------
Matthew Jonkman
Emerging Threats
Open Information Security Foundation (OISF)
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
http://www.openinfosecfoundation.org
----------------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc