Snort3

No entries match these filters. Clear filters

1. 3.12.4.0 Oct 21, 2026 · issue 116

   Snort3 3.12.4.0 adds brotli decompression, JSON stats export, RST_STREAMRST_STREAMAn HTTP/2 frame type that immediately cancels a single stream without closing the whole connection, letting a sender abort a request or response mid-flight without tearing down the underlying TCP session. rate limiting, configurable response pages, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. sequence tracing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.12.4.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.12.4.0

   └──▷ USE IT
   Use relative sequence numbers in TCP traces to make stream_tcp output easier to read during a session investigation.
   snort.lua copy

   stream_tcp = { trace_seq_relative = true }

   Enable stop_after_match on buffered logging to halt log output after the first matching event, reducing noise in high-volume environments.
   snort.lua copy

   logger = { stop_after_match = true }

   • Adds a trace_seq_relative option to stream_tcp to toggle between relative and absolute TCP sequence numbers in traces, and adds asymmetric-specific sequence span normalization checks to stream_tcp.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds http2_inspect configurable RST_STREAM rate threshold to cap RST_STREAM abuse.
   • Adds brotli decompression support to http_inspect.
   • Adds support for dumping stats in JSON format via stats.
   • Adds peg counters to file_api for extended file observability.

   +5 more show less

   • Adds peg counter for max header count to http_inspect.
   • Adds dynamic enable/disable commands for buffered logging with configurable stop_after_match to logger.
   • Adds stream_log and flow_log helpers to stream for multi-destination PacketTracer output.
   • Supports configurable response pages per action variable in react.
   • Adds QinQ outer VLAN tag support to main.
   • Adds a trace_seq_relative option to stream_tcp to toggle between relative and absolute TCP sequence numbers in traces, and adds asymmetric-specific sequence span normalization checks to stream_tcp.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds brotli decompression support to http_inspect.
   • Adds support for dumping stats in JSON format via stats.
   • Adds peg counters to file_api for extended file observability.
   • Adds dynamic enable/disable commands for buffered logging with configurable stop_after_match to logger.

   +2 more show less

   • Adds stream_log and flow_log helpers to stream for multi-destination PacketTracer output.
   • Adds QinQ outer VLAN tag support to main.

   3 more in Everything

2. 3.12.2.0 Apr 23, 2026 · release notes

   Snort3 3.12.2.0 adds Lua API for device-info events, two-way SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cache, connection ID tracking, and SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates.-boundary HTTP publishing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.12.2.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.12.2.0

   • New AppID Lua API for publishing device-info events to the DataBus.
   • Adds two-way SSL cache data support in AppID for richer TLS session tracking.
   • Adds a connection ID field to flow objects, settable by external modules.
   • Extractor now prints connection ID as UID whenever one is available.
   • HTTP Inspect publishes events on Server-Sent Events (SSE) boundaries.

   +4 more show less

   • File API generates advance log entries for files with unknown verdicts.
   • File API caches file_adv_pub_id for more efficient DataBus publishes.
   • Packet Tracer displays ICMP type and zero destination port in trace output.
   • Adds initial decompression fuzzers and build support in the decompress module.

   9 details in Everything

3. 3.12.1.0 Mar 18, 2026 · release notes

   Snort3 3.12.1.0 adds FILE logging and richer SSH telemetry to the extractor, plus payload injection for HTTP/HTTP2 s2c traffic.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.12.1.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.12.1.0

   • Adds FILE logging output to the extractor module.
   • Adds SSH event logging to the extractor, including direction, version, and computed shared (selected) algorithm fields.
   • Adds payload injection support for server-to-client (s2c) packets on HTTP and HTTP2 traffic in the payload injector.
   • Adds dump_inspector_map command to the inspector manager for serviceability.
   • Adds list_plugins command for serviceability.

   +3 more show less

   • Enables so (shared object) library reloads for the OPC-UAOPC-UAAn open, platform-neutral communication protocol for industrial automation systems, maintained by the OPC Foundation, giving cyber tools a standardized way to read and monitor data from PLCs, sensors, and SCADA equipment. inspector.
   • Adds content-length validation in the pub/sub subsystem.
   • Removes the block_udp_fragmentation configuration option from the socks inspector.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The block_udp_fragmentation configuration option has been removed from the socks inspector; any config referencing it will break.
   • !The ssl.server_name_identifier field in the extractor has been renamed; consumers of that field must update their references.
   • !Plugins API version has been bumped for base and all types; rules from snort.org require the Talos_lightSPD package from version 2026-03-16-001 or later.
4. 3.11.1.0 Feb 28, 2026 · release notes

   Snort 3.11.1.0 adds AppID midstream detection, HTTP decoded URI IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. option, SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. inspector, and expanded file/extractor telemetry.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.11.1.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.11.1.0

   └──▷ TRY IT
   Detect decoded HTTP URIs in IPS rules — useful for catching evasion via URL encoding in inspected traffic.
   copy

   $ alert http any any -> any any (msg:"Decoded URI match"; http_decoded_uri; content:"/etc/passwd"; sid:1000001;)

   Enable the KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. failed_login flag to surface brute-force or credential-stuffing events in AppID telemetry.
   lua copy

   kerberos = { failed_login = true }

   Enable the SOCKS inspector to gain visibility into SOCKS-proxied traffic flows.
   lua copy

   socks = {}

   • Adds AppID SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. service detection during midstream sessions.
   • Adds AppID server and client port inspection during midstream; adds NFSv4.1 protocol support.
   • New http_decoded_uri IPS rule option and decoded URI buffer with shared decoded path in http_inspect.
   • New socks inspector for SOCKS protocol traffic analysis.
   • Adds Kerberos config option to set the failed_login flag in the Kerberos client detector.

   +9 more show less

   • Adds file_api buffer data to perf-monitor output and packet tracer logs; adds extractor field support.
   • Saves DAQ header flow_id into the Flow object; includes flow_id in dump_flows command output.
   • New get_content_length method on HttpEvent pub/sub API.
   • Adds RNA support for deviceinfo fingerprint processing and events.
   • Adds multi-logging feature in trace to support new Lua configuration.
   • SSL inspector now alerts on multiple ClientHello certificate records.
   • Improves MMSMMSMultimedia Messaging Service, a mobile carrier protocol that extends SMS to carry images, audio, and video between handsets; cyber tools use it to analyze or simulate rich-media mobile message delivery. wizard curse against fragmented traffic and enhances MMS presentation context search.
   • Enhanced shadowtraffic logging to system support trace.
   • Lockless event ring in mp_dbus for improved multiprocessing throughput.

   14 details in Everything

5. 3.10.2.0 Jan 22, 2026 · release notes

   Snort 3.10.2.0 adds configurable midstream AppID discovery, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. AppID priority, and a new show_flows utility for binary flow-state dumps.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.10.2.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.10.2.0

   └──▷ TRY IT
   Convert a binary dump_flows capture to human-readable text for offline analysis or ingestion into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
   copy

   $ show_flows <path-to-binary-dump>

   • Adds configurable midstream service discovery in AppID, enabling detection of sessions that begin before Snort starts inspecting.
   • AppID now prefers QUIC client application ID over SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. when both are available, improving accuracy for QUIC traffic classification.
   • Refactors dump_flows command to output flow state in binary format for more efficient storage and processing.
   • Introduces show_flows utility program to convert dump_flows binary files into human-readable text containing flow state data for each flow.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The dump_flows command now outputs flow state in binary format instead of text; existing tooling or scripts that parse plain-text dump_flows output will break and must be updated to use the new show_flows utility.
6. 3.10.1.0 Jan 13, 2026 · release notes

   Snort3 3.10.1.0 adds AppID JSON logging, out-of-order packet inspection, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. parsing, MIME multipart/form-data content parsing, and ML client body scanning.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.10.1.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.10.1.0

   • Adds AppID application-ID logging support to the alert_json output module.
   • Enables out-of-order packet inspection in the AppID third-party engine, now on by default.
   • Adds mDNS TXT record parsing and deviceinfo event generation in AppID.
   • Implements content parsing of multipart/form-data in the MIME processor.
   • Adds flow creation failure logging to surface the different ways a flow can fail to be established.

   +9 more show less

   • Adds is_urlencoded method to the pub_sub API.
   • Adds urlencoded content-type to the http_inspect recognized content-type list.
   • Enables snort_ml client body scanning by default.
   • Adds snort_ml scanning of multipart form data.
   • Adds TransbridgeCodec encode function to the decoder.
   • Adds configurable cmd_len in ftp_telnet for improved command-length control.
   • Adds alerting on malformed FTP traffic in ftp_telnet.
   • Updates SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. filename and filesize handling in FileInfo to enable DLP evaluation for repeated transactions.
   • Adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. config command usage support.

   14 details in Everything

7. 3.10.0.0 Nov 25, 2025 · release notes

   Snort3 3.10.0.0 adds OPC UA inspection, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. extraction, DNS flavor counters, and new main-queue and data-bus APIs.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.10.0.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.10.0.0

   └──▷ USE IT
   Tune how long Snort retries queued packets before dropping them under load.
   lua copy

   main = { retry_queue_timeout = 500 }

   • Adds OPC UA protocol inspector for industrial control system traffic analysis.
   • New QUIC extractor captures metadata from QUIC protocol flows.
   • Adds counters for different DNS flavors (e.g., DNS-over-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., DNS-over-UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.) for visibility into resolver traffic.
   • New retry queue timeout option for the main packet processing queue.
   • New unsubscribe API on the multi-process data bus (mp_data_bus).

   +2 more show less

   • SSH inspector now exposes fields to the extractor framework for session metadata logging.
   • HTTP inspect request and response buffers renamed.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The HTTP inspect request and response buffers are renamed — rules or configurations referencing the old buffer names will break.
8. 3.9.7.0 Nov 7, 2025 · release notes

   Snort3 3.9.7.0 adds DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering./QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. detection, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. buffers in HTTP inspect, and new flow pruning telemetry.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.9.7.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.9.7.0

   • Adds AppID support for DNS over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring.) and DNS over QUIC (DoQ), enabling detection of encrypted DNS traffic.
   • Adds multi-stream support for DNS in AppID, improving classification across concurrent DNS flows.
   • Adds WAF buffers to http_inspect, providing new inspection surfaces for web application firewall rules.
   • Adds new pegs and packet tracer logging for flow prune events, improving visibility into session eviction.
   • Adds FNV-1a hash algorithm to the hash module.

   +5 more show less

   • Adds an SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. extractor event in the ssl preprocessor.
   • Adds MPSE and LRU cache to snort_ml, expanding the machine-learning detection engine's performance capabilities.
   • Enhances TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. RST validation to follow RFC 5961 recommendations in stream_tcp.
   • Adds partial inspection on the HTTP start line in http_inspect.
   • Increases the maximum length of LogMessage output in the log module.

   10 details in Everything

9. 3.9.6.0 Oct 6, 2025 · release notes

   Snort3 3.9.6.0 adds AppID Lua detector API, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. logging events, and an HTTP encoding-type inspection API.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.9.6.0 https://github.com/snort3/snort3.git
   # already have the repo? check out this version:
   $ git checkout 3.9.6.0

   • Adds setUserDetectorDataItem Lua detector API to AppID for setting user detector data items programmatically.
   • Adds QUIC logging events via pub_sub, enabling visibility into QUIC traffic flows.
   • Adds an API in HttpEvent to determine whether an HTTP response uses a supported encoding type.
   • Adds a log message when Snort is unable to set CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. affinity, improving operational diagnostics.
   • Extends trace output to print n-tuple information for non-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. packet types that have an IP layer set.

   5 details in Everything

10. 3.9.5.0 Sep 4, 2025 · release notes

    Snort3 3.9.5.0 adds HTTP partial header inspection, opportunistic TLS publishing, and atomic watchdog improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.5.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.9.5.0

    • Adds partial inspection support for HTTP headers in http_inspect, enabling analysis of incomplete header data.
    • Publishes OPPORTUNISTIC_TLS events from http_inspect, allowing detection of TLS upgrade attempts on plain-text connections.
    • Replaces the watchdog command with atomic kicking from packet threads, improving reliability of the watchdog mechanism under load.

    3 details in Everything

11. 3.9.3.0 Aug 11, 2025 · release notes

    Snort 3.9.3.0 adds batched logger with CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. affinity, new HTTP inspect peg count, IEC 104 abort fallback, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. splitter restart support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.3.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.9.3.0

    • Adds a batched logger to improve packet_tracer output performance, with CPU affinity control for the log writer thread.
    • Adds a peg count for HTTP inspect tracking when a published body reaches the requested maximum size.
    • Adds fallback functionality for IEC 104 abort scenarios.
    • Adds a splitter restart function to stream_tcp, restarting when a hole is skipped by AtomSplitter.
    • Adds random base file ID generation for IMAP, POP, and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. service inspectors.

    +4 more show less

    • Enables exporting compile commands from the build system.
    • Notifies DAQ via ioctl message when a packet is injected.
    • Combines host pattern matchers in AppID for unified matching.
    • Extracts children-related and current-node evaluation logic into separate functions in the detection engine.

    9 details in Everything

12. 3.9.2.0 Jul 21, 2025 · release notes

    Snort3 3.9.2.0 adds CIP inspector fallback, multi-instance file cache sharing, and separate TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. sequence tracking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.2.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.9.2.0

    └──▷ USE IT
    Update your http_inspect configuration to use the renamed parameter so partial body inspection depth continues to work after upgrade.
    lua copy

    http_inspect = { partial_depth_body = 1000 }

    • Adds CIP inspector fallback functionality for handling unsupported CIP services gracefully.
    • Enables multi-instance Snort file cache sharing via the file API for coordinated file inspection across instances.
    • Separates logs and counters for left and right invalid TCP sequence numbers for more granular stream analysis.
    • Renames the HTTP inspect parameter partial_depth to partial_depth_body for body-specific partial inspection depth control.
    • Improves JSON Formatter performance in the extractor module.

    +1 more show less

    • Adds watchdog kick in flow dump summary to prevent stalls during flow reporting.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The http_inspect parameter partial_depth is renamed to partial_depth_body; existing configs using partial_depth will break on upgrade.
13. 3.9.1.0 Jul 2, 2025 · release notes

    Snort 3.9.1.0 adds binding-block-on-do-not-decrypt, buffered std_connector output, file-redirect for connectors, and partial_depth HTTP inspection config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.1.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.9.1.0

    └──▷ USE IT
    Limit HTTP body inspection to a fixed depth to reduce CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cost on large uploads while still catching header-layer threats.
    lua copy

    http_inspect = { partial_depth = 8192 }

    • Adds facility to block binding based on a do_not_decrypt flow flag and a new can_decrypt inspector method, enabling policy enforcement on encrypted flows that cannot be decrypted.
    • Adds buffered output to std_connector, improving throughput for high-volume event streams.
    • Adds redirect option to connectors to print output directly to a file instead of stdout.
    • Adds partial_depth configuration option to http_inspect for controlling inspection depth on partial HTTP content.
    • Adds context logging event for notice level in the extractor module.

    +5 more show less

    • Adds a 1-reader-1-writer ring buffer helper for internal pipeline efficiency.
    • AppID now differentiates between request and response DNS hostnames for more precise application identification.
    • AppID now synchronizes flow service with protocol-based detection.
    • Adds affinity setting for the connector flusher thread, enabling CPU pinning for performance tuning.
    • Profiler output now includes a note for total percentage in profiler_dump results.

    10 details in Everything

14. 3.8.1.0 May 28, 2025 · release notes

    Snort3 3.8.1.0 adds flow allowlisting, per-flow timestamp validation, gap detection, ESP IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, and richer HTTP event data.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.8.1.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.8.1.0

    • Adds option to move excess flows to the allowlist, giving operators a new overflow-handling strategy instead of dropping.
    • Implements per-flow packet timestamp checking: packets with timestamps earlier than the previous packet on that flow can now be dropped.
    • Adds stale-packet counting (always on) with configurable dropping; drop_stale_packets defaults to false.
    • Adds id_offset to filenames produced by stream.dump_flows(), enabling more granular file identification in high-volume captures.
    • Adds gap detection in the packet stream via the stream module, surfacing sequence holes for improved analysis.

    +5 more show less

    • Adds ESP to valid next-header types in IPv6 processing, broadening IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. traffic inspection coverage.
    • Exposes all headers, response string, and HTTP method from HttpEvent via pub_sub, enriching event-driven integrations.
    • Extends the extractor with support for the conn.log history field.
    • Adds handling for AYT (Are You There) commands in the Telnet splitter.
    • Prints stream_tcp state when queue limits are hit, aiding capacity and tuning diagnostics.

    10 details in Everything

15. 3.7.4.0 May 8, 2025 · release notes

    Snort3 3.7.4.0 adds multi-process databus, expanded extractor logging, and dynamic HTTP body publishing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.4.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.7.4.0

    • Adds weird and notice logging to the extractor module.
    • Extends extractor DNS support with additional DNS fields.
    • Adds conn.log orig_bytes and resp_bytes field support to the extractor.
    • Adds dynamic length-limited publishing of HTTP request and response bodies in http_inspect.
    • Introduces core logic and peg stats/socket commands for a new multi-process databus (mp_data_bus).

    +2 more show less

    • Adds a new multiprocess_transport plugin type with Unix domain socket-based transport (mp_unix_transport).
    • Adds multiprocess initialization for AppID third-party sync events.

    7 details in Everything

16. 3.7.3.0 Apr 21, 2025 · release notes

    Snort 3.7.3.0 adds TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. output, configurable CSV delimiters, extended DNS logging, and a new HTTP/2 frame-size rule.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.3.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.7.3.0

    └──▷ USE IT
    Use TSV output from the extractor for easy ingestion into pipeline tools like awk or cut without worrying about quoted CSV fields.
    lua copy

    {
      extractor =
      {
        format = "tsv"
      }
    }

    Set a custom delimiter in the extractor CSV logger to match your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.'s expected format (e.g. pipe-delimited).
    lua copy

    {
      extractor =
      {
        format = "csv",
        delimiter = "|"
      }
    }

    Enforce an HTTP/2 frame size limit using the new settings_max_frame_size parameter to trigger built-in rule 121:44 on oversized frames.
    lua copy

    {
      http2_inspect =
      {
        settings_max_frame_size = 16384
      }
    }

    • Adds TSV (Tab-Separated Values) formatting option to the extractor module.
    • Adds configurable delimiter support to the extractor CSV logger.
    • Extends DNS logging in the extractor module.
    • Handles multiple transaction IDs in a single DNS-UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. flow.
    • Adds settings_max_frame_size parameter to http2_inspect with built-in rule 121:44 to detect oversized HTTP/2 frames.

    +2 more show less

    • Adds AppID caching for the DNS detector, improving detection performance.
    • Adds show_snort_packet_latency() help command to the main CLI.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The packet_capture module renames pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.-related options and changes their default values, which may break existing capture configurations on upgrade.
17. 3.7.2.0 Mar 31, 2025 · release notes

    Snort3 3.7.2.0 adds a unix domain connector, packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. limits, multiprocess databus framework, and AppID out-of-order packet inspection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.2.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.7.2.0

    • Adds flag to inspect out-of-order packets in AppID, improving detection coverage for reordered traffic.
    • New unix domain connector in the connectors module enables inter-process communicationinter-process communicationInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory. over local sockets.
    • Supports packet capture limit and location configuration in packet_capture, giving operators control over capture size and destination.
    • Introduces a basic multiprocess databus framework with skeleton APIs in pub_sub, laying the groundwork for multi-process event sharing.
    • Adds packet dump to unified2 events for reassembled UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. packets, enriching logged event data.

    +3 more show less

    • Includes PID in dump_config output file names, making it easier to identify per-process config dumps.
    • Passes packet data in DnsResponseEvent, enabling richer DNS event handling in pub/sub consumers.
    • Initializes OpenSSL at startup in the main process, ensuring TLS-related capabilities are available from launch.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !stream_tcp: OS policy names are renamed to prevent conflict with existing macros — configurations referencing old policy names will break.
18. 3.7.1.0 Mar 12, 2025 · release notes

    Snort3 3.7.1.0 adds domain fronting detection, encrypted DNS AppID, extractor DNS support, and NUMA memory policy tuning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.1.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.7.1.0

    └──▷ TRY IT
    Limit peer connections and write a PID file when running Snort3 as a managed sensor in a multi-instance deployment.
    copy

    $ snort --create-pidfile --max-peers 8 -c /etc/snort/snort.lua -i eth0

    • Detects domain fronting events and shadow traffic evasive VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. & multihop proxy techniques via AppID.
    • Adds general AppID support for encrypted DNS traffic.
    • Adds DNS support to the extractor module for richer log output.
    • Adds configurable time formatting in extractor loggers.
    • Adds tenant ID as a common field across extractor output.

    +10 more show less

    • Adds file name and MIME type fields to extractor output.
    • Adds partial download information to FileInfo via file_api and http_inspect.
    • Generates file events for asymmetric flows in file_api.
    • Adds --max-peers command-line parameter to Snort.
    • Updates --create-pidfile command-line parameter support.
    • Allows toggling generation of instance_map output from the main module.
    • Adds an option for setting NUMA memory policy in thread configuration.
    • Renames the kaizen network inspector to snort_ml, now building models into a BinaryClassifierSet.
    • Adds IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. rule events for the extractor via pub_sub.
    • Adds a numactl version check to the build system.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The kaizen network inspector is renamed to snort_ml; any configuration referencing kaizen will break on upgrade.
19. 3.7.0.0 Feb 17, 2025 · release notes

    Snort3 3.7.0.0 adds extractor default filter, logging constraints, and IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. option re-use limit warnings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.0.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.7.0.0

    • Adds a default filter to the extractor, reducing configuration needed for common extraction scenarios.
    • Adds logging constraints to the extractor for finer control over extraction output.
    • Adds a framework interface to warn operators when the IPS option re-usage limit is being reached.
    • Warns on excessive detection options in IPS rules to surface over-complex rule configurations.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The base API version has been bumped — rules from snort.org require the Talos_lightSPD package from 2025-02-12-001 or later to remain compatible.
20. 3.6.3.0 Feb 4, 2025 · release notes

    Snort3 3.6.3.0 adds connection log extraction, per-flow summary dumps, and config file generation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.3.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.6.3.0

    • Adds connection log support to the extractor module.
    • Implements dump config generation to a file via the dump_config facility.
    • New command to dump only flow summaries (rather than full flow data).
    • Adds thread_id to instance_mapping output for easier per-thread diagnostics.
    • Cloud malware lookup events now generated when file action changes from block malware to cloud malware lookup.

    +1 more show less

    • Hosts lookup now verifies IP protocol match, improving accuracy of host-based policy application.

    6 details in Everything

21. 3.6.2.0 Jan 26, 2025 · release notes

    Snort3 3.6.2.0 adds brute-force detection thresholds, pcre2pcre2A widely used open-source regular expression library maintained by the PCRE2 Project, offering Perl-compatible pattern matching that cyber tools embed for fast, expressive text and binary searching. migration, Geneve inner-header filtering, and multi-byte IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. content matching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.2.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.6.2.0

    • Adds configurable thresholds to AppID brute-force detection for tunable alerting sensitivity.
    • Supports multi-byte character matches in IPS content rules via new width and endian parameters.
    • Migrates IPS PCRE processing from legacy PCRE to PCRE2.
    • Filters Geneve-encapsulated packets using inner headers in pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. capture mode.
    • Adds per-thread instance ID dump support in the main engine.

    +3 more show less

    • Implements header definitions for a shadow traffic aggregator in pub/sub.
    • Adds IPS access to Event references for richer rule evaluation context.
    • Evaluates TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. flush policy on asymmetric connections at connection close or session clear.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !tcp_pdu is renamed to tlv_pdu; any configuration, rules, or scripts referencing tcp_pdu will break.
    • !The unsubscribe methods have been removed from data_bus; any code or plugins calling those methods will fail to compile or function.
    • !Libpcre2 is now a required dependency (replacing PCRE for IPS); deployments without libpcre2 installed will fail to build or run.
22. 3.6.1.0 Dec 30, 2024 · release notes

    Snort 3.6.1.0 adds fallback functionality for DNS, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., and POP inspectors with improved reload-config logging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.1.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.6.1.0

    • Adds fallback functionality to the DNS inspector for graceful handling of unexpected traffic.
    • Adds fallback functionality to the SMTP inspector for invalid commands and responses.
    • Adds a wrong-bytes threshold to the POP splitter to trigger fallback behavior on malformed traffic.
    • Adds a re_eval flag to fileinfo in the file API, enabling re-evaluation of file inspection state.
    • Improves logging of reload_config arguments for better operational visibility during live config reloads.

    5 details in Everything

23. 3.6.0.0 Dec 5, 2024 · release notes

    Snort3 3.6.0.0 adds a stdio connector, flow-end events, MIME hostname/URL enrichment, and resource-tuning logging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.0.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.6.0.0

    • Adds a standard I/O connector along with a connector API update, enabling new pipeline integration options.
    • Publishes flow end events, allowing downstream components and connectors to react to connection teardown.
    • Enriches HTTP with MIME traffic by adding hostname and URL fields to http_inspect and MIME inspection output.
    • Adds logging for resource tuning progress in the analyzer, making capacity-planning feedback visible at runtime.
    • Adds full path support when reading the list of Lua detectors in AppID.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The semicolon HTTP parameter delimiter has been removed from http_inspect; configurations or rules relying on semicolon-delimited http_param parsing will no longer work as before.
24. 3.5.2.0 Nov 20, 2024 · release notes

    Snort3 3.5.2.0 adds FTP extraction with aggregated event logging, ZIP central directory decompression, and full SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic. method parsing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.2.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.5.2.0

    • Adds FTP service implementation to the extractor subsystem, including aggregated event logging and a user field in extracted data.
    • Introduces imaginary transaction events for FTP in the extractor, enabling richer FTP session reconstruction.
    • Supports decompression of ZIP central directory structures.
    • Parses all SIP methods defined in the SIP standard, expanding SIP protocol coverage.
    • Introduces flow data support in the extractor subsystem.

    +1 more show less

    • Adds helper methods to the file API for unsetting filename and resetting SHA hash state.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !get_relative_instance_number now returns a zero-based index instead of one-based, which will break any code or config that assumes a one-based thread instance number.
25. 3.5.1.0 Nov 11, 2024 · release notes

    Snort3 3.5.1.0 adds QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. service detection API, TLS version capture, new flow allowlist LRU, and cross-PDU PDF token reassembly.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.1.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.5.1.0

    • New AppID API to check whether a detected service is running over QUIC.
    • Adds TLS version capture in AppID sessions for richer protocol metadata.
    • New API allowing users to specify values for data items used in Lua detectors.
    • New allowlist LRU cache for flow management.
    • HTTP/2 inspector now handles multiple Cookie header fields in a single request.

    +2 more show less

    • JavaScript normalizer adds cross-PDU PDF token reassembly for improved inspection across packet boundaries.
    • Thread instance number now included in dump_flows control command output for easier per-thread flow debugging.

    7 details in Everything

26. 3.5.0.0 Oct 23, 2024 · release notes

    Snort 3.5.0.0 adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. PDU inspector, FTP event pub/sub, asymmetric-flow flushing, and richer extractor fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.0.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.5.0.0

    • New tcp_pdu inspector provides simple length-based flushing for TCP streams.
    • Adds stream_tcp flush on asymmetric flows in IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. mode when queued bytes exceed a configured threshold.
    • Adds FTP request and response events via pub_sub, enabling downstream consumers to react to FTP activity.
    • Extractor gains support for body length, info_code/msg, filename, and proxied fields.
    • Extracts and sets hostname for file processing in file_api and http_inspect.

    +5 more show less

    • Adds filename extraction for FTP file processing in ftp_telnet.
    • IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. engine now ignores protocol when service supersedes ports, broadening rule matching.
    • JavaScript normalizer (js_norm) now processes complex nested PDF objects.
    • Stream layer rechecks flow eligibility when a session times out, improving accuracy of flow tracking.
    • Connector interface updated in framework and managers, with connector initialization moved out of SideChannel.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --dump-rule-databases flag has been removed from snort and search_engine.
    • !Requires libdaq v3.0.17 (bumped from the previous dependency version); older libdaq installs will be incompatible.
    • !The MPSE API has changed (minor version bumped); plugins or external code depending on the MPSE API must be recompiled.
27. 3.4.0.0 Oct 20, 2024 · release notes

    Snort 3.4 adds body length extraction, hostname setting in HTTP inspect, and new TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. PDU inspector

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.0.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.4.0.0

    • Adds body_length, info_code/msg, filename, and proxied fields to extractor output
    • Enables http_inspect to set the hostname field during file processing for better context
    • Introduces a new TCP PDU inspector that implements simple length-based flushing logic

    3 details in Everything

28. 3.3.7.0 Sep 30, 2024 · release notes

    Snort3 3.3.7.0 adds DNS sinkholeDNS sinkholeA DNS server configured to return false responses for malicious or unwanted domains, redirecting traffic to a controlled address instead of the real destination, so analysts can detect and block infected hosts. EDNSEDNSAn extension to the DNS protocol, standardized by the IETF, that adds larger UDP payload sizes, option flags, and extensible fields; cyber tools use it to carry additional query metadata and avoid fragmentation issues. support, HTTP/2 IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. frame options, FTP fallback, and jemalloc heap profiling commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.7.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.3.7.0

    • Adds DNS sinkhole support for EDNS in AppID, enabling detection of EDNS-based DNS traffic through sinkhole infrastructure.
    • Adds new IPS options for HTTP/2 frame header and data inspection via http2_inspect.
    • Adds fallback functionality for FTP in ftp_telnet, broadening protocol coverage.
    • Adds shell commands for jemalloc heap profiling to aid memory diagnostics.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Binder configuration is changed to allow only a single service per binding; setups with multiple services per binding entry will need to be updated.
29. 3.3.5.0 Sep 9, 2024 · release notes

    Snort 3.3.5.0 adds JSON logging for the extractor, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. window/options tracing, and new AppID reload logs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.5.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.3.5.0

    • Adds JSON logger output format to the extractor for structured event export.
    • Adds TCP window size, options, and meta-ack information to packet_tracer output.
    • Adds new log messages for AppID third-party library reloads.
    • Sets file name metadata during file processing in file_api.
    • Adds field name context to extractor logging function output.

    5 details in Everything

30. 3.3.3.0 Aug 16, 2024 · release notes

    Snort3 3.3.3.0 adds flow hash key extraction, outstanding packet counter, and expanded HTTP inspect telemetry.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.3.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.3.3.0

    • Adds outstanding packets counter to the DAQ layer for real-time queue depth visibility.
    • Adds flow hash key to the extractor for richer flow correlation in extracted output.
    • Adds peg counts for gzip, known-not-supported, and unknown encodings in http_inspect.
    • Logs normalized URI in extra data from http_inspect for improved alerting context.
    • Separates main-thread PCRE counts from packet-thread stats in IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. options for more accurate per-thread profiling.

    5 details in Everything

31. 3.3.1.0 Jul 18, 2024 · release notes

    Snort3 3.3.1.0 adds extractor fields, HTTP origin header detection, expanded MMSMMSMultimedia Messaging Service, a mobile carrier protocol that extends SMS to carry images, audio, and video between handsets; cyber tools use it to analyze or simulate rich-media mobile message delivery. curse, and new IP flow profiling parameters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.1.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.3.1.0

    └──▷ USE IT
    Capture HTTP referrer and origin metadata in extractor output for lateral-movement or phishing investigations.
    lua copy

    extractor = { output = 'file', fields = { http = { 'trans_depth', 'origin', 'referrer' } } }

    • Adds trans_depth, origin, and referrer fields to the extractor module for richer HTTP session metadata capture.
    • Adds origin header support to http_inspect for inspection of cross-origin HTTP requests.
    • Introduces new parameters to perf_monitor for IP flow profiling, enabling more granular performance analysis.
    • Expands MMS curse in the wizard for improved protocol identification of MMS traffic.
    • Enables OPT_TREE traces in release builds for detection-layer traceability without debug compilation.

    +2 more show less

    • Makes fast-pattern printing available as a trace module in the detection engine.
    • Supports TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream tracing without requiring special compilation flags.

    7 details in Everything

32. 3.3.0.0 Jul 10, 2024 · release notes

    Snort 3.3 introduces new CLI command for CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. percentage and Cursor Action Type in Lua scripts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0.0

    └──▷ TRY IT
    Check current CPU utilization of the Snort process via command line.
    copy

    $ snort --cpu-percent

    • Adds snort --cpu-percent CLI command to show Snort CPU usage
    • Adds new Cursor Action Type available in the framework for Lua-based actions

    2 details in Everything

33. 3.2.1.0 May 21, 2024 · release notes

    Snort 3.2.1 adds AppID CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. profiler CLI, connection profiling, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. reassembly improvements, and action counters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.1.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.2.1.0

    └──▷ TRY IT
    Access the new CLI table to profile application identification CPU usage directly from the command line.
    copy

    $ snort --appid-cpu-profiler

    Monitor aggregated action counts (e.g., drop, alert) to analyze traffic handling performance under ips_actions.
    copy

    $ snort --dump-actions ips_actions

    • Adds appid CPU Profiler Table and CLI for monitoring application identification performance
    • Introduces a new API version (20) and bumped plugin base API version
    • Adds connection profiling feature to the flow subsystem
    • Adds action counters aggregateable under ips_actions in actions module
    • Enables TCP reassembler for missed 3-way handshake (stream_tcp) with asymmetric flow mode

    +1 more show less

    • Supports dynamic build of inspector and ips options via SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. module

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Bumps framework API version to 20, requiring plugins to be recompiled against the new headers
    • !Removes deprecated aliases: string binder[].when.zones, src_zone, and dst_zone
34. 3.2.0.0 May 8, 2024 · release notes

    Snort 3.2.0 adds IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. action counters, protocol re-evaluation, and API bump

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.0.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.2.0.0

    • Adds ips_actions action counters to aggregate per-rule or per-policy event counts for visibility
    • Introduces dynamic re-evaluation of ips content matches in the next packet when conditions change
    • Bumps framework API version to 20 and updates base/plugin API versions

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The string binder[].when.zones deprecated alias is removed (use groups)
    • !The string binder[].when.src_zone deprecated alias is removed (use src_groups)
    • !The string binder[].when.dst_zone deprecated alias is removed (use dst_groups)
    • !The enum dce_smb.smb_file_inspection option is removed (use smb_file_depth { 'off' | 'on' | 'only' })
35. 3.1.85.0 May 6, 2024 · release notes

    Snort 3.1.85.0 adds appid URL regex patterns, HTTP AppID CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. profiler CLI, and asymmetric TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. flow mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.85.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.85.0

    • Adds appid http url regex pattern support for application identification
    • Introduces the appid CPU Profiler Table and accompanying CLI interface
    • Enables asymmetric TCP flow mode in stream reassembly for one-way traffic segments

    3 details in Everything

36. 3.1.83.0 Mar 24, 2024 · release notes

    Snort 3.1.83.0 adds flow dump filtering and refines trace logging for better diagnostic control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.83.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.83.0

    • Changes trace_logger output delimiter for tenant field from colon (:) to whitespace
    • Updates packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. behavior to correctly set DLT type in pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. header when using Netfilter Queue (nfq)

    2 details in Everything

37. 3.1.82.0 Mar 14, 2024 · release notes

    Snort 3.1.82.0 adds tenant-aware packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. and logging, appid ctrlcon broadcasts, stream TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. proxy normalization support, and Kaizen renamed to Snort ML.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.82.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.82.0

    • Adds packet_capture per tenant capability
    • Adds trace tenants logging for multi-tenant visibility
    • Adds stream TCP proxy mode normalization behavior support in stream_tcp inspector
    • Adds broadcast commands with ctrlcon in appid module
    • Renames kaizen component to Snort ML

    +1 more show less

    • Updates appid eve pattern matching logic

    6 details in Everything

38. 3.1.81.0 Feb 20, 2024 · release notes

    Snort 3.1.81.0 adds nested ctrlcon commands, Kaizen mock option, and stream_tcp threshold alerts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.81.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.81.0

    • control: Adds counting to ctrlcon blocked to allow for nested commands
    • kaizen: provide an option to enable Kaizen's mock
    • stream_tcp: add alerts for exceeding thresholds for max queued bytes or segments
    • flow: added ips event suppression flags

    4 details in Everything

39. 3.1.79.0 Feb 1, 2024 · release notes

    Snort3 3.1.79.0 adds Kaizen ML exploit detector and per-policy config, appid QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. fixes, and rate_filter multithreading.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.79.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.79.0

    • kaizen: add new dev_notes.txt for developer documentation
    • kaizen: change default value of uri_depth to -1
    • kaizen: update kaizen gid to 411
    • kaizen: make configuration available per-policy scope
    • kaizen: register module conditionally on LibML presence or REG_TEST definition

    +4 more show less

    • new network_inspectors module: adds Kaizen ML-based exploit detector
    • filters: make rate_filter multithreaded for performance gains
    • appid: add tenant filter capability for appid debug output
    • packet_tracer: add tenant filtering support in packet tracer filters

    9 details in Everything

40. 3.1.77.0 Dec 20, 2023 · release notes

    Snort 3.1.77 adds HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. appId support, tenant-scoped flows, and CWD to conf search

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.77.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.77.0

    • Adds http3 to the list of ssl protocols in appid, enabling detection for HTTP/3 traffic inside QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking..
    • Adds tenant ID to FlowKey to enable per-tenant flow isolation.
    • Adds current working directory (CWD) to conf search order via parser.

    3 details in Everything

41. 3.1.76.0 Dec 3, 2023 · release notes

    Snort 3.1.76 adds third-party lib memory profiling and protocol base counters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.76.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.76.0

    • Adds support for memory profiling of third party libraries in the appid module.
    • Adds new protocol based counters to the flow_cache subsystem.
    • Makes add_peg_count and set_peg_count protected functions available for derived classes in the pegs module.

    3 details in Everything

42. 3.1.75.0 Nov 22, 2023 · release notes

    Snort 3.1.75.0 adds AppID for DNS over QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking./HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. and flow logging flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.75.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.75.0

    • Sets a flag for flows with affected logging due to event filter

    1 detail in Everything

43. 3.1.73.0 Oct 25, 2023 · release notes

    Snort 3.1.73 adds appid trace log levels and host_cache segmented cache.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.73.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.73.0

    • Add multi-level support to appid trace logging via new configuration keys.
    • Introduce host_cache segmented caching to improve lookup performance.

    2 details in Everything

44. 3.1.72.0 Oct 16, 2023 · release notes

    Snort3 3.1.72.0 adds delayed action API, HTTP session ID, LRU flow caches, and more

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.72.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.72.0

    • Adds active module API for printing delayed action strings
    • Adds appid ability to retrieve the correct HTTP session using stream_id
    • Implements protocol-based LRU caches in flow_cache
    • Enhances http_inspect to run detection on failed UTF decoding

    4 details in Everything

45. 3.1.70.0 Sep 10, 2023 · release notes

    Snort 3.1.70.0 adds segmented host_cache and find_all config arg.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.70.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.70.0

    • host_cache now uses a segmented architecture for improved memory management and scalability
    • search_engines::find_all accepts an optional snort configuration parameter to control search behavior

    2 details in Everything

46. 3.1.69.0 Aug 29, 2023 · release notes

    Snort 3.1.69 adds CIP safety parsing, DNS response export, and HTTP/2 frame logging capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.69.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.69.0

    • appid, cip: parse CIP (Common Industrial Protocol) safety segments for deeper industrial protocol inspection
    • dns: publish DNS responses containing IP, FQDN, and TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. data in output logs
    • http2_inspect: log the HTTP/2 frame when processing a packet

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ips option asn1 has been removed from the configuration syntax.
47. 3.1.68.0 Aug 14, 2023 · release notes

    Snort 3.1.68 adds CIP safety segment parsing and enhanced DNS response inspection capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.68.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.68.0

    • Adds appid support for parsing Control & Information Protocol (CIP) safety segments
    • Enhances dns engine to parse and publish response data including IP, FQDN, and TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. fields
    • Disables rule evaluation caching for MIME attachments in http_inspect

    3 details in Everything

48. 3.1.67.0 Jul 30, 2023 · release notes

    Snort 3.1.67 introduces service_extension detection capability, time profiler commands, and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cert parsing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.67.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.67.0

    • Adds detection.service_extension config support for custom detection services
    • Adds shell commands for the time profiler to enable performance profiling sessions
    • Enables extraction and parsing of the server common name from SSL certificates via OpenSSL APIs

    3 details in Everything

49. 3.1.65.0 Jun 29, 2023 · release notes

    Snort 3.1.65.0 adds depth flag to ips_content, supports CIP multiple service packets, and thread-level mempolicy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.65.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.65.0

    • ips_content: added support for a non-default depth value via a new flag
    • appid: add support for CIP multiple service packet parsing

    2 details in Everything

50. 3.1.63.0 Jun 1, 2023 · release notes

    Snort 3.1.63.0 expands network ID support to 32 bits and reuses sensor_id field for tenant_id.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.63.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.63.0

    • Adds main: allow network IDs to use up to 32 bits
    • Reuses the sensor_id u2 event field for tenant_id value

    2 details in Everything

51. 3.1.62.0 May 21, 2023 · release notes

    Snort 3.1.62.0 adds encrypted appid logic, Partial Content file transfer support, and a JSON profiler formatter.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.62.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.62.0

    └──▷ USE IT
    Enable JSON profiling output for performance analysis in automation pipelines.
    shell copy

    snort -C snort3.conf --profiler-format json

    Allow http_inspect to handle chunked or range-based file transfers for modern web clients.
    config copy

    config http_inspect: profile multi_part; include partial_content;

    • Adds appid logic to check for encrypted appid before assigning SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. service based on port
    • Adds http_inspect support for file transfer using Partial Content (RFC 7233)
    • Adds json formatter to the profiler subsystem

    3 details in Everything

52. 3.1.61.0 May 4, 2023 · release notes

    Snort 3.1.61.0 adds profiler shell commands and show_config_generation()

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.61.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.61.0

    • Adds show_config_generation() command to display the configuration generation number.

    1 detail in Everything

53. 3.1.58.0 Mar 24, 2023 · release notes

    Snort3 v3.1.58.0 adds heap stat dumping and refines appid/eve precedence

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.58.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.58.0

    • Changes configuration precedence so that eve_http_client_mapping settings override default appid detection when set.
    • Adds rtn check restoration to Actions::alert and Actions::log for better action handling.

    2 details in Everything

54. 3.1.57.0 Mar 13, 2023 · release notes

    Snort 3.1.57 adds profiler rule time percentage and optimizes memory for search engine and FTP/Telnet plugins.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.57.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.57.0

    • Adds rule time percentage table field to the profiler output plugin
    • Optimizes search_engine by allocating a single shared scratch space
    • Improves ftp_telnet protocol handling by updating flushing around subnegotiation parameters

    3 details in Everything

55. 3.1.55.0 Feb 9, 2023 · release notes

    Snort 3.1.55.0 adds IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. subnet support for First Packet API, new pegcount metric, and Lua API enhancements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.55.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.55.0

    • Adds appid: support for IPv4 and IPv6 subnets for First Packet API to allow more granular flow identification.
    • Adds appid: updating lua API to accomodate netbios domain extraction, substring search, and substring index. to enhance application detection capabilities.
    • Adds new pegcount metric in the detection module to aid in performance monitoring and debugging.

    3 details in Everything

56. 3.1.53.0 Jan 25, 2023 · release notes

    Snort 3.1.53.0 adds parent flow API, memusage pegs, and TLS host publishing control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.53.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.53.0

    • flow module adds a stream interface to retrieve the parent flow from a child flow
    • memory module introduces memusage pegs for usage tracking
    • appid handler now publishes the TLS host set in the eve process event handler only when appid discovery is complete

    3 details in Everything

57. 3.1.51.0 Jan 13, 2023 · release notes

    Snort3 3.1.51.0 adds CIP appid support and Adobe JS identifier updates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.51.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.51.0

    • Adds appid support for CIP service, client, and payload detection
    • Updates snort_defaults with Adobe JavaScript related identifiers

    2 details in Everything

58. 3.1.48.0 Dec 2, 2022 · release notes

    Snort 3.1.48 adds ALPN service logging, one-sided TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. flow events, and retry packet tracking

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.48.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.48.0

    • Adds appid config key to log ALPN service mappings for visibility into application-layer protocol negotiation.
    • Adds flow event type to track and emit events for retry packets arriving in a stream.
    • Adds flow and stream logic to detect, track, and generate events for one-sided TCP sessions and established flows.

    3 details in Everything

59. 3.1.47.0 Nov 17, 2022 · release notes

    Snort 3.1.47.0 adds deferred trust to netflow and packet_io, standalone js_norm component, and appid discovery callbacks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.47.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.47.0

    • netflow implements deferred trust with cleanup logic.
    • packet_io allows ACT_TRUST as a delayed action.
    • http_inspect moves Enhanced JS Normalizer to a standalone js_norm component.
    • appid detects service, client, and payload via lua detectors and third-party sources when first packet re-inspection is enabled.

    4 details in Everything

60. 3.1.45.0 Oct 27, 2022 · release notes

    Snort 3.1.45.0 adds stateful signature evaluation, HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. APP_ID_NONE logic, and Lua sensitive data rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.45.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.45.0

    • detection: add stateful signature evaluation
    • appid: return APP_ID_NONE only if hsession is not present for http3
    • http_inspect: maximum_pipelined_requests
    • http_inspect: MIME partial inspections

    4 details in Everything

61. 3.1.44.0 Oct 20, 2022 · release notes

    Snort 3.1.44.0 adds stateful signature evaluation, sensitive data rules via Lua, and HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. appid support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.44.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.44.0

    • Add stateful signature evaluation to the detection engine
    • Add sensitive data rules support in Lua scripting
    • Update appid logic to return APP_ID_NONE for HTTP/3 when hsession is absent
    • Allow http_inspect to process multiple MIME attachments per message section

    4 details in Everything

62. 3.1.42.0 Sep 26, 2022 · release notes

    Adds AppID Lua API, HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. detection, NetFlow multi-rule eval, and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. session export to Snort 3.1.42

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.42.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.42.0

    └──▷ USE IT
    Enable PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. obfuscation globally without changing rule logic
    yaml copy

    ips.obfuscate_pii true

    • Adds appid custom lua detector API to map IP and port to appids on the first packet
    • Adds snort config option to control client-process mapping in the appid module
    • Prioritizes DPPID service detection over third-party detection in appid
    • Adds cache support for unprocessed SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. packets in appid
    • Adds http3 detection to HTTP IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. buffers in the detection module

    +5 more show less

    • Adds option to reduce RTNs by port values in the detection module
    • Enables evaluating all matching netflow rules, not just the first match, in the netflow module
    • Adds export support for creating UDP sessions in the stream module
    • Changes default of ips.obfuscate_pii to true in ips_options
    • Enables dumping IPS variables as hex in the trace module

    10 details in Everything

63. 3.1.41.0 Sep 7, 2022 · release notes

    Snort 3.1.41.0 adds appid reload via socket and improves NetFlow and file API output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.41.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.41.0

    • Adds appid support for sending intermediate messages during reload commands to the socket

    1 detail in Everything

64. 3.1.40.0 Aug 25, 2022 · release notes

    Snort 3.1.40 adds appid debug object, http_num_cookies rule option, configurable TPIDs in vlan, and get_module_version FFI function

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.40.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.40.0

    • Adds appid debug object activation before printing logs from the http event handler
    • Adds get_module_version(name, type) FFI function for conditional configuration
    • Enables match on PDUs in ip_proto

    3 details in Everything

65. 3.1.39.0 Aug 10, 2022 · release notes

    Snort 3.1.39 adds --enable-luajit-static cmake flag and swaps initiator/responder flags in netflow.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.39.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.39.0

    └──▷ USE IT
    Build Snort with a statically linked LuaJit interpreter.
    shell copy

    cmake --enable-luajit-static .

    • Adds --enable-luajit-static to the cmake command line for static linking of LuaJit
    • Passes a new flag in netflow output when the initiator and responder roles are swapped

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The reload_module command is removed from the managers subsystem
    • !Rule GID 138 is removed from the builtin exceptions list in the parser
66. 3.1.38.0 Jul 28, 2022 · release notes

    Snort 3.1.38 adds HTTP/2 frame inspection for GOAWAY and PRIORITY, renames cap_weight config param.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.38.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.38.0

    • http2_inspect adds support for GOAWAY frames
    • http2_inspect adds support for PRIORITY frames
    • Removed cap_weight config parameter

    3 details in Everything

67. 3.1.32.0 Jun 16, 2022 · release notes

    Adds EVE logging for AppID client mappings, netflow RNA integration, and logger reload support in Snort 3.1.32.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.32.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.32.0

    • appid configuration options now allow logging of eve process to client mappings
    • netflow module implements RNA integration for host/service discovery
    • logger gains a reload function that creates new log files upon snort reload
    • netflow supports memcap reconfiguration upon reload

    4 details in Everything

68. 3.1.31.0 Jun 2, 2022 · release notes

    Snort 3.1.31.0 adds JS Normalizer enhancements and utils keyword support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.31.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.31.0

    • http_inspect: new Content-Type header validation for the Enhanced JS Normalizer with general approach to checking headers
    • http_inspect: new Content-Type validation added for the Enhanced JS Normalizer
    • http_inspect: new handling of binary, octal and big integers in the JS Normalizer
    • utils: adds support for a new keyword and object tracking

    4 details in Everything

69. 3.1.29.0 May 4, 2022 · release notes

    Snort 3.1.29 adds ALPN matchers and a tenant ID field in the DAQ header.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.29.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.29.0

    • appid gains ALPN matchers to identify applications via TLS Application-Layer Protocol Negotiation.
    • http_inspect refactors MIME processing outside of file detection and depth logic.

    2 details in Everything

70. 3.1.28.0 Apr 25, 2022 · release notes

    Snort 3.1.28 adds netflow V5/V9 event support, MMSMMSMultimedia Messaging Service, a mobile carrier protocol that extends SMS to carry images, audio, and video between handsets; cyber tools use it to analyze or simulate rich-media mobile message delivery. service inspector, binder flow reassignment actions, and action logging hooks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.28.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.28.0

    • netflow module provides a framework for generating NetFlow v5 and v9 events.
    • New service inspector added for the IEC61850 MMS protocol (mms).
    • appid now exposes peg counts bytes_in_use and items_in_use.

    3 details in Everything

71. 3.1.27.0 Apr 8, 2022 · release notes

    Snort 3.1.27.0 adds control/shell network policy subcommand, enhanced JS normalizer via http_inspect, and removes legacy search algorithms.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.27.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.27.0

    • control and shell now support a new command to set the network policy for subsequent commands
    • http_inspect supports headers Restrict-Access-To-Tenants and Restrict-Access-Context
    • http_inspect decodes String.fromCodePoint() JavaScript function in the Enhanced JS Normalizer
    • Legacy search algorithms (ac_banded, ac_sparse, ac_sparse_bands, ac_std) removed from search_engines

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The legacy algorithms ac_banded, ac_sparse, ac_sparse_bands, and ac_std are no longer available in search_engines.
72. 3.1.26.0 Mar 23, 2022 · release notes

    Snort 3.1.26.0 adds delayed reject actions, appid API path, VBA decompression, and reputation reload command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.26.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.26.0

    • Adds appid API endpoint to provide the path to the appid detector directory
    • Makes appid a global inspector instead of per-flow
    • Adds VBA macro decompression support for HTTP MIME file uploads in http_inspect

    3 details in Everything

73. 3.1.25.0 Mar 9, 2022 · release notes

    Snort 3.1.25.0 adds http_header_test/http_trailer_test rule options and a watchdog for packet thread deadlocks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.25.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.25.0

    └──▷ TRY IT
    Match specific HTTP trailers in a detection rule, which is useful for inspecting chunked transfer encoding responses.
    copy

    $ alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Detect Trailer"; http_inspect; http_trailer_test:"X-Custom-Header"; sid:100001;)

    • http_inspect now supports http_header_test and http_trailer_test rule options to match HTTP headers and trailers.
    • process module gains a watchdog capability to detect packet thread dead locks or dead loops.

    2 details in Everything

74. 3.1.22.0 Jan 31, 2022 · release notes

    Snort3 3.1.22.0 adds priority for custom appid mappings, renames EFP to EVE, and exports stream prune limits

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.22.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.22.0

    • appid now gives priority to custom process-to-appid mappings over ODP (Out-of-the-Box) mappings in the application identification engine.
    • The efp configuration key is renamed to eve (encrypted visibility engine) for consistency in the application identification module.
    • pub_sub now exports the assistant_gadget_event.h header file, enabling custom assistant gadget event handling.
    • Stream module allows configuring the maximum number of flows pruned while idle via a new limit setting (default 400).

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The efp configuration key is renamed to eve in the application identification module; existing configurations using efp will fail or behave unexpectedly until updated.
75. 3.1.20.0 Jan 12, 2022 · release notes

    Snort3 3.1.20.0 adds http_version_match rule option and exposes SSH as a service inspector in the appid API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.20.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.20.0

    └──▷ TRY IT
    Enforce that HTTP traffic uses a specific protocol version using the new rule option.
    copy

    $ alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"HTTP Version Mismatch"; http_version_match:1.1; sid:1000001;)

    • Adds http_version_match rule option to http_inspect module
    • Updates appid API to include ssh in the list of service inspectors that need inspection

    2 details in Everything

76. 3.1.19.0 Dec 21, 2021 · release notes

    Adds VBA macro extraction for MS Office files over MIME and VLAN encoding support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.19.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.19.0

    • Add mime support for VBA macro data extraction of MS office files transferred over MIME protocols
    • Implement vlan encode function for VLAN manipulation

    2 details in Everything

77. 3.1.18.0 Dec 8, 2021 · release notes

    Snort 3.1.18 adds num_headers/num_trailers options, multi-tenant framework support, and JS normalizer improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.18.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.18.0

    └──▷ USE IT
    Detect HTTP requests with an unusually high number of headers or trailers, which may indicate smuggling or evasion attempts.
    shell copy

    alert http any any -> any any (msg:"High header count"; content:"HTTP/"; http_inspect; num_headers:50; sid:1000001; rev:1;)

    Leverage the improved JS normalizer to handle scripts split across multiple network chunks.
    shell copy

    alert http any any -> any any (msg:"JS Normalization Test"; content:"<script>"; http_fragments; sid:1000002; rev:1;)

    • Adds num_headers and num_trailers rule options to http_inspect for counting HTTP headers and trailers
    • Adds JS normalizer program scope tracking and alias resolution via utils

    2 details in Everything

78. 3.1.17.0 Nov 17, 2021 · release notes

    Snort 3.1.17.0 adds allow_missing_so_rules detection option and fixes http2_inspect hardening.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.17.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.17.0

    • Adds allow_missing_so_rules option to the detection configuration section to handle missing shared object rules.
    • Hardens http2_inspect protocol handler with immediate buffer creation and push promise error state checks.

    2 details in Everything

79. 3.1.16.0 Nov 3, 2021 · release notes

    Snort 3.1.16 adds AppID client_app_detection_type API, GENEVEGENEVEA network tunneling protocol that encapsulates Ethernet frames in UDP, designed to be extensible via metadata headers. Cyber tools use it to build flexible overlay networks across physical infrastructure. packet injection support, and Hyperscan serialization

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.16.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.16.0

    • Adds appid API endpoint/function to provide client_app_detection_type for external clients.
    • search_engine adds support for Hyperscan serialization, allowing pattern dumps to be saved and reloaded.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !detection module renames PortGroup to RuleGroup (and related symbols); code linking against the library must update references.
80. 3.1.15.0 Oct 21, 2021 · release notes

    Snort 3.1.15.0 adds OLE/VBA inspection via decompress/http_inspect and HTTP/2 partial header handling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.15.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.15.0

    • Adds vba_data IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. option to inspect VBA code embedded in OLE files (requires decompress and http_inspect modules)
    • Adds support for processing OLE files in decompress and http_inspect modules
    • Supports HTTP/2 partial headers when the priority flag is set in http2_inspect

    3 details in Everything

81. 3.1.14.0 Oct 7, 2021 · release notes

    Snort 3.1.14 adds RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. Bind v3 detection, JS-to-client app mapping API, and latency configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.14.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.14.0

    └──▷ HOW TO FIND IT
    Enable the latency module implicitly via config without explicit startup flags
    📍snort_config: adding api for enabling latency module
    • Adds appid support for RPC Bind version 3
    • Provides API for Lua detectors to map process name to client app
    • Adds file_policy_id and other config data in packet tracer File phase
    • Adds decompress_buffer_size to file_api
    • Adds total_flow_latency to flowstats

    +1 more show less

    • Adds configuration for implicit enable of latency module

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The script_data buffer is renamed to js_data in ips_options
82. 3.1.13.0 Sep 22, 2021 · release notes

    Snort 3.1.13.0 adds new file_api URL endpoint and --dump-builtin-options CLI flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.13.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.13.0

    └──▷ USE IT
    Inspect configuration options during startup for debugging or audit purposes.
    shell copy

    snort --dump-builtin-options

    • Adds --dump-builtin-options flag to enable dumping built-in configuration options.

    1 detail in Everything

83. 3.1.12.0 Sep 8, 2021 · release notes

    Snort3 3.1.12.0 improves ICMP6 checksum handling under NAT, HTTP inspect trace/cookie support, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream queue management

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.12.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.12.0

    • http_inspect now enables traces for the JS Normalizer
    • http_inspect includes cookies in http_raw_header
    • TCP stream reassembly normalizes data when queue limits are enabled

    3 details in Everything

84. 3.1.11.0 Aug 26, 2021 · release notes

    Snort 3.1.11 adds action_override global rule action mapping and new HTTP normalizations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.11.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.11.0

    • Adds the action_override configuration key to globally map all rule actions (e.g., block -> alert)
    • Adds flow_state.client_initiated flag support for identifying client-initiated sessions in flow state events
    • Adds http_raw_header and http_raw_trailer field support in http_inspect payloads
    • Adds normalization of JavaScript template literals in http_inspect

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes the tcp.trim config key from the normalize section
85. 3.1.10.0 Aug 11, 2021 · release notes

    Adds DNS splitter, SSH invalid version handling, and new wizard config options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.10.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.10.0

    └──▷ USE IT
    Configure Snort to split DNS traffic using the new splitter module
    config copy

    dns_splitter { config { ... } }

    • Adds dns_splitter to the configuration for splitting DNS traffic

    1 detail in Everything

86. 3.1.9.0 Jul 28, 2021 · release notes

    Adds http_raw_header_complete rule option for HTTP inspect and fixes HPACK table management in Snort3 3.1.9.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.9.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.9.0

    └──▷ TRY IT
    Trigger an alert when the HTTP raw header ends before expected content, bypassing standard parsing.
    copy

    $ alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP Raw Header Complete"; flow:to_server,established; http_raw_header_complete; sid:1000001; rev:1;)

87. 3.1.8.0 Jul 15, 2021 · release notes

    Adds SSH client detection via Lua detector; new HTTP alert for script tags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.8.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.8.0

    • Adds appid support for SSH client detection through a lua detector.
    • Adds http_inspect built-in alert for script tags in a short form.
    • Updates snort2lua to set raw_data buffer for rawbytes and B flag in PCRE.

    3 details in Everything

88. 3.1.7.0 Jun 30, 2021 · release notes

    Snort 3.1.7.0 adds --test-features debug flag, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. version detection in AppID, and HTTP/2 inspector docs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.7.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.7.0

    • main: implement test_features run flag to enable debug-like output
    • appid: enhance netbios service detector to identify SMB versions as web app

    2 details in Everything

89. 3.1.6.0 Jun 16, 2021 · release notes

    Snort 3.1.6 adds Geneve encapsulation support, HTTP/2 request body detection, and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. multichannel file analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.6.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.6.0

    • codecs: geneve - add support for Geneve encapsulation
    • appid: perform detection on request body for HTTP2 traffic.
    • filters: change rate filter to use network policy id instead of ips policy id
    • control: expose ContrlConn API

    4 details in Everything

90. 3.1.5.0 May 20, 2021 · release notes

    Snort 3.1.5.0 adds NetFlow v9 support, HTTP/2 window_update processing, and IP reputation in http_inspect

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.5.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.5.0

    └──▷ USE IT
    Inspect HTTP/2 streams with custom concurrency limits to prevent resource exhaustion.
    config copy

    # Configure http2_inspect in snort3.lua or rule options:
    # http2: concurrent_streams_limit 100

    Leverage IP reputation in http_inspect to tag traffic from known malicious sources.
    config copy

    # Ensure ip_reputation is enabled in the http_inspect policy configuration

    • Adds netflow version 9 decoding and filtering capabilities to the packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. stage
    • Adds configurable concurrent stream limits for http2_inspect protocol analyzer
    • Adds http_inspect IP reputation support for inspecting HTTP traffic sources
    • Adds auxiliary IP stash API for flow data persistence
    • Adds LRU cache shared insert method and incremental stream memory tracking in http2_inspect

    5 details in Everything

91. 3.1.4.0 Apr 25, 2021 · release notes

    Snort 3.1.4.0 adds script_data IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. option for JS payloads, SMBv2 DCERPC support, and new Netflow v5 filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.4.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.4.0

    • Adds script_data ips option to allow sticky buffer injection within normalized JavaScript payloads
    • Adds dce_rpc support for DCERPC over SMBv2
    • Adds netflow device list configuration and filter matching for the v5 decoder
    • Adds IT_FIRST inspector type via IT_FIRST flag to analyze only the first packet of a flow

    4 details in Everything

92. 3.1.3.0 Mar 27, 2021 · release notes

    Snort 3.1.3 adds HTTP/2 upgrade alerts, JS whitespace normalization, and netbios domain via appid API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.3.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.3.0

    • Adds http2_inspect alerting for uppercase header names encoded in HPACK
    • Adds http_inspect support for JavaScript whitespace normalization with the new normalization_depth config option
    • Adds alerting on HTTP/2 upgrade attempts in http_inspect
    • Makes netbios domain available through the appid API
    • Adds SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. fingerprinting support via appid and rna modules

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The is_active_enabled and set_active_enabled functions are removed from snort_config
93. 3.1.2.0 Mar 12, 2021 · release notes

    Snort3 3.1.2.0 adds streaming ZIP decompression, packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. group filters, IEC104 inspector, and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.2.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.2.0

    • appid loads lua detectors for packet threads from compiled lua bytecode during detector reload
    • decompress supports streaming ZIPs
    • file_magic detects pcapng format
    • flow adds a new flag to indicate elephant flow
    • http2_inspect processes RST_STREAMRST_STREAMAn HTTP/2 frame type that immediately cancels a single stream without closing the whole connection, letting a sender abort a request or response mid-flight without tearing down the underlying TCP session. frame

    +4 more show less

    • http_inspect supports partial inspection for 0 length chunk
    • iec104 adds initial support for multilayer compound codecs (protocol inspector)
    • packet_capture adds group filter capability
    • rna discovers NetBIOS name

    9 details in Everything

94. 3.1.0.0 Jan 13, 2021 · release notes

    Snort 3.1.0.0 adds host_cache CLI, HTTP/2 metrics, and improved stream/reassembly logic

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0.0 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0.0

    • Adds host_cache command to output usage, pegs, and memcap
    • Adds total_bytes peg to track HTTP data bytes inspected in http_inspect
    • Adds total_bytes peg to track HTTP/2 data bytes inspected in http2_inspect
    • Adds alert on truncated chunked and content-length message bodies in http_inspect

    4 details in Everything

95. 3.0.3 Dec 20, 2020 · release notes

    Snort 3.0.3 adds HA appid support for HTTP/TLS hosts, DHCP fingerprinting events, and Lua sandbox config loading.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.3 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.0.3

    • Adds support for apps, http host, url and tls host in HA to appid module
    • Supports DHCP fingerprint matching and event generation in the rna inspector
    • Enables loading configuration in lua sandbox via the shell inspector

    3 details in Everything

96. 3.0.2 Sep 13, 2020 · release notes

    Snort 3.0.2 adds --dump-config top, appid JSON logging, deferred flow trust, and netflow service inspector.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.2 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.0.2

    • appid: Support json logging in appid_listener
    • dump_config: Add --dump-config="top" to dump the main policy config only
    • dump_config: Dump config in JSON format to stdout
    • flow: Add a deferred trust class to allow plugins to defer trusting sessions

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The reload_odp command is renamed to reload_detectors in the appid module.
97. 3.0.1 Jun 18, 2020 · release notes

    Snort 3.0.1 adds DAQ whitelist prevention, HTTP2 appid metadata handling, trace CLI control and packet filtering, plus DCE/RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. future session support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.1 https://github.com/snort3/snort3.git
    # already have the repo? check out this version:
    $ git checkout 3.0.1

    • appid updates cert viz API to handle subject alt name and SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. mismatch, adds lua APIs to get IP and port tunneled through a proxy, and checks FQN before registering rrt.
    • Adds trace control channel command to filter traces by packet constraints and pass the packet pointer to loggers.
    • dce_rpc inspector gains support for DCE/RPC future session.

    3 details in Everything

98. 2020-03-25: build 270 Mar 25, 2020 · release notes

    Snort3 build 270 adds VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. codec support and DNS over TLSDNS over TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. classification

    • Adds vxlan codec to codecs module for decoding VXLAN encapsulated traffic
    • Updates appid to include DNS over TLS port for service classification

    2 details in Everything

99. 2020-03-12: build 269 Mar 12, 2020 · release notes

    Snort 3 build 269 adds SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address./CN appid data storage, HTTP2 info to pub-sub, and reload support for so_rule plugins.

    • appid detection now stores the SNI and CN provided by SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. in the appid lookup API for application detection
    • The http_pub messages now include HTTP/2 information via the pub_sub integration

    2 details in Everything

100. 2020-02-21: build 268 Feb 21, 2020 · release notes

     Snort 3 build 268 adds hyperscan literal matching, HTTP/2 detection, configurable IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. actions, metadata filtering, and more.

     • HTTP/2 inspection support for dynamic table size updates, frame data walking skeleton, and detection disabling for uninteresting frames
     • http_param rule option added for HTTP inspection parameter matching
     • Hyperscan literal matching alternative to boyer-moore in content detection engine

     3 details in Everything

101. 2019-12-20: build 267 Dec 20, 2019 · release notes

     Snort3 build 267 adds appid third-party reload command, GTP alerts for missing TEID, and file magic support

     • Adds appid command for third-party reload to manage application identification modules dynamically
     • Adds new file magic signatures for .jar, .rar, .alz, .egg, .hwp, and .swf files
     • Raises alerts for missing TEID in GTP messages

     3 details in Everything

102. 1.1 Dec 4, 2019 · release notes

     Snort3 1.1 adds flow verdict deferral and parallel rule compilation to boost inspection flexibility and performance.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.1 https://github.com/snort3/snort3.git
     # already have the repo? check out this version:
     $ git checkout 1.1

     • flow: Add ability to defer whitelist verdict
     • ips: Add support for parallel fast-pattern MPSE FSM compilation

     2 details in Everything

103. 2019-11-22: build 265 Nov 22, 2019 · release notes

     Snort 3 build 265 adds CIP IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. rule support, Lua-C API for midstream traffic, and reloadable resource tuning.

     • appid: Adding Lua-C API to handle midstream traffic
     • cip: ips rule support for Common Industrial Protocol (CIP)
     • * analyzer_command*: support resource tuning on reload
     • * plugin_manager*: allow loading individual plugin files in plugin-path

     4 details in Everything

104. 2019-11-06: build 264 Nov 6, 2019 · release notes

     Snort 3 build 264 adds s7commplus inspector, stream flow reload, and IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. GID range handling.

     └──▷ USE IT
     Configure the new s7commplus inspector to parse Siemens S7Plus traffic.
     text copy

     service-inspectors s7commplus

     Set the stream flow limit, which will trigger a dynamic resource tuner reload if changed at runtime.
     text copy

     stream: max_flows 100000

     • Adds s7commplus service inspector for initial protocol coverage.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The accelerated_blocking option in http_inspect is renamed to detained_inspection.
     • !The smb_file_inspection config key in dce_smb is deprecated; use smb_file_depth instead.
105. 2019-10-31: build 263 Oct 31, 2019 · release notes

     Snort3 build 263 adds HTTP/2 HPACK decoding, TLS payload identification, and HTTP/2 preface enforcement

     • http2_inspect now decodes indexed header fields in the HPACK static table for HTTP/2 traffic analysis.
     • http2_inspect generates request start lines from pseudo-headers and aborts on connection preface errors.
     • appid sets the SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. session payload ID to unknown after the handshake completes if application layer identification fails.

     3 details in Everything

106. 2019-10-09: build 262 Oct 9, 2019 · release notes

     Snort3 build 262 adds appid Lua callbacks, wildcard ports, http2 hpack support, and snort2lua --bind-port

     └──▷ USE IT
     Convert existing Snort2 port: <n> bindings to Snort3 service format using the new explicit flag, ensuring inspector mappings are correctly translated.
     shell copy

     snort2lua --bind-port -c snort2.conf -r snort3.lua

     • appid adds support for a Lua detector callback mechanism, enabling custom application identification logic via Lua scripts.
     • appid supports wildcard ports in the host tracker (e.g., port: any), expanding application detection scope beyond fixed ports.
     • http2_inspect now parses HPACK header representations and decodes string literals, improving inspection of HTTP/2 traffic.
     • The snort2lua converter adds a --bind-port option to explicitly enable conversion of Snort2 port bindings into Snort3 service bindings.

     4 details in Everything

107. 1.3 Aug 28, 2019 · release notes

     Snort3 1.3 adds TLS 1.3 appid support, RNA unified2 logging, and service reset via wizard.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 1.3 https://github.com/snort3/snort3.git
     # already have the repo? check out this version:
     $ git checkout 1.3

     • appid now handles change cipher spec in server hello to allow app detection for TLS 1.3 traffic
     • reload supports multiple in-progress analyzer commands and moves reload tune logic for ACSwap to the execute command
     • host_tracker derives LruCacheSharedMemcap from LruCacheShared, tracking size in bytes instead of item count

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !http2_inspect no longer supports the pkt_data buffer option (removed)
108. 2019-08-21: build 259 Aug 21, 2019 · release notes

     Snort 2019-08-21 build 259 adds appid detection logic, new flow cache architecture, and Lua configuration consolidation

     • appid delays port-based detection until a non-zero payload packet is seen for the session
     • appid supports bittorrent detection when UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. tracker packet arrives after TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. resumed session has already started
     • Introduces variable for handling idle session timeouts and flag for actively pruning flows based on the expire_time
     • Creates a single flow cache for all protocols instead of per-protocol caches
     • ips_options adds ber_data and ber_skip inspection options

     +1 more show less

     • snort2lua combines proto specific cache options for max_session in one max_flows option

     6 details in Everything

109. 2019-07-17: build 258 Jul 17, 2019 · release notes

     Snort3 build 258 adds high availability config in Snort2Lua, host cache dump flags, and DAQ no_ack support.

     └──▷ USE IT
     Enable high availability mode using the Lua config file
     lua copy

     # In snort.lua:
     
     high_availability {
       mode: local
     }

     • Adds high_availability support in Snort2Lua configuration to enable HA setups
     • Adds command-line flag -H and corresponding config key dump_hosts to the host_cache module for dumping host cache state
     • Adds ignore_vlan flag support from DAQ header for VLAN filtering decisions

     3 details in Everything

110. 2019-06-19: build 257 Jun 19, 2019 · release notes

     Snort 257 adds appid protocol detection for non-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. traffic and event-driven RNA inspections.

     • Adds appid support for protocol-based detection of non-TCP and non-UDP traffic
     • Adds appid support for dynamic host cache lookup-based application detection

     2 details in Everything

111. 2019-05-22: build 256 May 22, 2019 · release notes

     DAQng port with new configuration format and rule syntax changes

     • Port Snort and its DAQ modules to DAQ3 (DAQng) with a new DAQ configuration format
     • Update snort2lua to convert to the new DAQ configuration format
     • Change rule_state enable values from true/'false' to yes/'no'

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !rule_state enable values true and false are no longer accepted; use yes or no instead.
112. 2019-04-10: build 252 Apr 10, 2019 · release notes

     Snort3 build 252 adds file expiration timeouts and Mpse batch search profiling

     • Adds support for configurable file_api timers to limit pending file lookups and reset sessions on timeout

     1 detail in Everything

113. 2019-03-31: build 251 Mar 31, 2019 · release notes

     Snort3 2019-03-31 adds Lua-based interface var assignment, AppId service cache memcap configuration, and generic flow stash storage

     └──▷ HOW TO FIND IT
     Configure AppId service discovery memory limit to prevent excessive cache usage
     📍appid config\n appid_service_config\n state_memcap 1048576 # 1Mb default min_state_memcap 1024 end end
     • Allows setting of if variables in config via Lua scripts instead of slow automatic assignments
     • Adds configurable memory capacity limits for the AppId service discovery state queue with a default of 1Mb and minimum of 1024 bytes
     • Introduces support for storing generic strings and integers in flow stash using flow.stash

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The is_offloaded boolean field in Flow is renamed to is_suspended
     • !The SUSPENDED_OFFLOAD state is removed from IpsContext and should no longer be referenced
     • !TRUE/FALSE policy identifiers are renamed to ENABLE/DISABLED
114. 2018-12-06: build 250 Dec 6, 2018 · release notes

     Snort3 build 250 adds VLAN protocol support, configurable max bounds, and Lua control over reject actions.

     └──▷ TRY IT
     Determine valid configuration upper limits for parameters in your deployment.
     copy

     $ snort --help-limits

     Configure a reject rule to forward the packet instead of dropping it using Lua syntax.
     lua copy

     control = forward;

     • protocols section: add vlan_idx field to Packet struct and handle multiple vlan type ids
     • parameter section: add max31, max32, and max53 for int upper bounds
     • snort section: add --help-limits to output max* values
     • snort2lua section: add code to output control = forward under the reject module

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !snort: remove obsolete and inadequate -W option
115. 2018-11-07: build 249 Nov 7, 2018 · release notes

     Snort 249 adds --rule-path directory loading and configurable third-party appid stats

     └──▷ USE IT
     Load all rule files in a specific directory for centralized management
     shell copy

     snort -c snort3.lua --rule-path /etc/snort/rules

     • Add --rule-path <dir> argument to load rules from all files in a directory

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !Change http2 GID from 219 to 121
116. 2018-09-26: build 248 Sep 26, 2018 · release notes

     Snort 3 build 248 adds pause-after-n, post-onload detection callbacks, and pub-sub appid changes

     • Adds pause-after-n support in main to limit processing volume.
     • Adds post-onload callbacks in detection layer for late-stage rule evaluation.
     • Adds pub-sub mechanism for application identification (appid) changes.

     3 details in Everything

117. 2018-08-13: build 246 Aug 13, 2018 · release notes

     Snort 3 build 246 adds network policy IDs, Lua state per thread, and Hyperscan MPSE dynamic building.

     • Add binder support for two-pass rule processing (policy ID pass then general rules) to enable network policy identification
     • Set an upper limit of 255 on the min_interval active response parameter
     • Use a single Lua state per thread in appid inspectors to reduce memory usage and improve multithreading stability
     • Enable dynamic building of ips_pcre, ips_regex, and sd_pattern detectors alongside Hyperscan MPSE via framework settings
     • Report network policy IDs in packet_tracer output for user-specified policies

     +1 more show less

     • Export and query runtime policies by user ID in the policy module

     6 details in Everything

118. 2018-05-21: build 245 May 21, 2018 · release notes

     Snort 2018-05-21 adds third-party AppID integration, packet tracer constraint-based enablement, and -r stdin support

     └──▷ USE IT
     Injecting live traffic directly into Snort from a pipe or script without a pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file
     shell copy

     cat traffic.pcap | snort -r -

     • Enables third-party code for packet processing in the AppID engine
     • Allows reading packets from standard input using the -r - argument

     2 details in Everything

119. 2018-03-15: build 244 Mar 15, 2018 · release notes

     Snort 2018-03-15 adds rule-to-text output, file logging for packet tracer, DAQ meta events, and variable byte_jump offsets.

     └──▷ USE IT
     Extract raw text content from rules for automated processing or validation
     shell copy

     snort --rule-to-text -c snort.conf

     Log packet trace details to a specific file for post-mortem analysis
     config copy

     packet-tracer log-dir /var/log/snort/traces

     • Adds --rule-to-text [<delim>] flag to snort CLI for raw string rule output
     • Packet tracer gains ability to direct logging to a file via new configuration or runtime support
     • DAQ Hext module now generates start-of-flow and end-of-flow meta events
     • Logger updated to subscribe and log DAQ Meta Packets from Hext DAQ
     • byte_jump rule option post_offset now supports variable expressions

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !SO_PUBLIC APIs are wrapped in the snort namespace, potentially breaking direct access to previously exported global classes and functions
120. 2018-02-12: build 243 Feb 12, 2018 · release notes

     Snort3 build 243 adds episodic detection support, renames inspect_stream_inserts to detect_raw_tcp, and enables gdb debug builds by default

     • Adds episodic detection support in the flow subsystem.
     • inspect_stream_inserts configuration is renamed to detect_raw_tcp.
     • Build now enables GDB debugging info by default via build: enable gdb debugging info.
     • HTTP inspect applies request/response depth to packet data and suppresses raw packet inspection beyond that limit.

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The inspect_stream_inserts configuration key is renamed to detect_raw_tcp.
121. 2017-12-15: build 241 Dec 15, 2017 · release notes

     Snort 3 build 241 adds profiler support for HTTP, binder and wizard components.

     • Adds http_inspect profiler support to profile HTTP inspection performance
     • Activates binder component profiler support for traffic binding profiling

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The wizard usage mode is changed to inspect, which may break existing configurations relying on previous default wizard behavior.
122. 2017-10-31: build 240 Oct 31, 2017 · release notes

     Snort 3 build 240 adds JSON logging, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. AppId, DAQ tunnel bypass, and new rule options

     └──▷ USE IT
     Use the new command-line flag to dump message maps for debugging rule matches.
     shell copy

     snort -T --dump-msg-map

     • Adds alert_json initial json event logger for structured alert output.
     • Enables SSL certificate pattern matching in the AppId inspector via config.
     • Adds DAQ support for packet trace logging and tunnel bypass (IP 4IN4, IP 6IN6, GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation., MPLS).
     • Introduces alert_csv fields b64_data, class, priority, service, vlan, and mpls.
     • Adds --dump-msg-map CLI flag to dump message maps in the Snort3 binary.

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !alert_csv: rename dgm_len to pkt_len (existing field name changed)
     • !snort2lua: added config protected_content to deleted list (deprecated config key removed)
123. 2017-07-24: build 238 Jul 24, 2017 · release notes

     Snort 3 build 238 adds packet trace output, promotes metadata:service, supports mixed IP in u2, and updates http_inspect alerts.

     └──▷ TRY IT
     Enable full packet trace output for debugging specific rule matches.
     copy

     $ output: packet_trace filename=trace.dat

     Parse mixed IP protocol events from the unified2 log using the new event3 format.
     copy

     $ u2spewfoo -t event3 /var/log/snort/unified2_file

     Configure a rule to explicitly set the service metadata field separately from other metadata.
     copy

     $ sid:1000001; msg:"New Service Rule"; metadata:service http; sid:1000001;

     • Adds output: packet trace feature for logging full packet traces during detection.
     • Promotes metadata:service to a separate configuration option in rules, distinct from general metadata.
     • u2: adds event3 type support to u2spewfoo for unified log parsing.
     • u2: supports mixed IP versions (IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.) in the same flow key via new ip_proto integration.
     • http_inspect: adds alert 119:97 for lower case letters in HTTP version field.

     +2 more show less

     • http_inspect: adds alert 119:96 for unsolicited 206 responses.
     • http_inspect: adds alert 119:95 for Content-Encoding chunked responses.

     7 details in Everything

124. 2017-07-13: build 237 Jul 13, 2017 · release notes

     Snort3 build 237 adds JSON formatter to perf_monitor and snort2Lua line-number/file-name error output.

     • Adds a JSON formatter option to the perf_monitor module for structured performance data output
     • Updates snort2lua error output to include line numbers and file names for config files

     2 details in Everything

125. 2017-06-15: build 236 Jun 15, 2017 · release notes

     Snort 236 adds port scan configurability, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. peg counts, and dsize range validation.

     • port_scan alerts on all scan attempts to enable blocking
     • port_scan rules are now fully configurable
     • perf_monitor adds more TCP and UDP peg counts
     • perf_monitor updates cpu tracker output to thread_#.cpu_* format
     • ips options validate range check types such as dsize

     5 details in Everything

126. 2017-06-01: build 235 Jun 1, 2017 · release notes

     Snort3 build 235 adds daq module reload and unix socket support to control_mgmt.

     • control_mgmt now supports reloading the DAQ module without restarting the service.
     • control_mgmt adds support for unix sockets as a communication transport.

     2 details in Everything

127. 2017-05-21: build 234 May 21, 2017 · release notes

     Snort 3 build 234 adds byte_math rule option and refactors regex offload.

     • cmg: revamps hex buffer dump format to display 16 or 20 bytes per line
     • Offload module refactored to support experimental regex offload to other threads

     2 details in Everything

128. 2017-04-28: build 232 Apr 28, 2017 · release notes

     Snort3 build 232 adds non-blocking shell commands, multiple remote connections, bitmask support for byte rules, and removes deprecated http_server.

     └──▷ TRY IT
     Run multiple remote monitoring sessions simultaneously without blocking the terminal
     copy

     $ snort3 -s socket.sock &
     snort3 -r socket.sock &

     Extract bytes using a specific bitmask offset and end-relative positioning
     config copy

     alert tcp any any -> any 80 (msg:"Test"; byte_jump:4,16,0,big; byte_extract:2,0,uid; byte_jump:1,3,0,big,from_end; content:"|ff|";)

     • shell: Allow multiple simultaneous remote connections
     • byte_jump rule option: add bitmask and from_end arguments
     • byte_extract rule option: add bitmask argument
     • Remove deprecated http_server detection engine in favor of http_inspect

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The http_server detection engine is removed; configurations must use http_inspect instead.
129. 4.4.0 Mar 27, 2017 · release notes

     Snort 4.4.0 adds FlatBuffers output for perf_monitor and regex.fast_pattern config option

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 4.4.0 https://github.com/snort3/snort3.git
     # already have the repo? check out this version:
     $ git checkout 4.4.0

     • Adds FlatBuffers output format to perf_monitor with a companion converter tool.
     • Adds regex.fast_pattern configuration option to control fast pattern usage.

     2 details in Everything

130. 2016-12-16: build 222 Dec 16, 2016 · release notes

     Snort 3 adds JavaScript Normalization to http_inspect

131. 2016-11-21: build 219 Nov 21, 2016 · release notes

     Snort 3 adds DCE auto-detection, MIME file processing to http_inspect, and pid file support.

     └──▷ HOW TO FIND IT
     Enable automatic detection of DCE/RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. protocols via the configuration wizard.
     📍snort3 --wizard-mode
     Configure http_inspect to process MIME types for file extraction.
     config copy

     # Add MIME processing rules inside the http_inspect configuration block
     http_inspect {
       mime_config /etc/snort/mime_types.conf;
     }

     • appid refactoring and cleanup
     • Adds DCE auto-detection to the wizard
     • Creates a PID file after dropping privileges

     3 details in Everything

132. 2016-10-28: build 217 Oct 28, 2016 · release notes

     Snort3 build 217 enables HTTP inspect events in App-ID engine and updates rule signatures.

     └──▷ USE IT
     Correlate HTTP content inspection results with application identification rules for complex app detection.
     text copy

     snort -R snort3.lua -l /var/log/snort -c 'appid { ... http_inspect_events; ... }'

     • Add http_inspect inspector events to the application identification (appid) module, allowing App-ID to correlate data from HTTP inspection for deeper traffic analysis

     1 detail in Everything

133. 2016-10-13: build 215 Oct 13, 2016 · release notes

     Snort 3 build 215 adds module trace facility, DCE/UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. packet processing, and appid overhaul.

     • Adds dce_udp packet processing support
     • Overhauls appid engine for multiple threads

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The configuration keyword search_engine.debug_print_fast_pattern is renamed to show_fast_patterns
134. 2016-09-24: build 212 Sep 24, 2016 · release notes

     Snort3 build 212 adds DCE over UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. SnortLua support and SMB2SMB2A Microsoft network file-sharing protocol (version 2 of SMB) used for remote file, printer, and service access over a network; cyber tools target or implement it to inspect, relay, or exploit Windows file-sharing traffic. segmented file detection.

     • Adds file detection for files transferred in segments via SMB2

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The -w commandline option has been removed
135. 2016-09-20: build 210 Sep 20, 2016 · release notes

     Adds stream.ip_frag_only config to avoid tracking unwanted flows

136. 2016-09-14: build 209 Sep 14, 2016 · release notes

     Snort 2016-09-14 adds --enable-tsc-clock build flag for TSC register support on x86

     └──▷ TRY IT
     Build Snort from source with TSC clock support enabled on an x86 system to potentially improve timestamp precision.
     copy

     $ ./configure --enable-tsc-clock

     • Adds --enable-tsc-clock CLI option to enable the use of the Time Stamp Counter (TSC) register for timing during build/runtime on x86 platforms

     1 detail in Everything

137. 2016-09-09: build 208 Sep 9, 2016 · release notes

     Snort3 build 208 adds SMBv2/3 file support, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. client counters, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. HA fixes

     • Adds smtp client counters to track SMTP session metrics
     • Ported smbv2/smb3 file support for detecting SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. protocol files

     2 details in Everything

138. 2.9.8 Sep 2, 2016 · release notes

     Snort 2.9.8 adds smb file processing, ciscometadata decoder support, and new http_inspect alerts

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 2.9.8 https://github.com/snort3/snort3.git
     # already have the repo? check out this version:
     $ git checkout 2.9.8

     • Ported the ciscometadata decoder to enable parsing of Cisco-specific metadata
     • Added new http_inspect alerts for detecting Transfer-Encoding and Content-Encoding abuse

     2 details in Everything

139. 2016-08-10: build 206 Aug 10, 2016 · release notes

     Snort 3 adds appids rule option and smtp.max_auth_command_line_len config key

     └──▷ TRY IT
     Use the new appids keyword in a Snort3 rule to detect specific application protocols.
     copy

     $ alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Appid test"; appids; content:"GET"; classtype:web-application-attack; sid:1000001; rev:1;)

     • appid rule option is now available as appids in rules.
     • Added smtp.max_auth_command_line_len configuration parameter.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The appid rule option is renamed to appids, breaking existing rules that use the old name.
140. 2016-06-22: build 201 Jun 22, 2016 · release notes

     Snort 3 build 201 adds --enable-hardened-build, PIE support, new http_inspect alerts, file_log inspector, and HA for UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./ICMP.

     • configure --enable-hardened-build flag to enable hardened compilation settings
     • configure --pie flag to produce a position independent executable (PIE)
     • New new_http_inspect alert triggered on loss of sync during HTTP inspection
     • New file_log inspector for logging file events
     • Filename support added to the file Data Acquisition Module (DAQ)

     +2 more show less

     • High availability support for UDP and ICMP protocols
     • Support for a safe C library

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !OpenSSL is now a mandatory dependency (previously optional or bundled)
141. 2016-06-03: build 199 Jun 3, 2016 · release notes

     Snort 3 build 199 adds unprivileged operation support and sensitive data obfuscation.

     • Add obfuscate capability to sensitive data to prevent log leakage
     • Add \b matching support for sensitive data detection patterns
     • Enable new http_inspect alerts for abusive content-length and transfer-encodings
     • Add support for unprivileged operation mode

     4 details in Everything

142. 2016-05-27: build 198 May 27, 2016 · release notes

     Adds double-decoding to new_http_inspect and obfuscation support for cmg/unified2

143. 2016-04-22: build 195 Apr 22, 2016 · release notes

     Snort 3 build 195 adds packet_capture module, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. high availability, and file capture stats

     • Adds packet_capture module for network traffic capture capabilities.
     • Introduces initial high availability support for UDP traffic.

     2 details in Everything

144. 2016-03-18: build 192 Mar 18, 2016 · release notes

     Snort3 build 192 adds DCE rule options, hwloc CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. affinity, UTF-8 normalization for new_http_inspect, and initial HA connectors.

     └──▷ USE IT
     Inspect DCE/RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. traffic using the new rule options.
     config copy

     alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"DCE Test"; dce_stub_data; sid:1000001;)

     Enable UTF-8 normalization in HTTP inspection.
     config copy

     preprocessor new_http_inspect: normalize_utf8

     • Adds iface, opnum, smb, stub_data, tcp rule options for DCE protocols
     • Adds byte_extract/jump/test option for DCE rules
     • Adds UTF-8 normalization for the new_http_inspect preprocessor
     • Adds hwloc support for CPU affinity configuration

     4 details in Everything

145. 0.9 Feb 12, 2016 · release notes

     Snort3 adds file capture output and HTTP/0.9 support in new_http_inspect.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 0.9 https://github.com/snort3/snort3.git
     # already have the repo? check out this version:
     $ git checkout 0.9

     • file capture added - initial version writes from packet thread
     • added support for http 0.9 to new_http_inspect
     • added URI normalization of headers, cookies, and post bodies to new_http_inspect

     3 details in Everything

146. 2016-01-25: build 185 Jan 25, 2016 · release notes

     Introduces host_tracker for new integrated netmap in build 185

     • http_inspect undergoes refactoring focused on time and space considerations

     1 detail in Everything

147. 2015-12-11: build 182 - Alpha 3 Dec 11, 2015 · release notes

     Snort 3 adds memory profiling, regex fast pattern support, and ports the reputation preprocessor from Snort 2.x in Alpha 3 build 182.

     └──▷ TRY IT
     Run Snort 3 with the new memory profiling feature enabled to diagnose high RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. consumption during large traffic captures.
     copy

     $ snort -c /etc/snort/snort3.conf --profiling=memory

     • memory_profiling feature added for analyzing runtime memory usage
     • regex fast_pattern support enabled to accelerate pattern matching performance
     • Reputation preprocessor ported from Snort 2.x for IP reputation-based detection

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The _q search method flavor was removed; all searches are now queued, potentially affecting custom rule syntax relying on explicit queueing flags.
148. 2015-11-25: build 180 Nov 25, 2015 · release notes

     Snort3 build 180 adds hyperscan search method for rule contents and ports DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches. preprocessor

     • hyperscan search method support for rule contents (regex to follow)
     • DNP3 preprocessor and rule options ported from Snort 2.x

     2 details in Everything

149. 2015-11-20: build 179 Nov 20, 2015 · release notes

     Snort3 build 179 adds hyperscan search engine support and iface to alert_csv output

     • Adds hyperscan fast pattern search engine (functional)
     • Adds iface to alert_csv.fields for CSV alerts

     2 details in Everything

150. 2015-10-23: build 175 Oct 23, 2015 · release notes

     Snort 3 build 175 ports GTP and Modbus preprocessors and rule options from Snort 2

     • Adds gtp preprocessor and corresponding rule options ported from the legacy Snort 2 codebase, enabling inspection of GPRS Tunnelling Protocol traffic.
     • Adds modbus preprocessor and corresponding rule options ported from the legacy Snort 2 codebase, enabling detection of malicious Modbus protocol activity.

     2 details in Everything

151. 2015-10-09: build 173 Oct 9, 2015 · release notes

     Snort 3 build 173 adds pkt_num rule option, filename to reload commands, and moves modules to extras

     └──▷ TRY IT
     Use the packet number in a rule to trigger alerts only for specific packets in a stream.
     copy

     $ alert tcp any any -> any any (msg:"Packet number check"; pkt_num:1; sid:1000001; rev:1;)

     • Adds pkt_num rule option to the extras set for rule writers.
     • Allows passing a filename argument to reload commands to specify which configuration file to reload.

     2 details in Everything

152. 2015-10-01: build 172 Oct 1, 2015 · release notes

     Snort3 build 172 adds active response capability for rules lacking a flow signature.

     • enable_active_response_without_flow config option allows triggering active responses even when the rule does not create a flow object.
     • PPM now validates boolean values before assigning them to the fastpath config option, preventing invalid configuration states.

     2 details in Everything

153. 2015-09-04: build 168 Sep 4, 2015 · release notes

     Snort3 build 168 adds --catch-tags for unit test selection

     └──▷ TRY IT
     Run only unit tests tagged with perf or regression in a Snort3 build to speed up CI validation.
     copy

     $ make check --catch-tags perf,regression

     • Adds --catch-tags [footag],[bartag] flag to allow selection of specific unit tests by tag during builds

     1 detail in Everything

154. 2015-06-11: build 157 Jun 11, 2015 · release notes

     build 157 adds reset rule action as reject and ports SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. handling from Snort.

     └──▷ TRY IT
     Terminate a malicious flow immediately by sending reset packets instead of just dropping.
     copy

     $ alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"Malicious SSL"; sid:1000001; action:drop, reset;)

     • Ports SSL inspection logic from legacy Snort into this build

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removed support for sdrop and sblock rule types; use suppression rules instead
155. 2015-05-28: build 154 May 28, 2015 · release notes

     Snort3 adds raw hex DAQ/logger mode, alert_csv.separator config, and tcp payload-only reassembly

     • Adds alert_csv.separator config option to control the CSV delimiter in alert logs
     • Adds raw mode for the hext DAQ and logger components
     • Configures stream_tcp to reassemble payload only, removing previous overhead
     • Updates new_http_inspect with new parsing and event handling logic

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !alert_test config key has been deleted; users must migrate to alert_csv settings
156. 2015-05-22: build 153 May 22, 2015 · release notes

     Adds -L flag for log type, new DAQs (socket/user/file), and stream_user/stream_file engines.

     └──▷ TRY IT
     Use a custom DAQ for user-space packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
     copy

     $ snort -D --daq=user

     • Adds -L flag to specify log type
     • Added DAQs for socket, user, and file in extras
     • added stream_user for payload processing
     • added stream_file for file processing

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The -K flag is changed to -L (log type)
157. 2015-04-30: build 150 Apr 30, 2015 · release notes

     Snort 3 build 150 adds DAQ multi-param support via daq.vars and ports POP/IMAP inspectors.

     • Supports multiple DAQ parameters using the daq.vars config key instead of the previous single-value daq.var
     • Adds POP and IMAP protocol inspectors for application-layer analysis

     2 details in Everything

158. 2015-04-28: build 148 Apr 28, 2015 · release notes

     Snort 3 build 148 adds publish-subscribe event handling and a data_log plugin example

     • Added data_log plugin example demonstrating the new pub-sub pattern for data events.

     1 detail in Everything

159. 2015-01-26: build 134 Jan 26, 2015 · release notes

     Snort 3 build 134 adds SearchTool, default port bindings in snort2lua, and new hash rule options.

     • Adds SearchTool component alongside Mpse sync to 297
     • Changes snort2lua to add bindings for default ports when not explicitly configured
     • Adds md5, sha256, and sha512 rule options based on Snort 2.X protected_content

     3 details in Everything