On 29th August 2018, the team at Snort released the fourth alpha of the next generation Snort IPS– Snort 3, in beta version. Along with all the Snort 2.X features, this version of Snort++ includes new features as well as bug fixes for the base version of Snort.
Here are some key features of Snort++:
- Support provided for multiple packet processing threads
- Shared configuration and attribute table available
- Simple, scriptable configuration
- Key components are now pluggable
- Autodetect services for portless configuration
- Support for sticky buffers in rules
- Autogenerate reference documentation
- Provide better cross-platform support
- Facilitate component testing
- Support pipelining of packet processing, hardware offload and data plane integration, and proxy mode
Below is a brief gist of these upgrades,
Easy Configuration
LuaJIT is used for configuration with a consistent, and executable syntax.
Better Detection of Services
The team has worked closely with Cisco Talos to update rules to meet their needs, including a feature they call “sticky buffers.” The Hyperscan search engine, and regex fast patterns make rules faster and more accurate.
HTTP Support
Snort 3 has a stateful HTTP inspector that handles 99 percent of the HTTP Evader cases. The aim is to achieve 100% coverage soon. The HTTP support also includes new rule options.
Better Performance
Deep packet inspection now gives a better performance. Snort 3 supports multiple packet-processing threads, and scales linearly with a much smaller amount of memory required for shared configs.
JSON event logging
This can be used to integrate with tools such as the Elastic Stack. Check out the Snort blog post for more details on the same.
More Plugins!
Snort 3 was designed to be extensible. It has over 225 of plugins of various types. It is easy for users to add their own codec, inspector, rule action, rule option, or logger.
In addition to all these features, users can also watch out for additional upgrades like next generation DAQ, connection events, search engine acceleration among others. To know more about the release of Snort 3, head over to Snort’s official page.
Read Next-
OpenFaaS releases full support for stateless microservices in OpenFaaS 0.9.0
Mastodon 2.5 released with UI, administration, and deployment changes
GNOME 3.30 released with improved Desktop performance, Screen Sharing, and more
