Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.
Snort can be deployed inline to stop these packets, as well. Snort has three primary uses: As a packet sniffer like tcpdump, as a packet logger — which is useful for network traffic debugging, or it can be used as a full-blown network intrusion prevention system. Snort can be downloaded and configured for personal and business use alike.
 Homepage
 Download
Recent Releases
3.3.1.024 Jul 2024 02:45
major feature:
Appid: restructure the appid code to make it easier to follow and maintain.
Appid: updating appid cpu profiler cli.
Dce_rpc: correct the session counters post the upgrade to smb v2 from v1.
Detection: include OPT_TREE traces in release build.
Detection: make print of fast pattern as a trace module.
Extractor: support trans_depth, origin and referrer fields.
File: ing file context reuse.
Flow: clear flow stash when freeing the flow data.
Flow: handle significant groups with unknown group value as non-group flow keys.
Http_inspect: add origin header.
Parser: do not skip symbols while expanding variables.
Perf_monitor: introducing new parameters for ip flow profiling.
Stream_tcp: move prev_norm object from TcpNormalizer to TcpNormalizerState.
Stream_tcp: set daq_msg field in meta-ack pseudo-packet header to the value from the wire packet.
Stream_tcp: support tracing without compilation flags.
Wizard: expand MMS curse.
3.3.0.011 Jul 2024 07:45
major feature:
Appid: display rows limit of table and totals.
Appid: using different api for picking appids for appid cpu profiler.
Build: bump version to 3.2.0.
Codecs: add handling of NDP types.
Dns: set Flow timeout after getting DNS response.
Extractor: add protocol logging for HTTP.
Framework: add new Cursor Action Type.
Http_inspect: set CAT_SET_SUB_SECTION for buffer with a sub-selector configured.
Js_norm: prerequisites for FlexLexer includes.
Main: add CLI command to show snort cpu percentage.
Stream_tcp: use default size atomsplitter on fallback.
Utils: remove duplication of definition. Thanks to xxxx81 for reporting the.
3.2.2.007 Jun 2024 16:05
major feature:
Appid: appid cpu profiler max columns.
Appid: re-enabling appid cpu profiler making it thread safe.
Appid: store and retrieve only SNI in AppIdSession.
Appid: updating file_magic.rules with some new file types added to the VDB.
Dce_smb: do not prune from LRU cache during file tracker update.
Doc: formatting in dev_notes.txt.
Flow: add the newly-created flow to p- flow to avoid segv.
Js_norm: stop PDF processing on syntax error.
Main: apply loaded configuration only once.
Packet_capture: make sure packet_capture executed before detection.
Service_inspectors: get_buf handling.
Sip: flow clean-up based on lina configured timeout.
Src: remove repetitive words. Thanks @gopherorg for finding those typos.
Src: udpate to resolve new stream_tcp: don't attempt to verify or process keep-alive probes with data.
Stream_tcp: infinite recursion cases. Thanks to scloder-ut-iso for helping with deinformation that uncovered a case of infinite recursion.
Utils: add explicit include.
3.2.1.022 May 2024 13:25
major bugfix:
Framework: supply directories to system headers to plug_gen.sh.
Main: updates for types used by Alpine.
Memory: unit test.
3.1.84.012 Apr 2024 08:25
major bugfix:
Appid: enhanced appid config parsing.
Appid: remove locks from peg counts.
Appid: separate main thread and packet thread appid_pub_id.
Dce_smb: ing an ASAN memory corruption detection: handle policy changes in continuation.
Framework: add correct cast from double to unsigned.
Http_inspect: add file_data to buffer list.
Packet_capture: include cstdint in a header file. Thanks to Plup and Hauke Mehrtens for reporting this!.
Xhash: typo.
3.1.83.026 Mar 2024 03:25
major bugfix:
Detection: use correct packet in trace logs.
Doc: add libml to optional dependencies.
Flow: add filter to dump flows.
Flow: UT.
Hash: exception handling for random device.
Packet_capture: wrong dlt in pcap header when nfq is used.
Stream: count retransmits when we disable content rules.
Trace: replace colon delimiter for tenant with whitespace in the trace_logger output.
3.1.82.015 Mar 2024 10:05
major feature:
Appid: broadcast commands with ctrlcon.
Appid: change eve pattern matching logic.
Appid: replaced warning log with logging api for CBD.
File_api: do not clear the file capture and user file data pointers when updating the verdict from the cache.
Filters: updated dyn array with vector.
Flow: updated flow_data linklist with STL container.
Framework: validate parameter of number type in a string form.
Kaizen: rename to Snort ML.
Main: clear lua stack when registering commands in a shell.
Main: reset main-thread stats from the main thread.
Main: update limits help.
Packet_capture: add packet capturing per tenant.
Sfip: remove references to unused mode feature.
Sfip: zero out var/node pointers after operations to remedy heap-use-after-free on reload.
Smb: for improper session cache destruction in tterm during config reload.
Snort2lua: change deprecated use of ptr_fn to lambda.
Stats: timing stats.
Stats: perf improvement changes.
Stream: remove splitter from session before inspectors.
Stream_tcp: add reasons for drops due to trims.
Stream_tcp: implement support for proxy mode normalization behavior.
Stream_tcp: update documentation for stream TCP alerts to include the new 129:21 and 129:22 alerts.
Trace: add tenants logging.
3.1.81.021 Feb 2024 18:05
major feature:
Appid: check tenant_match() if required.
Appid: log error message instead of fatal error if appid stats logfile is not accessible.
Appid: Lowering max packet count before service fail.
Control: Adds counting to ctrlcon blocked to allow for nested commands.
Detection: add c'tors, use new instead of snort_calloc.
Detection: copy ip var name in dup_rtn.
Flow: added ips event suppression flags.
Host_cache: update_stats to remove race_condition.
Http_inspect: recreate JSNorm if reload takes place inside transaction.
Ips_context: add lazy-allocation of alt buffer.
Kaizen: provide an option to enable Kaizen's mock.
Kaizen: remove redundant semicolon and add explicit cast.
Kaizen: rename modules.
Lua: improve spell of wizard for HTTP.
Memory: prevent data race between main and packet threads.
Service_inspectors: add check for JSNorm config actuality.
Stream_tcp: add alerts for exceeding thresholds for max queued bytes or segments.
Stream_tcp: add check to verify seglist head is not nullptr and only initialize PAF when it is not.
Utils: add macro for setting thread name.
3.1.78.019 Jan 2024 13:32
major bugfix:
* appid: print odp version and odp detector count on startup
* copyright: update year to 2024
* doc: update arg list for "generate_builtin.sh". Add parity to "generate_" scripts arg list, thanks to @puck(https://github.com/puck)
* main: fix inconsistent lua variables assignment
* parser: fix --dump-rule-meta for negated ports
| 
