TBD

Bug #317: Invalid Rules

Bug #376: Windows - Failure when trying to get MTU

Bug #437: filemagic / libmagic inconsistent between releases

Bug #500: duplicate values in host-os-policy not detected

Bug #569: display syntax requirement on keyword parsing error

Bug #705: http.log missing lots of requests under high traffic load

Bug #708: Flow vars issue in pcap file mode

Bug #747: Reset async flag if stream is found to be non-async

Bug #778: ipv6 addr with nat64 notation

Bug #786: Windows - yaml directory paths

Bug #849: Not alerting on invalid http request Content-Length

Bug #868: 1.4.3: Makefile[.in] doesn't use its own INSTALL variable definition

Bug #923: memcap value in suricata.yaml

Bug #924: missing space between variable and value in suricata.yaml

Bug #992: Different alerts reported when reading from pcap file with runmode=single and runmode=autofp

Bug #1013: command line parsing

Bug #1020: 1.4.6: sc_log_config->op_filter not filled in

Bug #1083: pfring: valgrind: Syscall param socketcall.setsockopt(optval) points to uninitialised byte(s)

Bug #1084: pfring: valgrind: memory leak at exit in bpf filter

Bug #1152: Write to ipfw divert socket failed: Message too long

Bug #1247: Using suppress in threshold.config does not prevent dropping

Bug #1271: Creating core dump with dropped privileges

Bug #1275: ET Rule 2003927 not matchin in suricata

Bug #1315: trans_q should not have hardcoded size

Bug #1324: vlan tag in eve.json

Bug #1328: No vlanid in pcap-log

Bug #1370: sctp fp on suricata engine

Bug #1382: BPF not reflected in suricata.log when using pf-ring

Bug #1390: suricatasc return empty iface-stat.pkts in IPS nfqueue mode

Bug #1412: byte_test checks before byte_extract happens in some cases

Bug #1427: configure with libnss and libnspr

Bug #1457: Non-standard prefixes used for file size indication

Bug #1473: eve-json and tls logs aren't consistently writing to file when browsing bad certificate websites

Bug #1504: better notification in verbose mode on luascript err

Bug #1526: Malformed encoded base64 packet in json logs

Bug #1543: vlan tracking - false positive with relation to TCP/UDP protocols

Bug #1549: flow keywords rule parsing

Bug #1560: Newline in certificate subject name results in premature line break in TLS log

Bug #1561: Write to ipfw divert socket failed: Permission denied rappidly followed by a fatal "[ERRCODE: SC_ERR_TM_THREADS_ERROR(136)] - thread restarts exceeded threshold limit for thread Verdict0"

Bug #1567: TCP: Evasion issue

Bug #1593: Negative within error - works in snort

Bug #1694: unix-socket reading 0 size pcap

Bug #1711: Ethernet Header Missing From JSON Packet Field

Bug #1722: ip rules don't trigger under the context of 'flow:stateless'

Bug #1738: [ERRCODE: SC_ERR_MEM_ALLOC<1>] - Can not allocate fingerprint string - Suricata 2.0.11-1

Bug #1754: Inconsistent behavior with 'only_stream' flow keyword

Bug #1770: Suricata takes very long time to start using hyperscan and large/custom detect settings

Bug #1772: Inconsistent number of alerts while reading a pcap - runmode single/autofp,unix-socket

Bug #1782: Unkown TLS's subject attributes

Bug #1817: Suricata 3.1RC1 crashing

Bug #1833: Transaction can be logged before stream reassembly and parsing are complete

Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible)

Bug #1848: crash if disk is full

Bug #1881: pcap logging out of order

Bug #1882: I don't know why the 2nd file TRUNCATED

Bug #1900: Field http.hostname not being parsed out correctly.

Bug #1911: Commandline provided configuration values don't persist after initial startup

Bug #1915: rules: afl/asan crashes

Bug #1922: runmodes: memory leaks

Bug #1926: rule parsing: wrong content checked for fast_pattern (snort compatibility)

Bug #1981: luajit states fail to run with valgrind

Bug #2013: failure of TCP after DOS attack

Bug #2014: Possible autofp issue in detection causing extended runtime processing a pcap.

Bug #2042: Difference protocol of MD5 rule will restart Suricata automatically

Bug #2056: missing warning on a rule using within with one content keyword

Bug #2057: eve.json flow logs do not contain in_iface

Bug #2066: netmap/linux: can't capture packets in suricata-3.2

Bug #2080: Rules with bad port group var do not error

Bug #2091: nonexistent/misspelled custom fields accepted during parsing of suricata.yaml

Bug #2094: luajit: SCFlowvarGet always returns null

Bug #2147: fileinfo: sha1 hash not logged if state == TRUNCATED

Bug #2190: apparent 1000 character limit in threshold.conf IP lists

Bug #2205: Buffer confusion with fast_pattern:only;

Bug #2210: logging: SC_LOG_OP_FILTER still displays some lines not matching filter

Bug #2220: When running on a single-CPU machine, pcap processing takes a long time

Bug #2221: Suricata batch processing slowed down by 0.2s intervals

Bug #2224: Negated http_* match returns false if buffer not populated

Bug #2249: rule with file keyword used with ip or tcp not seen as invalid

Bug #2251: Suricata won't start - SC_ERR_AHO_CORASICK

Bug #2257: rate_filter doesn't honor "timeout" if it is longer than "seconds" parameter

Bug #2264: file-store.stream-depth not working as expected when configured to a specfic value

Bug #2265: pass rules not taken into account

Bug #2289: af-packet bpf filtering failed to select multiple vlan

Bug #2305: unified2 alerts not including xff ips using extra-data mode

Bug #2321: yaml: clean up usage of lists

Bug #2326: File extraction not properly handling http range requests

Bug #2333: Suricata doesn't see http traffic as http traffic in wierd proxy

Bug #2351: Suricata with alert-prelude option sending only one IDMEF message (not more).

Bug #2358: Inconsistent DNS/flows extracted from pcap

Bug #2362: rule reload with workers mode and NFQUEUE not working stable

Bug #2369: option force-filestore generate truncated file

Bug #2373: unix domain socket owner stays root when priviledges dropped

Bug #2378: log rotation 'flag' should be atomic

Bug #2386: check if default log dir is writable at start up

Bug #2393: One way TLS traffic not properly identified

Bug #2395: File_data inspection depth while inspecting base64 decoded data

Bug #2412: Suricatasc isn't showing or allowing pcap file continuous option

Bug #2413: Pcap Interrupt Keeps Pcap File Processing Interrupted

Bug #2423: Suricata 4.0.3 and Napatech crashing

Bug #2424: suri->userid (SCInstance) does not reflect correct uid if suricata is started as non-root

Bug #2428: suricata.log file permission error message when using suricata -l <dir> -r x.pcap as unprivilegded user

Bug #2429: TCP-session and wrong alert timestamp

Bug #2432: engine-analysis does not print out the tls buffers

Bug #2434: memleak - possible/definite memleaks reported for libnss3 and pthread_create

Bug #2435: Suricata 4.0.3 in IPS mode seems to discard some DNS requests

Bug #2452: After some time log only alerts with linktype=12

Bug #2458: memleak: gitmaster - 4.1.0-dev (rev c60decd)

Bug #2465: Eve Stats will not be reported unless stats.log is enabled

Bug #2473: Please allow disabling every option (add --without-{option})

Bug #2474: Not found the function of parser the dyn_port when in FTP active mode

Bug #2477: 802.1ah & Untagged Traffic

Bug #2478: PCAP logging does not include 802.1q header when using af-packet

Bug #2479: http_cookie negation fails if no cookie in traffic

Bug #2489: suricata with pf_ring - Segmentation Fault (core dumped)

Bug #2490: Filehash rule does not fire without filestore keyword

Bug #2493: EngineAnalysisRules2 File Output Cannot Be Adjusted

Bug #2494: Invalid Base64 payload for filemd5 alerts

Bug #2495: Stream depth and filestore interaction

Bug #2500: stored will always equal false in fileinfo events

Bug #2527: FTP file extraction only working in passive mode

Bug #2751: Engine unable to disable detect thread, Killing engine. (in libpcap mode)

Feature #120: Capture full session on alert

Feature #121: Alert on domain name look up, capture traffic for corresponding IP

Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml

Feature #266: log http raw request for network forensic

Feature #273: IRC protocol detection support

Feature #276: Libcap support for dropping privileges

Feature #294: Limit inspection of a stream and/or rule...

Feature #328: Traceability and QA with regards to rules loaded

Feature #352: Switching to message queuing system for output

Feature #365: expose interface(unix socket command) to reset tcp connection

Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires

Feature #432: PCAP-NG support

Feature #448: dlp: md5sum based on part of files

Feature #465: benchmark runmode

Feature #473: pcap log: alert log with packet indexes

Feature #511: Port indepedent protocol identification

Feature #524: detect double encoding in URI

Feature #535: new keywords - time , day

Feature #544: Live traffic decryption

Feature #547: libinjection -- sqli library

Feature #548: Use bloomfilter for filemd5

Feature #584: lua: expose file buffers

Feature #596: rule profiling: multiple outputs per run

Feature #609: Active Response in inline mode (like react in snort 2.9+)

Feature #614: Rate limiting messages

Feature #641: Flowbits group for ORing

Feature #659: Update IP reputation from unix socket.

Feature #660: Update host policy from unix socket

Feature #682: Add DEP and ASLR to Windows Binary

Feature #713: tls.fingerprint - file usage

Feature #716: configurable packet_stats.csv and packet_stats.log

Feature #721: full nfq zero copy mode

Feature #728: Add support for OpenCL

Feature #731: generic streaming parser api

Feature #745: Tunnel configuration

Feature #776: Add smtp_envelope and smtp_header keywords

Feature #783: LuaJIT be able to return various messages for a single script.

Feature #808: Support the new GSO-avoidance NFQ feature

Feature #816: TCP SACK: limits per stream

Feature #821: Conditional logging

Feature #843: Custom http logging filter functionality

Feature #845: Memory consumption in stats.log

Feature #870: luajit: global vars

Feature #884: add man pages

Feature #886: bromagic support

Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules

Feature #936: support tzsp protocol

Feature #947: dynamic allocation of thread queues

Feature #960: persistent TCP resets

Feature #984: libhtp HTP_AUTH_UNRECOGNIZED

Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip?

Feature #1005: conditional logging

Feature #1015: add chained content info to rule analysis

Feature #1017: Add support for content-range

Feature #1065: Introduce vlan id keyword

Feature #1088: Detect virtual machines during build/start

Feature #1095: Integration of support for STIX-based indicators

Feature #1096: Log TLS client certificate

Feature #1099: keyword: file_name keyword

Feature #1100: keyword: file_ext keyword

Feature #1132: set rpath for libs not in the default linker paths

Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global)

Feature #1149: add systemd service

Feature #1191: EVE log does not support customformat

Feature #1194: Implement http_args keyword to match http arguments - query string or body

Feature #1199: LDAP support

Feature #1215: journald logging support

Feature #1229: Suricata alerts in CEF Format

Feature #1234: nfqueue: use mnl API

Feature #1239: Best effort TCP stack

Feature #1245: Add "drop-only" and "alert-only" option for pcap-log

Feature #1249: http/dns ip-reputation alike technique

Feature #1250: Multipath TCP

Feature #1274: ssh events

Feature #1283: support for snort's file_data keyword

Feature #1290: handle SIGHUP signal

Feature #1300: profiling: per flow recording of profiling data

Feature #1323: automated eve.json rotation

Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session

Feature #1389: suppress by host

Feature #1468: File extension : fileext rule protocol support

Feature #1478: Active flow counters

Feature #1489: Log a message when memcap limit is reached

Feature #1505: Show loaded lua scripts during live rule swap or normal start in verbose mode

Feature #1520: multitenancy - verbose output clarity

Feature #1541: multi-detect - vlan range mapping

Feature #1542: dump-config - extend into multi-detect supplied yaml configuration

Feature #1545: Add type variable into StatsRecord

Feature #1566: ICMPv4 control channel detection

Feature #1571: Socket permissions setting in suricata.yaml

Feature #1576: http: byte-range support

Feature #1590: lua: force file magic and md5 lookup from script

Feature #1608: Add option to disable JSON escape slash

Feature #1655: Gather (develop) external scripts, extensions, addons specific to suricata to the wiki/contrib

Feature #1662: Disable action / rule ordering option

Feature #1710: Unix socket: Send output to unix socket

Feature #1712: multitenancy: 'lite' tenants

Feature #1726: pfring: IPS support

Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET

Feature #1752: Netmap for Windows

Feature #1757: URL Reputation

Feature #1766: TLS keyword expansion

Feature #1767: Support DTLS protocol

Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts

Feature #1794: test suricata rules over unix-socket

Feature #1799: netmap: capture drop stats

Feature #1828: YARA support

Feature #1851: add verbosity level description to the help command

Feature #1872: add --list-decoder-protos or similar

Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law

Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass

Feature #1940: Debian Jessie - better message when trying to run 2 suricata with afpacket

Feature #1947: HTTP2 decoder

Feature #1950: allow configuration of file-store types

Feature #1954: runtime option/flag to disable hardware timestamp support

Feature #1956: Add option to re-initialise Lua output scripts

Feature #1971: lua: make mandatory

Feature #1977: get the os info from TCP HTTP fingerprint

Feature #1979: TCP/IP packets normalization/scrubbing

Feature #1993: commandline: introduce --enable-all-outputs switch

Feature #2015: eve: add fileinfo in alert

Feature #2016: doc: improve keywords self documentation

Feature #2054: Extracting HTTPS URL´s from SMTP, currently only HTTP is supported

Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted

Feature #2092: Improved support for xbits/hostbits - workers runmode

Feature #2096: eve: event_type for MODBUS

Feature #2107: eve: rotate log output based on size

Feature #2115: Changing interfaces

Feature #2127: Rate Limiting by Tracking Both Source & Destination IP Addresses

Feature #2145: Relate directly flowid with certificate file

Feature #2166: output: log only triggering buffers

Feature #2167: eve-ng

Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update.

Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET

Feature #2196: Add flow_id to the file extracted .meta file

Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures

Feature #2200: Dynamically add md5 to blacklist without full restart

Feature #2213: file matching: allow generic file matching / store

Feature #2219: Save pcap only if alert

Feature #2227: more detailed output about number of threads created

Feature #2232: Allow Large value in suricata.yaml file

Feature #2233: Allow log for payload and packet only for defined sid

Feature #2262: Unix Socket Output Configurable Retries and Blocking

Feature #2269: TLS: tls.version: allow negation or comparison

Feature #2273: engine analysis: enable analysis by default during startup

Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events

Feature #2278: failing better

Feature #2280: http: rules that match both request and response

Feature #2281: tcp stream: simpler IDS handling of overlap evasions

Feature #2282: event log aka weird.log

Feature #2284: detect partial file transfers

Feature #2290: lua: expose lua generated buffers to rule lang

Feature #2297: deprecate: dns.log

Feature #2300: DPDK integration

Feature #2301: netflow: dump records at interval

Feature #2308: threshold/suppress by http_host

Feature #2310: lua: expose xbits

Feature #2311: math on extracted values

Feature #2312: http: parsing for async streams

Feature #2313: save & restore state when suricata restarts

Feature #2314: protocol parser: rdp

Feature #2316: global memcap

Feature #2318: matching on large amounts of data with dynamic updates

Feature #2319: Expose flow lifetime to the rulelanguage

Feature #2323: Applayer support for telnet

Feature #2332: Support for common http response headers - Location and Server

Feature #2342: Write PCAP files directly to Unix Socket

Feature #2343: Add "flush" command to unix socket

Feature #2363: pcap: read directories recursively

Feature #2371: list all available /exposed fields to lua

Feature #2375: Design and implement sensible per-thread capabilities

Feature #2376: deprecate: files-json.log

Feature #2377: deprecate: ssh.softwareversion and ssh.protoversion

Feature #2379: deprecate: Tilera / Tile support

Feature #2380: [discussion] deprecate: 'alert syslog' output

Feature #2381: [discussion] deprecate: 'drop' log output

Feature #2385: deprecate: unified2

Feature #2388: smtp: log md5 of attachments

Feature #2409: Push signatures without reloading the entire set.

Feature #2410: Create a reset counter and track maximum number of parallel flows

Feature #2415: Force timestamp to UTC timezone via yaml

Feature #2421: Warn user if -r (pcap offline mode) is used with default log dir

Feature #2426: tls: extend logging

Feature #2448: Add additional buffers for DNS Responses

Feature #2450: lua scripts access to calling rule informations

Feature #2459: Support of FTP active mode

Feature #2485: http: log byte range with file extraction

Feature #2486: prefilter/fast_pattern logic for flowbits

Feature #2487: Buffers for field/value pairs in http_uri and http_client_body

Feature #2488: HTML Parsing / Buffers

Feature #2497: error messages usability improvement

Feature #2513: Suricata read the SSLProxy header

Feature #2519: XFF iprep support

Feature #2524: Allow user to choose the reject iface

Feature #2538: dsize keyword improvements

Feature #2539: protocol parser: vxlan

Feature #2553: support 'by_both' in threshold rule keyword

Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode

Feature #2613: stats: add xdp counters to stats

Feature #2670: tls_cert sticky buffer

Feature #2693: libsuricata

Feature #2694: thresholding: feature parity between global and per-rule options

Feature #2695: websocket support

Feature #2696: http parser in rust

Feature #2697: prefilter support for stream_size

Feature #2698: hassh and hasshServer for ssh fingerprinting

Feature #2699: document all eve record types and fields

Feature #2700: ja3/ja3s functionality for IKEv2

Feature #2701: flow: counter for allocations at runtime

Feature #2713: protocol detection w/o protocol parsing

Feature #2732: convert dcerpc parser to Rust

Feature #2754: JA3 and JA3S - sets / reputation

Feature #2758: intel / reputation matching on arbitrary data

Feature #2766: Simplified Napatech Configuration

Feature #2771: MPLS over Vlan support

Feature #2772: Add MPLS labels to alert output

Support #1990: Rule management updation using pulledpork

Support #2322: create place for easy sharing of test cases

Support #2453: Big flows are splitted

Support #2470: Suricata does not always alert on traffic with content that matches rules

Optimization #426: sid based thresholding data structure improvement

Optimization #442: code cleanup - update all prototypes to include parameter names

Optimization #536: share ctx for filemd5 keyword if identical files are used

Optimization #570: memory fragmentation

Optimization #749: pcre 8.32 introduces JIT pcre_jit_exec(...)

Optimization #795: stream: use pool instead of direct SACK record allocs

Optimization #879: update configure.ac with autoupdate

Optimization #945: remove useless includes

Optimization #1038: Flow Queue should be a stack

Optimization #1094: Special check for first character of buffer

Optimization #1188: Don't use iface name in GetIfaceMaxHWHeaderLength

Optimization #1218: BoyerMooreNocase could avoid tolower() call

Optimization #1220: Boyer Moore SPM pass in ctx instead of indivual bmBc and bmBg

Optimization #1222: Boyer Moore content not shared between same content

Optimization #1313: All Free functions should correctly handle NULL pointers

Optimization #1322: Flow Spare Queue should be a stack

Optimization #1688: Do not try to turn on netmap if the driver doesn't support it

Optimization #1718: Time stamp in Log files should be ISO 8601 format

Optimization #1791: Kernel Drops: Thread occasionally Spike to 100%

Optimization #2272: Analyze DNS response if query is not present

Optimization #2317: rcu

Optimization #2405: Use FileTruncateAllOpenFiles for every app layer protocol

Optimization #2460: Reduce timeout in unix-socket when multiple pcaps are enqueued

Optimization #2530: Print matching rule SID in filestore meta file

Optimization #2602: add keywords to --list-keywords output

Project

General

Profile

Suricata