Software Update: Suricata 2.0.2

Version 2.0.2 of Suricata has been released. Suricata is an open source network intrusion detection system (IDS), intrusion prevention system (IPS), and network security monitoring engine. It can be used to monitor network traffic and alert a system administrator if anything suspicious is detected. Development is overseen by the Open Information Security Foundation, with support from the community and various manufacturers. The main change in version 2.0 is Eve, a fully op json based logging system. Eve can, among other things, with log stash are used to display information graphically again at to give. The changelog for this release looks like this:

Notable changes

• IP defrag issue leading to evasion. Bug discovered by Antonios Atlasis working with ERNW GmbH
• Support for NFLOG as a capture method. Nice work by Giuseppe Longo
• DNS TXT parsing and logging. Funded by Emerging Threats
• Log rotation through SIGHUP. Created by Jason Ish of Endace/Emulex

All closed tickets

• Feature #781: IDS using NFLOG iptables target
• Feature #1158: Parser DNS TXT data parsing and logging
• Feature #1197: liblua support
• Feature #1200: sighup for log rotation
• Bug #1098: http_raw_uri with relative pcre parsing issue
• Bug #1175: unix socket: valgrind warning
• Bug #1189: abort() in 2.0dev (rev 6fbb955) with pf_ring 5.6.3
• Bug #1195: nflog: cppcheck reports memleaks
• Bug #1206: ZC pf_ring not working with Suricata 2.0.1 (or latest git)
• Bug #1211: defrag issue
• Bug #1212: core dump (after a while) when app-layer.protocols.http.enabled = yes
• Bug #1214: Global Thresholds (sig_id 0, gid_id 0) not applied correctly if a signature has event vars
• Bug #1217: Segfault in unix-manager.c line 529 when using –unix-socket and sending pcap files to be analized via socket

Logstash Kibana fed with information from Suricata with json output.