About 5 months after 1.3 came out we’ve released 1.4, and we’ve been quite busy. Eric Leblond’s post here has all the stats and graphs. There are three big new features: unix socket, ip reputation and luajit. For each of these the same is true: it’s usesable now, but it’s the potential that we’re most excited about. Over the next months we’ll be extending each of those to be even more useful. We’re very much interested in ideas and feedback.
Performance obviously matters to many in the IDS world, and here too we have improved Suricata quite a bit again. We now have Suricata 1.4 running on a ISP 10gbit/s network on commodity hardware with a large ET ruleset. Of course, YMMV, but we’re definitely making a lot of progress here.
Sometimes the little things matter a lot as well. A minor new feature is that live “drop” stats are the the stats.log now:
capture.kernel_packets | AFPacketem21 | 13640581 capture.kernel_drops | AFPacketem21 | 442864 capture.kernel_packets | AFPacketem22 | 7073228 capture.kernel_drops | AFPacketem22 | 9449 capture.kernel_packets | AFPacketem23 | 10528970 capture.kernel_drops | AFPacketem23 | 148281 capture.kernel_packets | AFPacketem24 | 7212584 capture.kernel_drops | AFPacketem24 | 12643 capture.kernel_packets | AFPacketem25 | 9763439 capture.kernel_drops | AFPacketem25 | 17874 capture.kernel_packets | AFPacketem26 | 10464106 capture.kernel_drops | AFPacketem26 | 20378 capture.kernel_packets | AFPacketem27 | 8869182 capture.kernel_drops | AFPacketem27 | 18336 capture.kernel_packets | AFPacketem28 | 7925045 capture.kernel_drops | AFPacketem28 | 258168
This is supported for AF_PACKET, PF_RING and libpcap.
Last August we’ve added Suricata to github to make it easier to participate. Also, the code review tools associated with the pull requests are very useful. Github has been an unexpected success for us. At the time of writing there are 24 forks of Suricata on it, I’ve processed about 250 pull requests. The patches that have been submitted range from small fixes to full blown features, and more are on the way. I’m very grateful for these contributions and everyone’s patience with me.
Now that 1.4 is out, we’ll be taking it slow over the holidays. The team has been working like crazy, and everyone deserves a break. So the next weeks we’ll focus on further consolidation, fixing bugs that no doubt will pop up. Other than that, things will be slow. After the holidays we’ll start planning for the next milestone. Again, your ideas and contributions are very welcome! 🙂