LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: October 20th, 2014
Linux Advisory Watch: October 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Snort Version 1.8 Release Print E-mail
User Rating:      How can I rate this item?
Source: snort.org - Posted by Ryan W. Maple   
Intrusion Detection Snort is a lightweight network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks . . . Snort is a lightweight network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture. Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient.

 Subject: [Snort-users] Snort 1.8 released    Date: Mon, 09 Jul 2001 23:52:27 -0400    From: Martin Roesch   In a dress-rehearsal for the impending arrival of his baby later this month, Martin Roesch has finally squeezed out Snort version 1.8.    Snort 1.8 is available at:  http://www.snort.org/files/snort-1.8-RELEASE.tar.gz  Version 1.8 incorporates a number of changes and new features, including some of the following:  New things: * Stateful inspection and TCP stream reassembly module * High performance IP defragmenter module * High performance unified binary output module * Tagging allows hosts that trip events to be tracked/logged * Unique Rule IDs for every Snort rule and new printout code make machine processing of Snort output much easier * Enhanced cross-reference data with alerts * Classifications and Priorities added to rules language * ARP spoofing detection * "IP" is now a supported protocol type in the Snort rules language * Back Orifice detection plugin * Telnet normalization plugin defeats telnet and ftp evasion techniques * RPC normalization plugin defeats RPC fragmentation evasion techniques * CSV format output plugin * "uricontent" keyword allows HTTP traffic to be searched for data in the URI field only * 802.1Q decoder support * linux_sll decoder support * tcp window detection plugin * same IP detection plugin * -T switch to test Snort config before running * -y switch to add year to timestamps * -I switch to print interface name in Snort alerts * -G switch for backawards compatability with old cross-reference lookup progs * -L switch for naming the -b binary output file * -k switch to tune checksum verification routines * -z switch to run the rules engine in stateful mode (with stream4)  Additionally, there were a ton of fixes and development in the rest of the code, and the spo_xml and spo_database routines have matured over the past 6 months as well.  The full Changelog can be seen at http://www.snort.org/Changelog.htm for the changes since 1.7 was released last January.  I'd like to thank Fyodor Yarochkin, Brian Caswell, Phil Wood, Jed Pickel, Roman Danyliw, Dragos Ruiu, Jim Forster, Max Vision, the Silicon Defense gang, Chris Cramer, Eugene Tsyrklevich, Chris Green, HD Moore, DrSuse, Jeff Nathan and the whole gang on #snort for helping to make it happen.    Happy Snorting!       -Marty 

Only registered users can write comments.
Please login or register.

Powered by AkoComment!

 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
The Hacktivist as Angry Young Man
The Hacker Wars Hits NYC
CAINE Linux Distribution Helps Investigators With Forensic Analysis
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.