LoginSign Up
← Back to all sparks
S

Snort 3

INFRA · APIS
Velocity0.0

Open-source intrusion prevention and detection system

www.snort.org ↗

Snort 3's release train is almost entirely appid: identifying traffic it can no longer read.

intrusion detectionapplication identificationencrypted trafficmemory safetyquic
◆Current state
Every release in this window is dominated by two threads. The first is appid, the application identification engine, which keeps gaining ways to classify traffic that encryption has closed off: a QUIC extractor, preferring QUIC appid over SSL, midstream service discovery, SSL detection during midstream, and a fix for detection when the SNI is spoofed. The second is a sustained memory-safety campaign across dce_rpc, dce_smb, and appid, with use-after-frees, leaks, underflows, and out-of-bounds reads closed release after release.
◆Where it's heading
Snort is adapting an inspection engine built for readable traffic to a network where most of it is not. The investment is in inferring application identity from what remains visible, and in doing so on flows the sensor joined late. Alongside that, output is becoming more machine-consumable, with appid in alert_json, binary flow state dumps, and new DNS counters. The C codebase is being hardened continuously, which suggests fuzzing and sanitizer work running behind the feature stream.
◆Prediction
QUIC handling has moved from an extractor to an appid preference in consecutive releases while midstream detection keeps widening; extending the same treatment to more encrypted protocols is the clearest continuation these entries support.

◆Recent moves

  1. 3mo ago

    3.12.2.0: deviceinfo Lua API and dce_rpc memory fixes

    Adds a Lua API for publishing deviceinfo events and two-way SSL cache data, on top of a long list of dce_rpc and dce_smb memory-leak and use-after-free fixes. The detector-facing Lua surface keeps growing while the C internals get cleaned.

    View source ↗
  2. 4mo ago

    3.12.1.0: detection fix for spoofed SNI

    Fixes application detection when the SNI is spoofed, syncs host attributes on HTTP service detection, and closes thread-sanitizer data races in the decompressor. The SNI fix matters most: it closes an evasion path in the field.

    View source ↗
  3. 5mo ago

    3.11.1.0: trace multi-logging and midstream SSL detection

    Implements multi-logging for the trace subsystem under the new Lua configuration, and extends midstream work with SSL service detection, port inspection, and NFSv4.1 support. Midstream capability keeps widening across consecutive releases.

    View source ↗
  4. 6mo ago

    3.10.2.0: configurable midstream discovery, QUIC preferred over SSL

    Makes midstream service discovery configurable and prefers QUIC appid over SSL, alongside out-of-bounds read fixes in bootp and sslv2 parsing and a binary format for flow state dumps. The QUIC preference is the operative change for encrypted traffic classification.

    View source ↗
  5. 6mo ago

    3.10.1.0: out-of-order inspection on by default

    Enables out-of-order packet inspection by default in the third-party engine and adds appid logging to alert_json. Turning out-of-order inspection on by default changes what sensors see without any config change.

    View source ↗
  6. 6mo ago

    3.10.0.0: QUIC extractor and DNS flavor counters

    Adds a QUIC extractor, OPC UA handling, DNS flavor counters, and an unsubscribe API on the multiprocess data bus. This is where the QUIC visibility thread starts, before later releases build appid logic on top of it.

    View source ↗