Suricata

No entries match these filters. Clear filters

1. docs update Oct 8, 2026 · issue 097

   Suricata adds tcp.session keyword to match TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. lifecycle phases (setup, established, closing) in a single rule across IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity., IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection., and firewall modes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Detect brute-force login attempts by counting failures per stream with flowint and alerting only after more than five login fails in the same flow.
   copy

   $ alert tcp any any -> any any (msg:"Start a login count"; content:"login failed"; flowint:loginfail,notset; flowint:loginfail,=,1; noalert;)
   alert tcp any any -> any any (msg:"Counting Logins"; content:"login failed"; flowint:loginfail,isset; flowint:loginfail,+,1; noalert;)
   alert tcp any any -> any any (msg:"More than Five login fails in a Stream"; content:"login failed"; flowint:loginfail,isset; flowint:loginfail,>,5;)

   Alert only when either of two known usernames is seen logged in, using the flowbits pipe OR operator to avoid duplicating rules.
   copy

   $ alert http any any -> any any (msg:"User1 or User2 logged in"; content:"login"; flowbits:isset,user1|user2; sid:1;)

   • Adds tcp.session keyword accepting a comma-separated subset of setup, established, and closing phases, letting a single rule cover the full TCP session lifecycle instead of requiring separate rules per phase; works in IDS, IPS, and firewall modes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports tcp.session midstream pickup: when a flow is picked up mid-connection, the keyword evaluates the flow's current TCP state directly (e.g., a midstream TCP_ESTABLISHED pickup matches tcp.session:established but not tcp.session:setup).
   • Documents flow keyword options including only_frag and no_frag to match packets reassembled from fragments or not.
   • Documents flowint keyword for per-flow integer storage and arithmetic (+, -, =, >, <, >=, <=, ==, !=) enabling in-rule counting, thresholding, and stateful tracking across packets in a stream.
   • Documents flowbits OR operation using the | pipe operator to check multiple named conditions in a single isset call (e.g., flowbits:isset,user1|user2).
   • Adds tcp.session keyword accepting a comma-separated subset of setup, established, and closing phases, letting a single rule cover the full TCP session lifecycle instead of requiring separate rules per phase; works in IDS, IPS, and firewall modes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports tcp.session midstream pickup: when a flow is picked up mid-connection, the keyword evaluates the flow's current TCP state directly (e.g., a midstream TCP_ESTABLISHED pickup matches tcp.session:established but not tcp.session:setup).
   • Documents flowint keyword for per-flow integer storage and arithmetic (+, -, =, >, <, >=, <=, ==, !=) enabling in-rule counting, thresholding, and stateful tracking across packets in a stream.

   2 more in Everything

2. docs update Oct 4, 2026 · issue 094

   Suricata adds per-direction SSH error fields to EVE records and renames TLS firewall state phases and SSH app-layer hooks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds ssh.client.error, ssh.client.state, ssh.server.error, ssh.server.state per-direction fields to the SSH EVE record, including invalid_banner and invalid_record error detail and the state at which the failure occurred.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Renames SSH app-layer state hooks to request_banner, request_kex, request_session (and response_ equivalents); rules using the old hook names fail to load.
   • Changes TLS firewall state names in accept:hook tls:<state>, alert tls:<state>, and firewall.policies.app.tls config keys from completion milestones to active phases (e.g. client_hello_done becomes client_hello, client_in_progress, or client_started); rules with old state names fail to load.
   • Bounds the firewall's per-packet evaluation of app-layer states to the state the packet's parse progress actually reaches, affecting every app-layer protocol.
   • Updates ts_progress and tc_progress values in alerts for renamed TLS firewall states to use the new phase names.
   • Adds ssh.client.error, ssh.client.state, ssh.server.error, ssh.server.state per-direction fields to the SSH EVE record, including invalid_banner and invalid_record error detail and the state at which the failure occurred.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !TLS firewall state names in accept:hook tls:<state>, alert tls:<state>, and firewall.policies.app.tls config keys have changed from completion milestones to active phases (e.g. client_hello_done → client_hello/client_in_progress/client_started); a rule with an old state name fails to load and is not enforced, and a config key matching a renamed state aborts init when engine.init-failure-fatal is set.
   • !SSH app-layer state hooks are renamed to request_banner, request_kex, request_session (and response_ equivalents); rules using the old names fail to load. ssh:request_complete and the request-complete policy key match nothing for SSH except disrupted flows — session-admit rules or policies no longer fire.
   • !Firewall per-packet evaluation is now bounded by the state the packet's parse progress reaches across all app-layer protocols; existing rulesets that relied on a policy at a later state to drop packets that stop at an earlier state must move that policy to the state the packet actually reaches.
   • !A ClientHello carrying no SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. extension is now decided at the certificate state instead of the hello-completion milestone; without an explicit accept at the certificate state it falls on the implicit default drop:flow policy. A plain certificate-state accept also admits SNI-less hellos — pair it with an explicit rule to keep the drop if required.
3. advisory CVE-2026-94084 Sep 21, 2026 · issue 128
   • CVE-2026-94084: detect/http2: header inspection can trigger a use-after-free (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects >= 8.0.4, < 8.0.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
4. advisory CVE-2026-94083 Sep 21, 2026 · issue 128
   • CVE-2026-94083: DoH2: upgrade from HTTP2 to DoH2 can cause a type-confused free (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects >= 8.0.0, < 8.0.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
5. suricata-8.0.7 Sep 15, 2026 · issue 076

   Suricata 8.0.7 adds dataset subdomain matching, a new tcp.session keyword, ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. accept policy option, and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. firewall progress states.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch suricata-8.0.7 https://github.com/OISF/suricata.git
   # already have the repo? check out this version:
   $ git checkout suricata-8.0.7

   └──▷ TRY IT
   Match DNS or HTTP traffic in a single rule using the new pipe-separated protocol list in app-layer-protocol.
   copy

   $ alert tcp any any -> any any (msg:"DNS or HTTP detected"; app-layer-protocol:dns|http; sid:1000001; rev:1;)

   Allow ARP traffic through the firewall and set a default drop policy for unmatched flows.
   suricata.yaml copy

   firewall:
     policies:
       accept-arp: true
       default-policy: drop

   Detect connections to any subdomain of a blocklisted domain set using the new match subdomain dataset option.
   copy

   $ alert dns any any -> any any (msg:"Blocklisted domain hit"; dns.query; dataset:isset,bad-domains,type string,match subdomain; sid:1000002; rev:1;)

   • Adds accept-arp option under firewall.policies config to control whether ARP traffic is accepted by the firewall policy engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds default-policy setting to firewall policy config for specifying a fallback action when no explicit policy matches.
   • Adds match subdomain option to the dataset keyword, enabling rules to match subdomains of entries in a dataset.
   • Adds tcp.session keyword for unified TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. lifecycle matching across a session.
   • Extends app-layer-protocol keyword to accept a pipe-separated list of protocol values in a single rule.

   +1 more show less

   • Adds firewall progress states to the SMTP parser, enabling policy enforcement at SMTP transaction stages.
   • Adds accept-arp option under firewall.policies config to control whether ARP traffic is accepted by the firewall policy engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds tcp.session keyword for unified TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. lifecycle matching across a session.

   4 more in Everything

6. 8.0.0 Jul 8, 2025 · release notes

   Suricata 8.0.0 adds integer unit support and removes unused stats counters

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 8.0.0 https://github.com/OISF/suricata.git
   # already have the repo? check out this version:
   $ git checkout 8.0.0

   • Adds kib unit support for detect/integers rule matching to allow size-based detection in kibibytes.

   1 detail in Everything

7. 8.0.0-rc1 Prerelease Jun 12, 2025 · release notes

   Suricata 8.0.0-rc1 adds pre_flow/pre_stream hooks, new keywords (tcp.wscale, email.*, ftp.*), pgsql CopyIn, and list-app-layer-hooks CLI flag

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 8.0.0-rc1 https://github.com/OISF/suricata.git
   # already have the repo? check out this version:
   $ git checkout 8.0.0-rc1

   └──▷ TRY IT
   Create a detection rule using the new TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. window scale keyword to identify specific TCP initialization patterns.
   copy

   $ alert tcp any any -> any any (msg:"TCP WScale Match"; tcp.wscale:12; flow:established; sid:1000001;)

   • Adds pre_flow rule hook to run detection logic before flow tracking
   • Adds pre_stream rule hook to intercept traffic before stream inspection
   • Adds tcp.wscale keyword to match TCP Window Scale option values
   • Adds email.received, email.url, and email.message_id keywords for MIME/Email protocol detection
   • Adds ftp.completion_code, ftp.reply_received, ftp.mode, and ftp.dynamic_port keywords for FTP protocol detection

   +3 more show less

   • Adds query detection keyword for PostgreSQL (pgsql) protocol inspection
   • Enables CopyIn subprotocol/mode for PostgreSQL database logging
   • Enhances CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. affinity logic with per-interface NUMA preferences via cpu-affinity config

   8 details in Everything

8. 8.0.0-beta1 Prerelease Apr 8, 2025 · release notes

   Suricata 8.0.0-beta1 adds new protocol parsers (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring., POP3), Lua sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., and detection keywords.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 8.0.0-beta1 https://github.com/OISF/suricata.git
   # already have the repo? check out this version:
   $ git checkout 8.0.0-beta1

   • Adds doh support for DNS over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. decoding
   • Adds pop3 protocol detection capability
   • Adds Lua sandboxing via the lua subsystem
   • Adds requires rule keyword to specify minimum Suricata version
   • Adds explicit action scopes with the action keywords in rules

   +10 more show less

   • Adds new detection keywords: mime.email.to, mime.email.subject, mime.email.from, and mime.email.cc
   • Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. request/response keywords: ldap.request.attribute_type, ldap.request.attribute, ldap.response.operation, ldap.distinguished_name
   • Adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. detection keywords: smtp.mail_from, smtp.rcpt_to, and smtp.helo
   • Adds FTP rule keywords: ftp.reply, ftp.command_data, and ftp.command
   • Enables DPDK RSS configuration using rte_flow rules via the dpdk config
   • Provides an auto option for DPDK rx-desc and tx-desc properties in config
   • Adds TLS ALPN detection with the tls.alpn keyword
   • Adds DNS opcode range matching support using ranges in dns.opcode values
   • Enables integer bitmask detection via the int:mask: transform/keyword syntax
   • Allows binding plugins to specific Suricata versions via plugin metadata

   15 details in Everything

9. 7.0.0-rc2 Prerelease Jun 14, 2023 · release notes

   Suricata 7.0-rc2 adds DPDK bonding, EVE TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. logging, PF_RING inner clustering, and explicit detect rule types.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 7.0.0-rc2 https://github.com/OISF/suricata.git
   # already have the repo? check out this version:
   $ git checkout 7.0.0-rc2

   └──▷ USE IT
   Capture TCP stream data (payload, offsets) in EVE JSON for full context analysis.
   config copy

   Add 'tcp-stream' to the output section of your suricata.yaml

   Bind multiple physical DPDK NICsNICsA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. to a single logical interface for increased throughput and redundancy.
   config copy

   Configure 'dpdk' with a 'bonding' section in suricata.yaml

   • dpdk: add support for bonding interface
   • eve: add stream tcp logging to EVE JSON output
   • yaml: set suricata version in generated config via suricata-update dump-sample-configs

   3 details in Everything

10. 6.0.1 Dec 4, 2020 · release notes

    Suricata 6.0.1 adds file inspection API for HTTP/2 and normalizes HTTP client body buffer.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 6.0.1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 6.0.1

    • http2: support file inspection API
    • http: Normalized HTTP client body buffer

    2 details in Everything

11. 6.0.0-rc1 Prerelease Sep 11, 2020 · release notes

    Suricata 6.0.0-rc1 adds GENEVEGENEVEA network tunneling protocol that encapsulates Ethernet frames in UDP, designed to be extensible via metadata headers. Cyber tools use it to build flexible overlay networks across physical infrastructure. protocol decoding, DNS SOA extraction, HTTP GAP recovery, and promotes datasets to stable.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 6.0.0-rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 6.0.0-rc1

    • Adds geneve as a new protocol decoder in the application layer
    • Enables parsing and extraction of Start of Authority (SOA) app layer data from DNS packets
    • Adds HTTP GAP recovery support for the HTTP protocol decoder
    • Promotes the datasets subsystem out of experimental status to stable

    4 details in Everything

12. 6.0.0-beta1 Prerelease Aug 7, 2020 · release notes

    Suricata 6.0.0-beta1 adds dynamic module loading, HTTP/2 support, and dataset CLI commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 6.0.0-beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 6.0.0-beta1

    └──▷ USE IT
    Remove a specific entry from a Suricata dataset via the CLI tool.
    shell copy

    dataset-remove my_dataset key_to_delete

    Configure a threshold rule that counts events in both directions (src and dst).
    shell copy

    alert http any any -> any any (msg:"Bidirectional flow"; threshold:type by_both, track by_src, count 5, seconds 60;)

    Enable loading of a custom dynamic plugin module in the configuration.
    config copy

    dynamic-loadable-modules:
     - filename: my_plugin.so
       args: "arg1=value"

    • Adds dynamic-loadable-module support for loading plugins at runtime.
    • Adds the dataset-remove unix command to delete entries from datasets.
    • Adds by_both option to the threshold rule keyword for bidirectional counting.
    • Adds HTTP/2 decoder support for parsing HTTP/2 traffic streams.

    4 details in Everything

13. 5.0.0 Oct 15, 2019 · release notes

    Suricata 5.0 adds auto-enabled JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. rule support and fixes default EVE DNS logger versioning behavior.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.0.0 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 5.0.0

    • Ja3(s) signatures are now automatically enabled when rules require them
    • EVE DNS logger defaults to version 2 when version not specified in configuration

    2 details in Everything

14. 5.0.0-rc1 Prerelease Sep 24, 2019 · release notes

    Suricata 5.0.0-rc1 adds JA3S detection, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Fast Open, SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic. parser, IP reputation matching, and XDPXDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. hardware offload

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.0.0-rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 5.0.0-rc1

    └──▷ TRY IT
    Detect specific DNS query types like AXFRAXFRA DNS zone transfer request that asks a nameserver to send every record in a zone at once, letting cyber tools enumerate all hostnames in a domain if the server is misconfigured to allow it. or TKEY to identify potential data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. or reconnaissance.
    copy

    $ alert dns any any -> any any (msg:"DNS AXFR Query"; dns.opcode:24; sid:1000001; rev:1;)

    Identify clients connecting with specific TLS fingerprints (JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port.) often associated with malware C2 traffic.
    copy

    $ alert tls any any -> any any (msg:"Known Malicious JA3"; ja3s:set:malicious_ja3_list; sid:1000002; rev:1;)

    • dns.opcode rule keyword for matching DNS header opcode values
    • TLS_cert sticky buffer for inspecting TLS certificates in rules
    • JA3S detection via new JA3/JA3S sets and reputation matching
    • TCP Fast Open (tcp_fast_open) support in the protocol stack
    • New rdp protocol parser with logging and detection capabilities

    +15 more show less

    • New vxlan protocol parser with logging and detection capabilities
    • New snmp protocol parser, logging, and detection capabilities
    • New sip protocol parser, logging, and detection capabilities
    • eve module now logs FTP events (ftp_logging)
    • url_reputation keyword for URL reputation matching
    • IP reputation matching technique usable in http/dns contexts
    • Intel/reputation matching on arbitrary data streams
    • Dynamically update md5 blacklist without full restart using dynamic_add_md5_blacklist event
    • New cluster_peer runmode for load balancing by IP header (src<->dst)
    • Hardware offload support for XDP bypass with pinned maps
    • IP pair XDP load balancing capability
    • Decapsulation of GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. in the XDP filter
    • Ability to detect TCP MSS values via new rule keywords
    • Ability to inspect TCP, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. headers and DNS full domain matching within dns_query buffer
    • Support for multiple stacked compression in HTTP decoding

    20 details in Everything

15. 5.0.0-beta1 Prerelease Apr 30, 2019 · release notes

    Suricata 5.0.0-beta1 adds man pages, HTTP header logging, FTP active mode support, and new JSON schema fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.0.0-beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 5.0.0-beta1

    • --help / man entries now available for Suricata commands
    • HTP_AUTH_UNRECOGNIZED enum value added to libhtp bindings
    • libjansson is now mandatory instead of optional
    • byte_test, byte_jump, and byte_extract rules documented in manual pages
    • System log events written to weird.log (formerly event log)

    +9 more show less

    • HTTP response headers Location and Server added to EVE JSON output
    • -s / --system and -u / --user flags to enable system/user mode separation
    • HTTP file extraction logs the byte range of extracted files
    • Rust compiler is now mandatory for building Suricata
    • SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. raw payload extraction now supported via new EVE JSON field
    • All HTTP headers dumped in Eve-JSON output via new http object fields
    • Protocol detection supports specifying flow direction with new rule modifiers
    • netmap mode adds support for load balancing and Vale switches
    • Napatech configuration simplified via new config keys

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !libjansson is no longer optional; builds will fail without it installed
    • !Rust compiler is now mandatory; older toolchains without Rust support are dropped
16. 4.1.1 Dec 17, 2018 · release notes

    Suricata 4.1.1 adds configurable JSON log level and improves af-packet error handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 4.1.1

    • Improves BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. loading failure error output in af-packet mode

    1 detail in Everything

17. 4.1.0-rc2 Prerelease Oct 16, 2018 · release notes

    Suricata 4.1.0-rc2 adds TLS 1.3 decoding, http_port to Eve-log, multi-tenancy device selector, and community flow IDs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.0-rc2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 4.1.0-rc2

    • Adds TLS 1.3 protocol decoding, SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. extraction, and logging capability for encrypted traffic analysis
    • Adds http_port to HTTP Eve-log entries when specified in the hostname.
    • Adds device selector option within the multi-tenancy feature to isolate traffic by network device
    • Enables community flow id generation for interoperable flow identification across distributed sensors

    4 details in Everything

18. 4.1.0-rc1 Prerelease Jul 20, 2018 · release notes

    Suricata 4.1.0-rc1 adds LZ4 pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. compression, WinDivert on Windows, and explicit disable of libnss/libnspr.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.0-rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 4.1.0-rc1

    └──▷ TRY IT
    Store pcap logs in compressed format to save disk space.
    copy

    $ suricata --pcap-file /path/to/traffic.lz4

    Build Suricata without NSS libraries when they are not needed.
    copy

    $ ./configure --disable-libnss --disable-libnspr

    • pcap.filename can now use .lz4 extension to enable LZ4 compression for pcap logs
    • Adds --disable-libnss and --disable-libnspr build options to explicitly disable NSS/NSPR support

    2 details in Everything

19. 4.1.0-beta1 Prerelease Mar 22, 2018 · release notes

    Suricata 4.1.0-beta1 adds SMB3SMB3The third major version of Microsoft's Server Message Block protocol, used for file and printer sharing over a network, adding encryption, multichannel support, and improved performance that cyber tools exploit or inspect., JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. fingerprinting, file-store v2 and Unix socket management

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.0-beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 4.1.0-beta1

    • unix-socket exposes ruleset_info to make rule load errors available programmatically
    • unix-socket supports modify_memcap to adjust memory caps at runtime
    • Adds startswith keyword for signature content matching
    • Adds endswith keyword for signature content matching
    • Adds content_len keyword for signature content matching

    +1 more show less

    • SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. 3 protocol support is enabled in the application layer parser

    6 details in Everything

20. 4.0.0-rc2 Prerelease Jul 13, 2017 · release notes

    Suricata 4.0.0-rc2 adds Teredo configuration and exposes tx in Lua alert scripts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.0-rc2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 4.0.0-rc2

21. 4.0.0-beta1 Prerelease Jun 7, 2017 · release notes

    Suricata 4.0.0-beta1 adds unified2 log rotation, STARTTLSSTARTTLSA protocol command that upgrades a plaintext connection to an encrypted TLS session without changing ports, used in SMTP, IMAP, and LDAP so tools can negotiate encryption opportunistically on standard service ports., TLS cert decoding, and new detection engines for NFS/DNS.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.0-beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 4.0.0-beta1

    • Adds signal-based rotation of unified2 log files without requiring a service restart via unified2 logger config
    • Implements STARTTLS support in the SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. application layer parser
    • Adds TLS certificate serial number decoding capability via eve.tls output
    • Adds NFS protocol parsing, logging, and detection capabilities through the app-layer module
    • Introduces a new stateless DNS parser written in Rust for improved performance and reliability

    5 details in Everything

22. 3.2.1 Feb 15, 2017 · release notes

    Suricata 3.2.1 allows building without libmagic/file and supports ICMPv6 MLDv2 reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 3.2.1

    └──▷ USE IT
    Configure Suricata to build without libmagic/file dependency.
    shell copy

    ./configure --without-libmagic

    • Adds Feature #1951 to allow building Suricata without requiring the libmagic/file library, reducing build dependencies.
    • Adds Feature #1972 to handle ICMPv6 unknown type 143 for MLDv2 report traffic.

    2 details in Everything

23. 3.2rc1 Prerelease Nov 1, 2016 · release notes

    Suricata 3.2rc1 adds Lua SCPacketTimestamp function

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 3.2rc1

    └──▷ USE IT
    Example usage inside a Lua script to retrieve the timestamp from an event object e.
    lua copy

    local ts = SCPacketTimestamp(e)

24. 3.2beta1 Prerelease Oct 3, 2016 · release notes

    Suricata 3.2beta1 adds SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications./SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. file checksums, EtherNet/IP/CIP support, TLS cert keywords, and HTTP line matchers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 3.2beta1

    └──▷ HOW TO FIND IT
    Check if a TLS certificate has expired using the new detection keywords
    📍alert tls any any -> any any (msg:"Expired Cert"; tls_cert_expired:true; sid:1000001;)
    Match the exact HTTP request line content in a flow
    📍alert http any any -> any any (msg:"Suspicious Request"; http_request_line:"/admin/login"; sid:1000002;)
    • Adds sha1 and sha256 fields to filestore events for SHA1 and SHA256 checksum support
    • Adds tls_cert_valid and tls_cert_expired detection keywords to check TLS certificate validity
    • Adds EtherNet/IP and CIP protocol support enabling detection of PLC traffic

    3 details in Everything

25. 3.1.2 Sep 6, 2016 · release notes

    Suricata 3.1.2 adds tag support to EVE logs, flow_id uniqueness, Cisco Fabric Path detection, and a new eve output option for dropped packets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 3.1.2

    • Supports tag field in EVE log output format
    • Makes logged flow_id more unique across sessions
    • EVE logs can now include all dropped packets via a new option

    3 details in Everything

26. 3.1.1 Jul 13, 2016 · release notes

    Suricata 3.1.1 adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. support via Lua scripting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 3.1.1

27. 3.1rc1 Prerelease Jun 7, 2016 · release notes

    Suricata 3.1rc1 adds TPACKET_V3, Hyperscan MPM/SPM, TLS SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. rule keyword, and Netmap auto-threading.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 3.1rc1

    • hyperscan mpm is now enabled by default for faster pattern matching
    • hyperscan spm integration allows hyperscan to handle single-pattern matching
    • TPACKET_V3 support added to AF_PACKET interface via Feature #681
    • New tls.sni rule keyword enables detection based on TLS Server Name Indication
    • DNS logging now includes SSHFP records when configured in the dns module

    +1 more show less

    • Netmap backend supports threads: auto configuration key to auto-detect thread count

    6 details in Everything

28. 3.0.1 Apr 4, 2016 · release notes

    Suricata 3.0.1 adds Hyperscan MPM integration and improves xbits/threaded support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 3.0.1

    • hyperscan mpm integration enables high-performance pattern matching using the Hyperscan library.

    1 detail in Everything

29. 3.0.1rc1 Prerelease Mar 23, 2016 · release notes

    Suricata 3.0.1rc1 adds TLS cert export via Lua, gre bridge decoding, and sensor-name JSON output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.1rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 3.0.1rc1

    • Adds transparent Ethernet bridge decoding for GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation..
    • Creates counters for decode-events errors accessible via stats subsystem

    2 details in Everything

30. 2.1beta4 Prerelease May 8, 2015 · release notes

    Suricata 2.1beta4 adds NETMAP support, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. file data extraction, xbits engine, and drop log alerts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1beta4 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 2.1beta4

    • Adds netmap interface type to enable network acceleration via the netmap framework
    • Adds SMTP file_data support.
    • Adds xbits support.
    • Extends EVE JSON logs to include alerts within drop log entries

    4 details in Everything

31. 2.1beta2 Prerelease Nov 6, 2014 · release notes

    Suricata 2.1beta2 adds email file extraction, Lua scripting support, MPLS detection, IP reputation CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network., and stream logging capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1beta2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 2.1beta2

    • feature #549 enables extraction of file attachments directly from email traffic
    • feature #1312 introduces Lua output support for custom scripting actions
    • feature #899 adds detection capability for MPLS over Ethernet networks
    • feature #707 expands IP reputation files to accept network range inclusion via CIDR notation
    • feature #383 adds stream logging to capture packet flow data

    +2 more show less

    • feature #1263 grants Lua scripts access to raw Stream Payloads for deep inspection
    • feature #1264 provides Lua scripts with access to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. quad / Flow Tuple metadata

    7 details in Everything

32. 2.1beta1 Prerelease Aug 12, 2014 · release notes

    Suricata 2.1beta1 adds payload logging to eve alerts and per-thread pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. recording.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 2.1beta1

    • Adds eve-log capability to include raw packet payloads in alert output
    • Extends JSON output format to include HTTP info with Alert output
    • Introduces flow/connection logging via eve-log

    3 details in Everything

33. 2.0.2 Jun 25, 2014 · release notes

    Suricata 2.0.2 adds NFLOG target support, DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. logging, liblua, and sigHUP log rotation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 2.0.2

    • Adds support for the NFLOG iptables target.
    • Adds DNS TXT data parsing and logging.
    • Adds liblua support allowing Lua scripting integration within the detection engine
    • Adds SIGHUP signal handling for automatic log rotation without restarting the service

    4 details in Everything

34. 2.0rc2 Prerelease Mar 6, 2014 · release notes

    Suricata 2.0rc2 adds VLAN tag support to all outputs and introduces an SSH log.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0rc2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 2.0rc2

35. 2.0beta1 Prerelease Jul 18, 2013 · release notes

    Suricata 2.0beta1 adds LuaJit flow vars, DNS parsing/logic, HTTP deflate support, and redesigned CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 2.0beta1

    • flow_vars and flow_ints support via LuaJit
    • DNS parser, logger and keyword support
    • deflate support for HTTP response bodies

    3 details in Everything

36. 1.4.1 Mar 8, 2013 · release notes

    Suricata 1.4.1 adds GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. keyword, HTTP host keywords, unix socket control API, and configurable unified2 sensor ID

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4.1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.4.1

    • Adds geoip keyword for matching against MaxMind database
    • Introduces http_host and http_raw_host keywords
    • Adds Python module for unix socket interaction
    • Adds unix socket commands: fetching config, counters, basic runtime info

    4 details in Everything

37. 1.4rc1 Prerelease Nov 29, 2012 · release notes

    Suricata 1.4rc1 adds interactive unix socket mode, IP Reputation loading/matching, and libhtp port mismatch event support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.4rc1

    • Interactive unix socket mode allows external management of Suricata via a Unix domain socket.
    • IP Reputation: loading and matching enables built-in reputation-based rule evaluation using loaded lists.
    • libhtp event 'request port doesn't match tcp port' adds detection logic for HTTP request/port mismatches.
    • Improved --list-keywords command-line option displays detailed information and documentation links for all supported keywords.
    • Rule analyzer now handles ipv4/ipv6 and invalid rules more robustly.

    +3 more show less

    • User-Agent header is now included in file log and filestore meta files for downloaded content.
    • Endace DAGDAGA directed acyclic graph — a data structure of nodes connected by one-way edges with no cycles — used by tools to model task pipelines or data flows where execution order and dependencies must be enforced without loops. driver supports live statistics reporting and at-exit drop statistics.
    • Rule reload performance is significantly improved under low traffic conditions.

    8 details in Everything

38. 1.4beta3 Prerelease Nov 14, 2012 · release notes

    Suricata 1.4beta3 adds user/group config keys, configurable HTTP body sizes, and Napatech improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4beta3 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.4beta3

    └──▷ USE IT
    Run the Suricata daemon as a specific system user and group for isolation.
    yaml copy

    run_user: suricata
    run_group: suricata

    Increase the buffer size for inspecting HTTP request bodies to a specific server configuration.
    yaml copy

    http-server:
      inspection-size: 1024

    • run_group and run_user config entries allow specifying the daemon's identity.
    • HTTP request and response body inspection sizes are now configurable per server.
    • Support for Napatech cards is significantly improved.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !stream.inline default changes to auto, enabling it in IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. mode and disabling it in IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. mode.
39. 1.4beta2 Prerelease Oct 4, 2012 · release notes

    Suricata 1.4beta2 adds LuaJIT keyword for packet inspection and granular HTTP parser controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4beta2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.4beta2

    └──▷ HOW TO FIND IT
    Use a Lua script to inspect HTTP payloads for custom patterns not covered by standard Suricata rules.
    📍# Add to suricata.yaml files: - /etc/suricata/rules/custom-rules.rules rules: - luajit: inspect_http.lua
    • luajit keyword enables inspecting packet, payload and all HTTP buffers with a Lua script
    • Global vs rule thresholds support for [3] syntax

    2 details in Everything

40. 1.3.1 Aug 21, 2012 · release notes

    Suricata 1.3.1 adds HTTP double decoding control and stream engine fixes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3.1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.3.1

    • HTTP: add per server options to enable/disable double decoding of URI (#464, #504)

    1 detail in Everything

41. 1.3rc1 Prerelease Jun 29, 2012 · release notes

    Suricata 1.3rc1 introduces live rule reload via USR2, HTTP Set-Cookie inspection, and negated filemd5.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.3rc1

    • Adds USR2 signal handling for experimental live rule reload without restarting the daemon
    • Adds negated filemd5 support to allow md5 whitelisting in rules
    • Expands http_cookie keyword to inspect Set-Cookie headers in addition to request cookies

    3 details in Everything

42. 1.3beta2 Prerelease Jun 8, 2012 · release notes

    Suricata 1.3beta2 adds file MD5 list matching, PF_RING 5.4, negative byte_extract offsets, and syslog action for file inspection scripts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3beta2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.3beta2

    • experimental support for matching on large lists of known file MD5 checksums
    • Support for PF_RING 5.4 added
    • File inspection scripts: Added Syslog action for logging to local syslog

    3 details in Everything

43. 1.3beta1 Prerelease Apr 4, 2012 · release notes

    Suricata 1.3beta1 adds TLS parser, multi-pattern engine, autofp runmode, and test mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.3beta1

    • Adds tls.subjectdn and tls.issuerdn rule keywords for TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. handshake inspection
    • Adds -T command-line option to test configuration syntax without running
    • Adds support for including external yaml files in the main configuration
    • Splits the file output into distinct file-store and file-log outputs
    • Adds CommandLine options to list supported app layer protocols and keywords

    5 details in Everything

44. 1.2rc1 Prerelease Jan 11, 2012 · release notes

    Suricata 1.2rc1 adds app-layer-events, unixsock output support, and HTTP response header inspection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.2rc1

    • Adds app-layer-events keyword to match on HTTP and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. events
    • Adds urilen options to match on raw or normalized URI length
    • Adds only_stream and no_stream flow keyword options
    • Adds unixsock output support for all outputs except unified2 via a PoC Python script in qa/
    • Expands http_header rule option to inspect response headers in addition to request headers

    5 details in Everything

45. 1.2beta1 Prerelease Dec 19, 2011 · release notes

    Suricata 1.2beta1 adds HTTP file extraction keywords (file, http_server_body) and YAML config options for core dumps and human-readable sizes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.2beta1

    • Adds filename, fileext, filemagic, and filestore keywords for detecting and storing extracted files in HTTP traffic
    • Adds file_data keyword to inspect normalized, dechunked, decompressed HTTP response bodies alongside the new http_server_body keyword and /S PCRE regex option
    • Adds a config key in suricata.yaml to enable or disable core dumping (enabled by default)
    • Enables human-readable size limit settings in suricata.yaml
    • Adds PF_RING BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. support (requires PF_RING >= 5.1) and privilege dropping capabilities

    +1 more show less

    • Adds tos keyword support for Type of Service detection

    6 details in Everything

46. 1.1rc1 Prerelease Nov 3, 2011 · release notes

    Suricata 1.1rc1 adds BDAT SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. support, stricter rule parsing, and Prelude state match output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1rc1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.1rc1

    • Adds new flow and stream counters in stats.log
    • Adds Prelude output capability for state matches

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removal of the unified1 output plugins
47. 1.1beta3 Prerelease Oct 25, 2011 · release notes

    Suricata 1.1beta3 adds AF-PACKET capture, workers runmode, and new detection keywords like replace and stream-event

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1beta3 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.1beta3

    • Adds af-packet support for high speed packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.
    • Adds a workers runmode for multi-dev and/or clustered PF_RING, AF_PACKET, pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.
    • Adds replace keyword support for rule modification
    • Adds stream-event keyword to match on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. session anomalies
    • Adds byte_extract keyword support

    +5 more show less

    • Adds support for suppress keyword in rules
    • Adds unified2 payload logging if detection was in the HTTP state
    • Adds support for flowbits in ip-only rules
    • Adds packet based performance profiling subsystem
    • Adds TCP SACK support to the stream engine

    10 details in Everything

48. 1.1beta2 Prerelease Apr 13, 2011 · release notes

    Suricata 1.1beta2 adds SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking. parsing, new rule keywords, pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. logging output, and pf_ring runmode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1beta2 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.1beta2

    • Adds http_raw_uri keyword (with /I pcre support) to allow matching raw HTTP URIs in rules.
    • Adds ssl_state and ssl_version keywords for inspecting SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS handshake states and versions.
    • Adds nfq_set_mark keyword for setting Netfilter queue marks in inline mode.
    • Introduces pcap logging / recording output to write captured traffic to disk.
    • Adds pf_ring runmode for improved packet processing scalability.

    +6 more show less

    • Enables basic SCTP protocol parsing, allowing inspection of Stream Control Transmission Protocol traffic.
    • Adds API for programmatically adding and selecting runmodes at startup.
    • Supports configurable interval for stats.log updates via configuration key.
    • Extends stream engine to inspect streams in larger chunks for improved performance.
    • Adds fast_pattern support for the http_method content modifier.
    • Adds negation support for the isdataat keyword in rule signatures.

    11 details in Everything

49. 1.1beta1 Prerelease Dec 21, 2010 · release notes

    Suricata 1.1beta1 adds http_raw_header keyword and Aho-Corasick pattern matcher

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1beta1 https://github.com/OISF/suricata.git
    # already have the repo? check out this version:
    $ git checkout 1.1beta1

    └──▷ TRY IT
    Inspect raw HTTP headers in network rules using the new http_raw_header keyword
    copy

    $ alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Raw Header Inspection"; content:"Value|0A"; http_raw_header; classtype:bad-unknown; sid:1000001; rev:1;)

    • Adds http_raw_header, http_stat_msg, and http_stat_code keyword support for network inspection rules
    • Introduces a new default Aho-Corasick based pattern matcher that reduces memory usage

    2 details in Everything