|
Suricata v0.8.1 released The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. New features: - the engine will now detect the number of cpu’s/core’s and setup the engine to use them fully - libhtp is now included in the source - experimental CUDA support for NVIDIA GPU accelerated pattern matching - initial support for Win32 (using mingw) was added - FreeBSD/Mac OS X IPFW inline support was added - many options in the configuration file for performance tuning - VLAN decoding support was added - Prelude output support Major issues fixed & improvements made: - threading issues in the unified1 and unified2 logging modules - major stream engine issues were solved - uricontent, urilen inspection is now done against the libhtp parsed uri - ip only signature detection fixes in inline mode - add the /P (request body) option to the pcre keyword - many SMB, SMB2 and DCERPC improvements - logging is more configurable - pcap and pfring modes support for bpf was added - many bugs were fixed, cleanups were made Known issues: - Some signatures fail to load because of missing keywords or keyword options - We have identified some serious performance issues with certain signatures and traffic combinations - Although we improved big endian support, there are still some issues - CUDA code is expected to work only on 32bit and probably doesn’t speed things up yet as we will need further redsign to fully benefit You can download Suricata in here : Linux/Mac/FreeBSD/UNIX Source: http://www.openinfosecfoundation.org/download/suricata-0.8.1.tar.gz PGP Signature: http://www.openinfosecfoundation.org/download/suricata-0.8.1.tar.gz.sig Build Requirements: - gcc - make - g++ If building from the git repository you will also need: - automake - autoconf - libtool Library Requirements: - libpcre - libnet 1.1.x - libyaml - libpcap - libnetfilter-queue and libfnetlink (optional for use with ./configure --enable-nfqueue) - libpthread (should be part of most glibc's) - libpfring (optional for use with ./configure --enable-pfring) - libz - htp For Debian/Ubuntu Users sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \ build-essential autoconf automake libtool libpcap-dev libnet1-dev \ libyaml-0-1 libyaml-dev zlib1g zlib1g-dev ### HTP wget http://www.openinfosecfoundation.org/download/htp-current.tar.gz tar -xzvf htp-current.tar.gz cd htp-<version> ./configure make make install ldconfig #if using ubuntu-8.04 to use prebuilt yaml packages you need to uncomment the following two lines in your /etc/apt/sources.list to enable hardy-backports. #deb http://us.archive.ubuntu.com/ubuntu/ hardy-backports main restricted universe multiverse #deb-src http://us.archive.ubuntu.com/ubuntu/ hardy-backports main restricted universe multiverse #if building with IPS capabilities via ./configure --enable-nfqueue sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev libnfnetlink0 ### Suricata: wget http://www.openinfosecfoundation.org/download/suricata-current.tar.gz tar -xvzf suricata-current.tar.gz cd suricata.<version> If building from git sources: bash autojunk.sh #else ./configure sudo mkdir /var/log/suricata/ make make install Reference : http://www.openinfosecfoundation.org/ |