Suricata 1.1 released, 1.2 on the horizon

Posted on Nov 10, 2011

Today we released Suricata 1.1. This ends a rather long development cycle of more than a year. And it shows. Performance, accuracy and features were all greatly improved. I think it’s the best Suricata so far. If you’ve been looking at trying Suricata, now might be a good time to jump in.

The long development cycles should be something of the past. At our last brainstorm session, at RAID 2011, we decided to change our release policy. The aim of this policy is to do time based releases, roughly a “stable” every 2 months and a beta every other month. This way we’ll be making it much easier for users to stay current without have to run our “git master”.

Looking forward, we’ve started work on the 1.2 release, which should happen in about 2 months. Focus will be on performance. We’re planning to do a significant refactoring of our pattern matching engine, which should lead both to better performance and improved accuracy. Next to this, we’ll be finally adding the “file_data” keyword along with HTTP file carving – extracting files from HTTP requests. I am personally very excited about this.

We’re starting to see more and more community involvement. Not just on the user side, but also on the development side. As seen on the oisf-devel mailinglist, a large SSL/TLS patch set was contributed by Pierre Chifflier. This will make it’s way into the 1.2 release as well. Smaller contributions were accepted on PF_RING code and the HTTP code. I am very grateful for the contributions.

Eric Leblond and I will be doing a talk next week at DeepSec on Suricata. If you are able to, please come meet us!