Snort Version 1.8 Release
Source: snort.org - Posted by Ryan W. Maple   
Intrusion Detection Snort is a lightweight network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks . . . Snort is a lightweight network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture. Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient.

 Subject: [Snort-users] Snort 1.8 released    Date: Mon, 09 Jul 2001 23:52:27 -0400    From: Martin Roesch   In a dress-rehearsal for the impending arrival of his baby later this month, Martin Roesch has finally squeezed out Snort version 1.8.    Snort 1.8 is available at:  http://www.snort.org/files/snort-1.8-RELEASE.tar.gz  Version 1.8 incorporates a number of changes and new features, including some of the following:  New things: * Stateful inspection and TCP stream reassembly module * High performance IP defragmenter module * High performance unified binary output module * Tagging allows hosts that trip events to be tracked/logged * Unique Rule IDs for every Snort rule and new printout code make machine processing of Snort output much easier * Enhanced cross-reference data with alerts * Classifications and Priorities added to rules language * ARP spoofing detection * "IP" is now a supported protocol type in the Snort rules language * Back Orifice detection plugin * Telnet normalization plugin defeats telnet and ftp evasion techniques * RPC normalization plugin defeats RPC fragmentation evasion techniques * CSV format output plugin * "uricontent" keyword allows HTTP traffic to be searched for data in the URI field only * 802.1Q decoder support * linux_sll decoder support * tcp window detection plugin * same IP detection plugin * -T switch to test Snort config before running * -y switch to add year to timestamps * -I switch to print interface name in Snort alerts * -G switch for backawards compatability with old cross-reference lookup progs * -L switch for naming the -b binary output file * -k switch to tune checksum verification routines * -z switch to run the rules engine in stateful mode (with stream4)  Additionally, there were a ton of fixes and development in the rest of the code, and the spo_xml and spo_database routines have matured over the past 6 months as well.  The full Changelog can be seen at http://www.snort.org/Changelog.htm for the changes since 1.7 was released last January.  I'd like to thank Fyodor Yarochkin, Brian Caswell, Phil Wood, Jed Pickel, Roman Danyliw, Dragos Ruiu, Jim Forster, Max Vision, the Silicon Defense gang, Chris Cramer, Eugene Tsyrklevich, Chris Green, HD Moore, DrSuse, Jeff Nathan and the whole gang on #snort for helping to make it happen.    Happy Snorting!       -Marty 

Only registered users can write comments.
Please login or register.

Powered by AkoComment!