入侵检测系统 Snort 2.9.1 发布

     Snort 发布了 2.9.1版，主要改变:    <br />     * Protocol aware reassembly support for HTTP and DCE/RPC preprocessors. Updates to Stream5 allowing Snort to more intelligently inspect HTTP and DCE/RPC requests and responses. See README.stream5 subsection related to Protocol Aware Flushing (PAF).    <br />     * SIP preprocessor to identify SIP call channels and provide rule access via new rule option keywords. Also includes new preprocessor rules for anomalies in the SIP communications. See the Snort Manual and README.sip for details.    <br />     * POP3 & IMAP preprocessors to decode email attachments in Base64, Quoted Printable, and uuencode formats, and updates to SMTP preprocessor for decoding email attachments encoded as Quoted Printable and uuencode formats. See the Snort Manual, README.pop, README.imap, and README.SMTP for details.    <br />     * Support for reading large pcap files.    <br />     * Logging of HTTP URL (host and filename), SMTP attachment filenames and email recipients to unified2 when Snort generates events on related traffic.    <br />     * IP Reputation preprocessor, allowing Snort to blacklist or whitelist packets based on their IP addresses. This preprocessor is still in an experimental state, so please report any issues to the Snort team. See README.reputation for more information.    <br />    <br />    <p><strong>Snort</strong>可以用来监测各种数据包如端口扫描等之外，还提供了以XML形式或数据库形式记录日志的各种插件。</p>    <p><strong>Snort</strong>有 三种工作模式：嗅探器、数据包记录器、网络入侵检测系统模式。嗅探器模式仅仅是从网络上读取数据包并作为连续不断的流显示在终端上。数据包记录器模式把数 据包记录到硬盘上。网路入侵检测模式分析网络数据流以匹配用户定义的一些规则，并根据检测结果采取一定的动作。网络入侵检测系统模式是最复杂的，而且是可 配置的。<br /> <br /> 项目地址：<a href="/misc/goto?guid=4958187683021858108" target="_blank">http://www.snort.org/</a></p>