https://cybertoolchain.io/tools/snort3 New releases and features in Snort3, tracked by The Cyber Toolchain. en Wed, 21 Oct 2026 15:52:09 GMT https://github.com/snort3/snort3/releases/tag/3.12.4.0 https://github.com/snort3/snort3/releases/tag/3.12.4.0 Wed, 21 Oct 2026 15:52:09 GMT Snort3 3.12.4.0 adds brotli decompression, JSON stats export, RST_STREAM rate limiting, configurable response pages, and TCP sequence tracing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `trace_seq_relative` option to `stream_tcp` to toggle between relative and absolute TCP sequence numbers in traces, and adds asymmetric-specific sequence span normalization checks to `stream_tcp`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `http2_inspect` configurable RST_STREAM rate threshold to cap RST_STREAM abuse. • Adds `brotli` decompression support to `http_inspect`. • Adds support for dumping stats in JSON format via `stats`. • Adds `peg counters` to `file_api` for extended file observability. • Adds `peg counter` for max header count to `http_inspect`. • Adds dynamic enable/disable commands for buffered logging with configurable `stop_after_match` to `logger`. • Adds `stream_log` and `flow_log` helpers to `stream` for multi-destination PacketTracer output. • Supports configurable response pages per action variable in `react`. • Adds QinQ outer VLAN tag support to `main`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.12.2.0 https://github.com/snort3/snort3/releases/tag/3.12.2.0 Thu, 23 Apr 2026 21:06:24 GMT Snort3 3.12.2.0 adds Lua API for device-info events, two-way SSL cache, connection ID tracking, and SSE-boundary HTTP publishing. • New AppID Lua API for publishing device-info events to the DataBus. • Adds two-way SSL cache data support in AppID for richer TLS session tracking. • Adds a connection ID field to flow objects, settable by external modules. • Extractor now prints connection ID as UID whenever one is available. • HTTP Inspect publishes events on Server-Sent Events (SSE) boundaries. • File API generates advance log entries for files with unknown verdicts. • File API caches file_adv_pub_id for more efficient DataBus publishes. • Packet Tracer displays ICMP type and zero destination port in trace output. • Adds initial decompression fuzzers and build support in the decompress module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.12.1.0 https://github.com/snort3/snort3/releases/tag/3.12.1.0 Wed, 18 Mar 2026 03:03:35 GMT Snort3 3.12.1.0 adds FILE logging and richer SSH telemetry to the extractor, plus payload injection for HTTP/HTTP2 s2c traffic. • Adds FILE logging output to the extractor module. • Adds SSH event logging to the extractor, including direction, version, and computed shared (selected) algorithm fields. • Adds payload injection support for server-to-client (s2c) packets on HTTP and HTTP2 traffic in the payload injector. • Adds `dump_inspector_map` command to the inspector manager for serviceability. • Adds `list_plugins` command for serviceability. • Enables so (shared object) library reloads for the OPC-UA inspector. • Adds content-length validation in the pub/sub subsystem. • Removes the `block_udp_fragmentation` configuration option from the socks inspector. Breaking changes: • The `block_udp_fragmentation` configuration option has been removed from the socks inspector; any config referencing it will break. • The `ssl.server_name_identifier` field in the extractor has been renamed; consumers of that field must update their references. • Plugins API version has been bumped for base and all types; rules from snort.org require the Talos_lightSPD package from version 2026-03-16-001 or later. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.11.1.0 https://github.com/snort3/snort3/releases/tag/3.11.1.0 Sat, 28 Feb 2026 01:45:43 GMT Snort 3.11.1.0 adds AppID midstream detection, HTTP decoded URI IPS option, SOCKS inspector, and expanded file/extractor telemetry. • Adds AppID SSL service detection during midstream sessions. • Adds AppID server and client port inspection during midstream; adds NFSv4.1 protocol support. • New `http_decoded_uri` IPS rule option and decoded URI buffer with shared decoded path in http_inspect. • New `socks` inspector for SOCKS protocol traffic analysis. • Adds Kerberos config option to set the `failed_login` flag in the Kerberos client detector. • Adds file_api buffer data to perf-monitor output and packet tracer logs; adds extractor field support. • Saves DAQ header `flow_id` into the Flow object; includes `flow_id` in `dump_flows` command output. • New `get_content_length` method on `HttpEvent` pub/sub API. • Adds RNA support for deviceinfo fingerprint processing and events. • Adds multi-logging feature in trace to support new Lua configuration. • SSL inspector now alerts on multiple ClientHello certificate records. • Improves MMS wizard curse against fragmented traffic and enhances MMS presentation context search. • Enhanced shadowtraffic logging to system support trace. • Lockless event ring in `mp_dbus` for improved multiprocessing throughput. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.10.2.0 https://github.com/snort3/snort3/releases/tag/3.10.2.0 Thu, 22 Jan 2026 03:48:53 GMT Snort 3.10.2.0 adds configurable midstream AppID discovery, QUIC AppID priority, and a new show_flows utility for binary flow-state dumps. • Adds configurable midstream service discovery in AppID, enabling detection of sessions that begin before Snort starts inspecting. • AppID now prefers QUIC client application ID over SSL when both are available, improving accuracy for QUIC traffic classification. • Refactors `dump_flows` command to output flow state in binary format for more efficient storage and processing. • Introduces `show_flows` utility program to convert `dump_flows` binary files into human-readable text containing flow state data for each flow. Breaking changes: • The `dump_flows` command now outputs flow state in binary format instead of text; existing tooling or scripts that parse plain-text `dump_flows` output will break and must be updated to use the new `show_flows` utility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.10.1.0 https://github.com/snort3/snort3/releases/tag/3.10.1.0 Tue, 13 Jan 2026 03:26:52 GMT Snort3 3.10.1.0 adds AppID JSON logging, out-of-order packet inspection, mDNS parsing, MIME multipart/form-data content parsing, and ML client body scanning. • Adds AppID application-ID logging support to the alert_json output module. • Enables out-of-order packet inspection in the AppID third-party engine, now on by default. • Adds mDNS TXT record parsing and deviceinfo event generation in AppID. • Implements content parsing of multipart/form-data in the MIME processor. • Adds flow creation failure logging to surface the different ways a flow can fail to be established. • Adds `is_urlencoded` method to the pub_sub API. • Adds urlencoded content-type to the http_inspect recognized content-type list. • Enables snort_ml client body scanning by default. • Adds snort_ml scanning of multipart form data. • Adds TransbridgeCodec encode function to the decoder. • Adds configurable `cmd_len` in ftp_telnet for improved command-length control. • Adds alerting on malformed FTP traffic in ftp_telnet. • Updates SMB/DLP filename and filesize handling in FileInfo to enable DLP evaluation for repeated transactions. • Adds SMTP config command usage support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.10.0.0 https://github.com/snort3/snort3/releases/tag/3.10.0.0 Tue, 25 Nov 2025 21:53:05 GMT Snort3 3.10.0.0 adds OPC UA inspection, QUIC extraction, DNS flavor counters, and new main-queue and data-bus APIs. • Adds OPC UA protocol inspector for industrial control system traffic analysis. • New QUIC extractor captures metadata from QUIC protocol flows. • Adds counters for different DNS flavors (e.g., DNS-over-TCP, DNS-over-UDP) for visibility into resolver traffic. • New retry queue timeout option for the main packet processing queue. • New unsubscribe API on the multi-process data bus (`mp_data_bus`). • SSH inspector now exposes fields to the extractor framework for session metadata logging. • HTTP inspect request and response buffers renamed. Breaking changes: • The HTTP inspect request and response buffers are renamed — rules or configurations referencing the old buffer names will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.9.7.0 https://github.com/snort3/snort3/releases/tag/3.9.7.0 Fri, 07 Nov 2025 02:55:27 GMT Snort3 3.9.7.0 adds DNS-over-HTTPS/QUIC detection, WAF buffers in HTTP inspect, and new flow pruning telemetry. • Adds AppID support for DNS over HTTPS (DoH) and DNS over QUIC (DoQ), enabling detection of encrypted DNS traffic. • Adds multi-stream support for DNS in AppID, improving classification across concurrent DNS flows. • Adds WAF buffers to http_inspect, providing new inspection surfaces for web application firewall rules. • Adds new pegs and packet tracer logging for flow prune events, improving visibility into session eviction. • Adds FNV-1a hash algorithm to the hash module. • Adds an SSL extractor event in the ssl preprocessor. • Adds MPSE and LRU cache to snort_ml, expanding the machine-learning detection engine's performance capabilities. • Enhances TCP RST validation to follow RFC 5961 recommendations in stream_tcp. • Adds partial inspection on the HTTP start line in http_inspect. • Increases the maximum length of LogMessage output in the log module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.9.6.0 https://github.com/snort3/snort3/releases/tag/3.9.6.0 Mon, 06 Oct 2025 21:19:42 GMT Snort3 3.9.6.0 adds AppID Lua detector API, QUIC logging events, and an HTTP encoding-type inspection API. • Adds `setUserDetectorDataItem` Lua detector API to AppID for setting user detector data items programmatically. • Adds QUIC logging events via pub_sub, enabling visibility into QUIC traffic flows. • Adds an API in `HttpEvent` to determine whether an HTTP response uses a supported encoding type. • Adds a log message when Snort is unable to set CPU affinity, improving operational diagnostics. • Extends trace output to print n-tuple information for non-TCP/UDP packet types that have an IP layer set. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.9.5.0 https://github.com/snort3/snort3/releases/tag/3.9.5.0 Thu, 04 Sep 2025 21:07:49 GMT Snort3 3.9.5.0 adds HTTP partial header inspection, opportunistic TLS publishing, and atomic watchdog improvements. • Adds partial inspection support for HTTP headers in http_inspect, enabling analysis of incomplete header data. • Publishes OPPORTUNISTIC_TLS events from http_inspect, allowing detection of TLS upgrade attempts on plain-text connections. • Replaces the watchdog command with atomic kicking from packet threads, improving reliability of the watchdog mechanism under load. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.9.3.0 https://github.com/snort3/snort3/releases/tag/3.9.3.0 Mon, 11 Aug 2025 21:22:55 GMT Snort 3.9.3.0 adds batched logger with CPU affinity, new HTTP inspect peg count, IEC 104 abort fallback, and TCP splitter restart support. • Adds a batched logger to improve packet_tracer output performance, with CPU affinity control for the log writer thread. • Adds a peg count for HTTP inspect tracking when a published body reaches the requested maximum size. • Adds fallback functionality for IEC 104 abort scenarios. • Adds a splitter restart function to stream_tcp, restarting when a hole is skipped by AtomSplitter. • Adds random base file ID generation for IMAP, POP, and SMTP service inspectors. • Enables exporting compile commands from the build system. • Notifies DAQ via ioctl message when a packet is injected. • Combines host pattern matchers in AppID for unified matching. • Extracts children-related and current-node evaluation logic into separate functions in the detection engine. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.9.2.0 https://github.com/snort3/snort3/releases/tag/3.9.2.0 Mon, 21 Jul 2025 22:00:07 GMT Snort3 3.9.2.0 adds CIP inspector fallback, multi-instance file cache sharing, and separate TCP sequence tracking. • Adds CIP inspector fallback functionality for handling unsupported CIP services gracefully. • Enables multi-instance Snort file cache sharing via the file API for coordinated file inspection across instances. • Separates logs and counters for left and right invalid TCP sequence numbers for more granular stream analysis. • Renames the HTTP inspect parameter `partial_depth` to `partial_depth_body` for body-specific partial inspection depth control. • Improves JSON Formatter performance in the extractor module. • Adds watchdog kick in flow dump summary to prevent stalls during flow reporting. Breaking changes: • The `http_inspect` parameter `partial_depth` is renamed to `partial_depth_body`; existing configs using `partial_depth` will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.9.1.0 https://github.com/snort3/snort3/releases/tag/3.9.1.0 Wed, 02 Jul 2025 00:40:12 GMT Snort 3.9.1.0 adds binding-block-on-do-not-decrypt, buffered std_connector output, file-redirect for connectors, and partial_depth HTTP inspection config. • Adds facility to block binding based on a `do_not_decrypt` flow flag and a new `can_decrypt` inspector method, enabling policy enforcement on encrypted flows that cannot be decrypted. • Adds buffered output to `std_connector`, improving throughput for high-volume event streams. • Adds `redirect` option to connectors to print output directly to a file instead of stdout. • Adds `partial_depth` configuration option to `http_inspect` for controlling inspection depth on partial HTTP content. • Adds context logging event for `notice` level in the extractor module. • Adds a 1-reader-1-writer ring buffer helper for internal pipeline efficiency. • AppID now differentiates between request and response DNS hostnames for more precise application identification. • AppID now synchronizes flow service with protocol-based detection. • Adds affinity setting for the connector flusher thread, enabling CPU pinning for performance tuning. • Profiler output now includes a note for total percentage in `profiler_dump` results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.8.1.0 https://github.com/snort3/snort3/releases/tag/3.8.1.0 Wed, 28 May 2025 02:44:49 GMT Snort3 3.8.1.0 adds flow allowlisting, per-flow timestamp validation, gap detection, ESP IPv6 support, and richer HTTP event data. • Adds option to move excess flows to the allowlist, giving operators a new overflow-handling strategy instead of dropping. • Implements per-flow packet timestamp checking: packets with timestamps earlier than the previous packet on that flow can now be dropped. • Adds stale-packet counting (always on) with configurable dropping; `drop_stale_packets` defaults to false. • Adds `id_offset` to filenames produced by stream.dump_flows(), enabling more granular file identification in high-volume captures. • Adds gap detection in the packet stream via the `stream` module, surfacing sequence holes for improved analysis. • Adds ESP to valid next-header types in IPv6 processing, broadening IPsec traffic inspection coverage. • Exposes all headers, response string, and HTTP method from `HttpEvent` via `pub_sub`, enriching event-driven integrations. • Extends the extractor with support for the `conn.log` history field. • Adds handling for AYT (Are You There) commands in the Telnet splitter. • Prints `stream_tcp` state when queue limits are hit, aiding capacity and tuning diagnostics. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.7.4.0 https://github.com/snort3/snort3/releases/tag/3.7.4.0 Thu, 08 May 2025 21:09:16 GMT Snort3 3.7.4.0 adds multi-process databus, expanded extractor logging, and dynamic HTTP body publishing. • Adds weird and notice logging to the extractor module. • Extends extractor DNS support with additional DNS fields. • Adds conn.log orig_bytes and resp_bytes field support to the extractor. • Adds dynamic length-limited publishing of HTTP request and response bodies in http_inspect. • Introduces core logic and peg stats/socket commands for a new multi-process databus (mp_data_bus). • Adds a new multiprocess_transport plugin type with Unix domain socket-based transport (mp_unix_transport). • Adds multiprocess initialization for AppID third-party sync events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.7.3.0 https://github.com/snort3/snort3/releases/tag/3.7.3.0 Mon, 21 Apr 2025 19:42:49 GMT Snort 3.7.3.0 adds TSV output, configurable CSV delimiters, extended DNS logging, and a new HTTP/2 frame-size rule. • Adds TSV (Tab-Separated Values) formatting option to the extractor module. • Adds configurable delimiter support to the extractor CSV logger. • Extends DNS logging in the extractor module. • Handles multiple transaction IDs in a single DNS-UDP flow. • Adds `settings_max_frame_size` parameter to `http2_inspect` with built-in rule 121:44 to detect oversized HTTP/2 frames. • Adds AppID caching for the DNS detector, improving detection performance. • Adds show_snort_packet_latency() help command to the main CLI. Breaking changes: • The `packet_capture` module renames pcap-related options and changes their default values, which may break existing capture configurations on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.7.2.0 https://github.com/snort3/snort3/releases/tag/3.7.2.0 Mon, 31 Mar 2025 18:58:01 GMT Snort3 3.7.2.0 adds a unix domain connector, packet capture limits, multiprocess databus framework, and AppID out-of-order packet inspection. • Adds flag to inspect out-of-order packets in AppID, improving detection coverage for reordered traffic. • New unix domain connector in the connectors module enables inter-process communication over local sockets. • Supports packet capture limit and location configuration in packet_capture, giving operators control over capture size and destination. • Introduces a basic multiprocess databus framework with skeleton APIs in pub_sub, laying the groundwork for multi-process event sharing. • Adds packet dump to unified2 events for reassembled UDP packets, enriching logged event data. • Includes PID in dump_config output file names, making it easier to identify per-process config dumps. • Passes packet data in DnsResponseEvent, enabling richer DNS event handling in pub/sub consumers. • Initializes OpenSSL at startup in the main process, ensuring TLS-related capabilities are available from launch. Breaking changes: • stream_tcp: OS policy names are renamed to prevent conflict with existing macros — configurations referencing old policy names will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.7.1.0 https://github.com/snort3/snort3/releases/tag/3.7.1.0 Wed, 12 Mar 2025 21:34:07 GMT Snort3 3.7.1.0 adds domain fronting detection, encrypted DNS AppID, extractor DNS support, and NUMA memory policy tuning. • Detects domain fronting events and shadow traffic evasive VPN & multihop proxy techniques via AppID. • Adds general AppID support for encrypted DNS traffic. • Adds DNS support to the extractor module for richer log output. • Adds configurable time formatting in extractor loggers. • Adds tenant ID as a common field across extractor output. • Adds file name and MIME type fields to extractor output. • Adds partial download information to FileInfo via file_api and http_inspect. • Generates file events for asymmetric flows in file_api. • Adds `--max-peers` command-line parameter to Snort. • Updates `--create-pidfile` command-line parameter support. • Allows toggling generation of `instance_map` output from the main module. • Adds an option for setting NUMA memory policy in thread configuration. • Renames the `kaizen` network inspector to `snort_ml`, now building models into a BinaryClassifierSet. • Adds IPS rule events for the extractor via pub_sub. • Adds a numactl version check to the build system. Breaking changes: • The `kaizen` network inspector is renamed to `snort_ml`; any configuration referencing `kaizen` will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.7.0.0 https://github.com/snort3/snort3/releases/tag/3.7.0.0 Mon, 17 Feb 2025 17:44:34 GMT Snort3 3.7.0.0 adds extractor default filter, logging constraints, and IPS option re-use limit warnings. • Adds a default filter to the extractor, reducing configuration needed for common extraction scenarios. • Adds logging constraints to the extractor for finer control over extraction output. • Adds a framework interface to warn operators when the IPS option re-usage limit is being reached. • Warns on excessive detection options in IPS rules to surface over-complex rule configurations. Breaking changes: • The base API version has been bumped — rules from snort.org require the Talos_lightSPD package from 2025-02-12-001 or later to remain compatible. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.6.3.0 https://github.com/snort3/snort3/releases/tag/3.6.3.0 Tue, 04 Feb 2025 21:28:05 GMT Snort3 3.6.3.0 adds connection log extraction, per-flow summary dumps, and config file generation. • Adds connection log support to the extractor module. • Implements dump config generation to a file via the dump_config facility. • New command to dump only flow summaries (rather than full flow data). • Adds thread_id to instance_mapping output for easier per-thread diagnostics. • Cloud malware lookup events now generated when file action changes from block malware to cloud malware lookup. • Hosts lookup now verifies IP protocol match, improving accuracy of host-based policy application. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.6.2.0 https://github.com/snort3/snort3/releases/tag/3.6.2.0 Sun, 26 Jan 2025 02:25:33 GMT Snort3 3.6.2.0 adds brute-force detection thresholds, pcre2 migration, Geneve inner-header filtering, and multi-byte IPS content matching. • Adds configurable thresholds to AppID brute-force detection for tunable alerting sensitivity. • Supports multi-byte character matches in IPS content rules via new width and endian parameters. • Migrates IPS PCRE processing from legacy PCRE to PCRE2. • Filters Geneve-encapsulated packets using inner headers in pcap capture mode. • Adds per-thread instance ID dump support in the main engine. • Implements header definitions for a shadow traffic aggregator in pub/sub. • Adds IPS access to Event references for richer rule evaluation context. • Evaluates TCP flush policy on asymmetric connections at connection close or session clear. Breaking changes: • `tcp_pdu` is renamed to `tlv_pdu`; any configuration, rules, or scripts referencing `tcp_pdu` will break. • The `unsubscribe` methods have been removed from `data_bus`; any code or plugins calling those methods will fail to compile or function. • Libpcre2 is now a required dependency (replacing PCRE for IPS); deployments without libpcre2 installed will fail to build or run. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.6.1.0 https://github.com/snort3/snort3/releases/tag/3.6.1.0 Mon, 30 Dec 2024 15:30:06 GMT Snort 3.6.1.0 adds fallback functionality for DNS, SMTP, and POP inspectors with improved reload-config logging. • Adds fallback functionality to the DNS inspector for graceful handling of unexpected traffic. • Adds fallback functionality to the SMTP inspector for invalid commands and responses. • Adds a wrong-bytes threshold to the POP splitter to trigger fallback behavior on malformed traffic. • Adds a `re_eval` flag to `fileinfo` in the file API, enabling re-evaluation of file inspection state. • Improves logging of `reload_config` arguments for better operational visibility during live config reloads. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.6.0.0 https://github.com/snort3/snort3/releases/tag/3.6.0.0 Thu, 05 Dec 2024 02:47:23 GMT Snort3 3.6.0.0 adds a stdio connector, flow-end events, MIME hostname/URL enrichment, and resource-tuning logging. • Adds a standard I/O connector along with a connector API update, enabling new pipeline integration options. • Publishes flow end events, allowing downstream components and connectors to react to connection teardown. • Enriches HTTP with MIME traffic by adding hostname and URL fields to http_inspect and MIME inspection output. • Adds logging for resource tuning progress in the analyzer, making capacity-planning feedback visible at runtime. • Adds full path support when reading the list of Lua detectors in AppID. Breaking changes: • The semicolon HTTP parameter delimiter has been removed from http_inspect; configurations or rules relying on semicolon-delimited `http_param` parsing will no longer work as before. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.5.2.0 https://github.com/snort3/snort3/releases/tag/3.5.2.0 Wed, 20 Nov 2024 03:51:47 GMT Snort3 3.5.2.0 adds FTP extraction with aggregated event logging, ZIP central directory decompression, and full SIP method parsing. • Adds FTP service implementation to the extractor subsystem, including aggregated event logging and a `user` field in extracted data. • Introduces imaginary transaction events for FTP in the extractor, enabling richer FTP session reconstruction. • Supports decompression of ZIP central directory structures. • Parses all SIP methods defined in the SIP standard, expanding SIP protocol coverage. • Introduces flow data support in the extractor subsystem. • Adds helper methods to the file API for unsetting filename and resetting SHA hash state. Breaking changes: • `get_relative_instance_number` now returns a zero-based index instead of one-based, which will break any code or config that assumes a one-based thread instance number. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.5.1.0 https://github.com/snort3/snort3/releases/tag/3.5.1.0 Mon, 11 Nov 2024 00:20:11 GMT Snort3 3.5.1.0 adds QUIC service detection API, TLS version capture, new flow allowlist LRU, and cross-PDU PDF token reassembly. • New AppID API to check whether a detected service is running over QUIC. • Adds TLS version capture in AppID sessions for richer protocol metadata. • New API allowing users to specify values for data items used in Lua detectors. • New allowlist LRU cache for flow management. • HTTP/2 inspector now handles multiple Cookie header fields in a single request. • JavaScript normalizer adds cross-PDU PDF token reassembly for improved inspection across packet boundaries. • Thread instance number now included in `dump_flows` control command output for easier per-thread flow debugging. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.5.0.0 https://github.com/snort3/snort3/releases/tag/3.5.0.0 Wed, 23 Oct 2024 03:15:34 GMT Snort 3.5.0.0 adds TCP PDU inspector, FTP event pub/sub, asymmetric-flow flushing, and richer extractor fields. • New `tcp_pdu` inspector provides simple length-based flushing for TCP streams. • Adds `stream_tcp` flush on asymmetric flows in IDS mode when queued bytes exceed a configured threshold. • Adds FTP request and response events via `pub_sub`, enabling downstream consumers to react to FTP activity. • Extractor gains support for body length, `info_code`/`msg`, filename, and proxied fields. • Extracts and sets hostname for file processing in `file_api` and `http_inspect`. • Adds filename extraction for FTP file processing in `ftp_telnet`. • IPS engine now ignores protocol when service supersedes ports, broadening rule matching. • JavaScript normalizer (`js_norm`) now processes complex nested PDF objects. • Stream layer rechecks flow eligibility when a session times out, improving accuracy of flow tracking. • Connector interface updated in `framework` and `managers`, with connector initialization moved out of SideChannel. Breaking changes: • The `--dump-rule-databases` flag has been removed from `snort` and `search_engine`. • Requires libdaq v3.0.17 (bumped from the previous dependency version); older libdaq installs will be incompatible. • The MPSE API has changed (minor version bumped); plugins or external code depending on the MPSE API must be recompiled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Sun, 20 Oct 2024 00:00:00 GMT Snort 3.4 adds body length extraction, hostname setting in HTTP inspect, and new TCP PDU inspector • Adds `body_length`, `info_code/msg`, `filename`, and `proxied` fields to extractor output • Enables `http_inspect` to set the `hostname` field during file processing for better context • Introduces a new TCP PDU inspector that implements simple length-based flushing logic Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.3.7.0 https://github.com/snort3/snort3/releases/tag/3.3.7.0 Mon, 30 Sep 2024 00:29:59 GMT Snort3 3.3.7.0 adds DNS sinkhole EDNS support, HTTP/2 IPS frame options, FTP fallback, and jemalloc heap profiling commands. • Adds DNS sinkhole support for EDNS in AppID, enabling detection of EDNS-based DNS traffic through sinkhole infrastructure. • Adds new IPS options for HTTP/2 frame header and data inspection via http2_inspect. • Adds fallback functionality for FTP in ftp_telnet, broadening protocol coverage. • Adds shell commands for jemalloc heap profiling to aid memory diagnostics. Breaking changes: • Binder configuration is changed to allow only a single service per binding; setups with multiple services per binding entry will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.3.5.0 https://github.com/snort3/snort3/releases/tag/3.3.5.0 Mon, 09 Sep 2024 14:26:41 GMT Snort 3.3.5.0 adds JSON logging for the extractor, TCP window/options tracing, and new AppID reload logs. • Adds JSON logger output format to the extractor for structured event export. • Adds TCP window size, options, and meta-ack information to packet_tracer output. • Adds new log messages for AppID third-party library reloads. • Sets file name metadata during file processing in file_api. • Adds field name context to extractor logging function output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.3.3.0 https://github.com/snort3/snort3/releases/tag/3.3.3.0 Fri, 16 Aug 2024 14:49:06 GMT Snort3 3.3.3.0 adds flow hash key extraction, outstanding packet counter, and expanded HTTP inspect telemetry. • Adds outstanding packets counter to the DAQ layer for real-time queue depth visibility. • Adds flow hash key to the extractor for richer flow correlation in extracted output. • Adds peg counts for gzip, known-not-supported, and unknown encodings in http_inspect. • Logs normalized URI in extra data from http_inspect for improved alerting context. • Separates main-thread PCRE counts from packet-thread stats in IPS options for more accurate per-thread profiling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.3.1.0 https://github.com/snort3/snort3/releases/tag/3.3.1.0 Thu, 18 Jul 2024 01:52:28 GMT Snort3 3.3.1.0 adds extractor fields, HTTP origin header detection, expanded MMS curse, and new IP flow profiling parameters. • Adds `trans_depth`, `origin`, and `referrer` fields to the extractor module for richer HTTP session metadata capture. • Adds origin header support to `http_inspect` for inspection of cross-origin HTTP requests. • Introduces new parameters to `perf_monitor` for IP flow profiling, enabling more granular performance analysis. • Expands MMS curse in the wizard for improved protocol identification of MMS traffic. • Enables OPT_TREE traces in release builds for detection-layer traceability without debug compilation. • Makes fast-pattern printing available as a trace module in the detection engine. • Supports TCP stream tracing without requiring special compilation flags. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.3.0.0 https://github.com/snort3/snort3/releases/tag/3.3.0.0 Wed, 10 Jul 2024 15:31:24 GMT Snort 3.3 introduces new CLI command for CPU percentage and Cursor Action Type in Lua scripts • Adds `snort --cpu-percent` CLI command to show Snort CPU usage • Adds new Cursor Action Type available in the framework for Lua-based actions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.2.1.0 https://github.com/snort3/snort3/releases/tag/3.2.1.0 Tue, 21 May 2024 16:18:14 GMT Snort 3.2.1 adds AppID CPU profiler CLI, connection profiling, TCP reassembly improvements, and action counters • Adds `appid` CPU Profiler Table and CLI for monitoring application identification performance • Introduces a new API version (20) and bumped plugin base API version • Adds 'connection profiling feature' to the `flow` subsystem • Adds action counters aggregateable under `ips_actions` in `actions` module • Enables TCP reassembler for missed 3-way handshake (`stream_tcp`) with asymmetric flow mode • Supports dynamic build of `inspector` and `ips options` via SSL module Breaking changes: • Bumps framework API version to 20, requiring plugins to be recompiled against the new headers • Removes deprecated aliases: `string binder[].when.zones`, `src_zone`, and `dst_zone` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Wed, 08 May 2024 00:00:00 GMT Snort 3.2.0 adds IPS action counters, protocol re-evaluation, and API bump • Adds `ips_actions` action counters to aggregate per-rule or per-policy event counts for visibility • Introduces dynamic re-evaluation of `ips content` matches in the next packet when conditions change • Bumps framework API version to 20 and updates base/plugin API versions Breaking changes: • The `string binder[].when.zones` deprecated alias is removed (use `groups`) • The `string binder[].when.src_zone` deprecated alias is removed (use `src_groups`) • The `string binder[].when.dst_zone` deprecated alias is removed (use `dst_groups`) • The `enum dce_smb.smb_file_inspection` option is removed (use `smb_file_depth { 'off' | 'on' | 'only' }`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Mon, 06 May 2024 00:00:00 GMT Snort 3.1.85.0 adds appid URL regex patterns, HTTP AppID CPU profiler CLI, and asymmetric TCP flow mode • Adds `appid` http url regex pattern support for application identification • Introduces the appid CPU Profiler Table and accompanying CLI interface • Enables asymmetric TCP flow mode in stream reassembly for one-way traffic segments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Sun, 24 Mar 2024 00:00:00 GMT Snort 3.1.83.0 adds flow dump filtering and refines trace logging for better diagnostic control. • Changes `trace_logger` output delimiter for tenant field from colon (`:`) to whitespace • Updates packet capture behavior to correctly set DLT type in pcap header when using Netfilter Queue (nfq) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.1.82.0 https://github.com/snort3/snort3/releases/tag/3.1.82.0 Thu, 14 Mar 2024 20:09:36 GMT Snort 3.1.82.0 adds tenant-aware packet capture and logging, appid ctrlcon broadcasts, stream TCP proxy normalization support, and Kaizen renamed to Snort ML. • Adds `packet_capture` per tenant capability • Adds `trace` tenants logging for multi-tenant visibility • Adds stream TCP proxy mode normalization behavior support in `stream_tcp` inspector • Adds broadcast commands with ctrlcon in `appid` module • Renames `kaizen` component to `Snort ML` • Updates appid eve pattern matching logic Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Tue, 20 Feb 2024 00:00:00 GMT Snort 3.1.81.0 adds nested ctrlcon commands, Kaizen mock option, and stream_tcp threshold alerts • control: Adds counting to `ctrlcon` blocked to allow for nested commands • kaizen: provide an option to enable Kaizen's mock • stream_tcp: add alerts for exceeding thresholds for max queued bytes or segments • flow: added `ips event suppression flags` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Thu, 01 Feb 2024 00:00:00 GMT Snort3 3.1.79.0 adds Kaizen ML exploit detector and per-policy config, appid QUIC fixes, and rate_filter multithreading. • `kaizen`: add new `dev_notes.txt` for developer documentation • `kaizen`: change default value of `uri_depth` to `-1` • `kaizen`: update `kaizen gid` to `411` • `kaizen`: make configuration available per-policy scope • `kaizen`: register module conditionally on LibML presence or `REG_TEST` definition • new `network_inspectors` module: adds Kaizen ML-based exploit detector • `filters`: make `rate_filter` multithreaded for performance gains • `appid`: add tenant filter capability for `appid` debug output • `packet_tracer`: add tenant filtering support in packet tracer filters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Wed, 20 Dec 2023 00:00:00 GMT Snort 3.1.77 adds HTTP/3 appId support, tenant-scoped flows, and CWD to conf search • Adds `http3` to the list of ssl protocols in `appid`, enabling detection for HTTP/3 traffic inside QUIC. • Adds tenant ID to `FlowKey` to enable per-tenant flow isolation. • Adds current working directory (`CWD`) to conf search order via `parser`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Sun, 03 Dec 2023 00:00:00 GMT Snort 3.1.76 adds third-party lib memory profiling and protocol base counters • Adds support for memory profiling of third party libraries in the appid module. • Adds new protocol based counters to the flow_cache subsystem. • Makes `add_peg_count` and `set_peg_count` protected functions available for derived classes in the pegs module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.1.75.0 https://github.com/snort3/snort3/releases/tag/3.1.75.0 Wed, 22 Nov 2023 02:58:55 GMT Snort 3.1.75.0 adds AppID for DNS over QUIC/HTTP/3 and flow logging flags • Sets a flag for flows with affected logging due to event filter Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.1.73.0 https://github.com/snort3/snort3/releases/tag/3.1.73.0 Wed, 25 Oct 2023 19:38:57 GMT Snort 3.1.73 adds appid trace log levels and host_cache segmented cache. • Add multi-level support to `appid` trace logging via new configuration keys. • Introduce `host_cache` segmented caching to improve lookup performance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.1.72.0 https://github.com/snort3/snort3/releases/tag/3.1.72.0 Mon, 16 Oct 2023 19:35:56 GMT Snort3 3.1.72.0 adds delayed action API, HTTP session ID, LRU flow caches, and more • Adds `active` module API for printing delayed action strings • Adds `appid` ability to retrieve the correct HTTP session using `stream_id` • Implements protocol-based LRU caches in `flow_cache` • Enhances `http_inspect` to run detection on failed UTF decoding Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Sun, 10 Sep 2023 00:00:00 GMT Snort 3.1.70.0 adds segmented host_cache and `find_all` config arg. • `host_cache` now uses a segmented architecture for improved memory management and scalability • `search_engines::find_all` accepts an optional snort configuration parameter to control search behavior Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/releases/tag/3.1.69.0 https://github.com/snort3/snort3/releases/tag/3.1.69.0 Tue, 29 Aug 2023 03:17:09 GMT Snort 3.1.69 adds CIP safety parsing, DNS response export, and HTTP/2 frame logging capabilities. • `appid, cip`: parse CIP (Common Industrial Protocol) safety segments for deeper industrial protocol inspection • `dns`: publish DNS responses containing IP, FQDN, and TTL data in output logs • `http2_inspect`: log the HTTP/2 frame when processing a packet Breaking changes: • The `ips` option `asn1` has been removed from the configuration syntax. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Mon, 14 Aug 2023 00:00:00 GMT Snort 3.1.68 adds CIP safety segment parsing and enhanced DNS response inspection capabilities. • Adds `appid` support for parsing Control & Information Protocol (CIP) safety segments • Enhances `dns` engine to parse and publish response data including IP, FQDN, and TTL fields • Disables rule evaluation caching for MIME attachments in `http_inspect` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Sun, 30 Jul 2023 00:00:00 GMT Snort 3.1.67 introduces service_extension detection capability, time profiler commands, and SSL cert parsing. • Adds `detection.service_extension` config support for custom detection services • Adds shell commands for the time profiler to enable performance profiling sessions • Enables extraction and parsing of the server common name from SSL certificates via OpenSSL APIs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Thu, 29 Jun 2023 00:00:00 GMT Snort 3.1.65.0 adds `depth` flag to `ips_content`, supports CIP multiple service packets, and thread-level mempolicy • `ips_content`: added support for a non-default `depth` value via a new flag • appid: add support for CIP multiple service packet parsing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3 https://github.com/snort3/snort3/blob/master/ChangeLog.md https://github.com/snort3/snort3/blob/master/ChangeLog.md Thu, 01 Jun 2023 00:00:00 GMT Snort 3.1.63.0 expands network ID support to 32 bits and reuses sensor_id field for tenant_id. • Adds `main: allow network IDs to use up to 32 bits` • Reuses the `sensor_id` u2 event field for `tenant_id` value Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snort3