Suricata 1.4 is out
About 5 months after 1.3 came out we’ve released 1.4, and we’ve been quite busy. Eric Leblond’s post here has all the stats and graphs. There are three big new features: unix socket, ip reputation and luajit. For each of these the same is true: it’s usesable now, but it’s the potential that we’re most excited about. Over the next months we’ll be extending each of those to be even more useful. We’re very much interested in ideas and feedback.
Performance obviously matters to many in the IDS world, and here too we have improved Suricata quite a bit again. We now have Suricata 1.4 running on a ISP 10gbit/s network on commodity hardware with a large ET ruleset. Of course, YMMV, but we’re definitely making a lot of progress here.
Sometimes the little things matter a lot as well. A minor new feature is that live “drop” stats are the the stats.log now:
capture.kernel_packets | AFPacketem21 | 13640581
capture.kernel_drops | AFPacketem21 | 442864
capture.kernel_packets | AFPacketem22 | 7073228
capture.kernel_drops | AFPacketem22 | 9449
capture.kernel_packets | AFPacketem23 | 10528970
capture.kernel_drops | AFPacketem23 | 148281
capture.kernel_packets | AFPacketem24 | 7212584
capture.kernel_drops | AFPacketem24 | 12643
capture.kernel_packets | AFPacketem25 | 9763439
capture.kernel_drops | AFPacketem25 | 17874
capture.kernel_packets | AFPacketem26 | 10464106
capture.kernel_drops | AFPacketem26 | 20378
capture.kernel_packets | AFPacketem27 | 8869182
capture.kernel_drops | AFPacketem27 | 18336
capture.kernel_packets | AFPacketem28 | 7925045
capture.kernel_drops | AFPacketem28 | 258168
This is supported for AF_PACKET, PF_RING and libpcap.
Last August we’ve added Suricata to github to make it easier to participate. Also, the code review tools associated with the pull requests are very useful. Github has been an unexpected success for us. At the time of writing there are 24 forks of Suricata on it, I’ve processed about 250 pull requests. The patches that have been submitted range from small fixes to full blown features, and more are on the way. I’m very grateful for these contributions and everyone’s patience with me.
Now that 1.4 is out, we’ll be taking it slow over the holidays. The team has been working like crazy, and everyone deserves a break. So the next weeks we’ll focus on further consolidation, fixing bugs that no doubt will pop up. Other than that, things will be slow. After the holidays we’ll start planning for the next milestone. Again, your ideas and contributions are very welcome! :)