Download it here: Suricata1.4.1-1-32bit.msi

After downloading, double click the file to launch the installer. Please note that the installer is not yet signed.

If you have a previous version installed, please remove that first.

If you’re using this PPA, updating is as simple as:

apt-get update && apt-get upgrade

The PPA Ubuntu packages have IPS mode through NFQUEUE enabled.

Get the new release here: suricata-1.4.1.tar.gz

The most interesting new feature is the GeoIP support. Great contribution by Ignacio Sanchez. It adds “geoip” rule keyword that allows you to match on source of destination of a packet per country.

New features

• GeoIP keyword, allowing matching on Maxmind’s database, contributed by Ignacio Sanchez (#559)
• Introduce http_host and http_raw_host keywords (#733, #743)
• Add python module for interacting with unix socket (#767)
• Add new unix socket commands: fetching config, counters, basic runtime info (#764, #765)

Improvements

• Big Napatech support update by Matt Keeler
• Configurable sensor id in unified2 output, contributed by Jake Gionet (#667)
• FreeBSD IPFW fixes by Nikolay Denev
• Add “default” interface setting to capture configuration in yaml (#679)
• Make sure “snaplen” can be set by the user (#680)
• Improve HTTP URI query string normalization (#739)
• Improved error reporting in MD5 loading (#693)
• Improve reference.config parser error reporting (#737)
• Improve build info output to include all configure options (#738)

Fixes

• Segfault in TLS parsing reported by Charles Smutz (#725)
• Fix crash in teredo decoding, reported by Rmkml (#736)
• fixed UDPv4 packets without checksum being detected as invalid (#760)
• fixed DCE/SMB parsers getting confused in some fragmented cases (#764)
• parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#697)
• FN: IP-only rule ip_proto not matching for some protocols (#689)
• Fix build failure with other libhtp installs (#688)
• Fix malformed yaml loading leading to a crash (#694)
• Various Mac OS X fixes (#700, #701, #703)
• Fix for autotools on Mac OS X by Jason Ish (#704)
• Fix AF_PACKET under high load not updating stats (#706)

Special thanks

• Ignacio Sanchez
• Matt Keeler — nPulse
• Jake Gionet
• Nikolay Denev
• Jason Ish — Endace
• Jamie Strandboge
• Charles Smutz
• Rmkml

Known issues & missing features

As always, we are doing our best to make you aware of continuing development and items within the engine that are not yet complete or optimal. With this in mind, please notice the list we have included of known items we are working on.

See issues for an up to date list and to report new issues. See Known_issues for a discussion and time line for the major issues.

About Suricata

Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF, its supporting vendors and the community.

Because of the fixes below, upgrading is highly recommended.

Download: http://www.openinfosecfoundation.org/download/suricata-1.3.6.tar.gz

Fixes

• fix decoder event rules not checked in all cases (#671)
• checksum detection for icmpv6 was fixed (#673)
• crash in HTTP server body inspection code fixed (#675)
• fixed a icmpv6 payload bug (#676)
• IP-only rule ip_proto not matching for some protocols was addressed (#690)
• fixed malformed yaml crashing suricata (#702)
• parsing ipv6 address/subnet parsing in thresholding was fixed by Jamie Strandboge (#717)
• crash in tls parser was fixed (#759)
• fixed UDPv4 packets without checksum being detected as invalid (#762)
• fixed DCE/SMB parsers getting confused in some fragmented cases (#763)

Special thanks

• Jamie Strandboge

Known issues & missing features

If you encounter issues, please let us know! As always, we are doing our best to make you aware of continuing development and items within the engine that are not yet complete or optimal. With this in mind, please notice the list we have included of known items we are working on.

See http://redmine.openinfosecfoundation.org/projects/suricata/issues for an up to date list and to report new issues. See http://redmine.openinfosecfoundation.org/projects/suricata/wiki/Known_issues for a discussion and time line for the major issues.

About Suricata

Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF, its supporting vendors and the community.

nPulse Technologies, Inc. takes the pulse of the world’s fastest networks. For customers with extremely big pipes of 10Gbps or more, who run intelligence-driven security and network operations, nPulse solutions are open, standards-based collection platforms that integrate ultrafast flow and packet capture probes with big data analytics. Unlike traditional packet capture solutions which are proprietary, expensive, and unable to scale to today’s network core speeds, nPulse platforms capture 100% of network traffic at 20 Gbps and utilize a Big Data analytics approach to significantly reduce the time, effort, and resources required to produce actionable intelligence. For more information, visit www.npulsetech.com.

As the leader in 64-bit manycore general purpose processors, the company is already hard at work contributing to the Consortium and has delivered the highest performance, highest density Suricata solution in the market – seeing about 40 Gbps throughput in a 1U platform. The Suricata implementation on TILE-Gx processors supports all the features of Suricata including both the IDS and IPS modes of operation.

“Tilera’s involvement with the OISF and Suricata is significant validation of Suricata as an Engine, and threading as the way forward for the industry as a whole,” said Matt Jonkman, president, OISF. “The performance benefits that Tilera has already demonstrated with Suricata and the TILE-GX processor family is thoroughly impressive and is just a taste of what is to come.”

The industry-leading performance was achieved on Tilera’s TILExtreme-Gx high density platform that packs 144 cores with four TILE-Gx36 processors in a compact 1U rack mountable device. The standard TILExtreme-Gx platform provides up to 160Gbps of Ethernet I/O and is ideal for a variety of compute and I/O intensive tasks such as Network Security (IDS/IPS, DPI, DLP), Network Monitoring, Data Forensics and Big Data processing. It is actively being deployed by several Tilera customers. Additionally, based on the performance and I/O requirements, Tilera customers have the ability to scale up or down by choosing from range of platforms ranging from half-length PCIe cards to the high density 1U chassis.

Tilera will unveil a new platform that doubles the capacity in the first quarter of 2013. Support for the TILE-Gx will also be added for the open source version of Suricata.

There will be much more exciting news to come from Tilera and the OISF in 2013. If you want to learn more about Tilera and its solutions, contact  Satish Ganesan, Director of Marketing, Networking Solutions, for Tilera. In the meantime, stay tuned to this space for the latest updates!

The Open Information Security Foundation (OISF) is a non-profit foundation organized to build a next generation IDS/IPS engine Suricata.  The OISF has formed a multi-national group of the leading software developers in the security industry.  In addition to developers and a consortium consisting of leading cyber security companies, OISF has engaged the open source security community to identify current and future IDS/IPS needs and desires.

Download it here: Suricata1.4-1-32bit.msi

After downloading, double click the file to launch the installer. Please note that the installer is not yet signed.

If you have a previous version installed, please remove that first.

If you are running Fedora, updating is as simple as:
yum update


Installing is as simple as:
yum install suricata

The Fedora package has IPS mode through NFQUEUE enabled.

If you are running Ubuntu 13.04, updating is as simple as:
apt-get update && apt-get upgrade

Installing is as simple as:
apt-get update && apt-get install suricata

The Ubuntu package has IPS mode through NFQUEUE enabled.

The OISF also provides a PPA for this and other Ubuntu versions: instructions can be found here.

If you’re using this PPA, updating is as simple as:

apt-get update && apt-get upgrade

The PPA Ubuntu packages have IPS mode through NFQUEUE enabled.