{"id":138900,"date":"2025-07-10T05:12:03","date_gmt":"2025-07-10T03:12:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostupna-sistema-obnaruzheniya-atak-suricata-8-0"},"modified":"2026-02-08T16:48:26","modified_gmt":"2026-02-08T14:48:26","slug":"dostupna-sistema-obnaruzheniya-atak-suricata-8-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/dostupna-sistema-obnaruzheniya-atak-suricata-8-0","title":{"rendered":"The Suricata 8.0 attack detection system is now available.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
After two years of development, the OISF (Open Information Security Foundation) has released version 8.0 of the Suricata network intrusion detection and prevention system, which provides tools for inspecting various types of traffic. Suricata configurations allow the use of the signature database developed by the Snort project, as well as the Emerging Threats and Emerging Threats Pro rule sets. The project's source code is distributed under the GPLv2 license.<\/p>\n
Key Changes:<\/p>\n
\n
An experimental feature has been added to use Suricata as a firewall. The firewall mode allows the use of a dialect of the traffic inspection rule language to filter network packets.<\/li>\n
The scripting capability in Lua has been reworked. The codebase now includes the Lua 5.4 interpreter, which runs in a sandbox environment that restricts Lua rules (for example, writing to files or creating network sockets is not permitted from within the rules).<\/li>\n
Dynamic (at runtime) registration of plugins with protocol parsers, detectors, and components for logging is now available.<\/li>\n
Significant performance optimizations have been made, accelerating various aspects of the engine's operation, including protocol detection, rule loading, and initialization. This acceleration is achieved through state prediction, hash function optimization, increased size of PCAP format data loading buffers, and reworked thread synchronization. The startup time of Suricata has also been reduced using caching, enhanced port grouping, and improved IP address substitution algorithms.<\/li>\n
The handlers for LibHTP, FTP, and ENIP, as well as the code for parsing MIME types, the byte_extract operations, and base64 decoding have been rewritten in Rust.<\/li>\n
Support has been added for the DoH (DNS over HTTPS), LDAP, mDNS (Multicast DNS), and Websocket protocols.<\/li>\n
New decoding and logging modules for the ARP and POP3 protocols have been added.<\/li>\n
Traffic parsing for SDP over SIP and SIP over TCP has been provided.<\/li>\n
The capabilities of the protocol detection engine and rule building have been expanded. Key words for rules now include LDAP, MIME\/EMAIL, vlan.id, DNS, SMTP, FTP, TLS, tcp.wscale, pgsql.query, from_base64, entropy, luaxform, and mDNS. Transactional rules have been added to describe both directions of a transaction within a single rule.<\/li>\n<\/ul>\n
Features of Suricata:<\/p>\n
\n
\n
\n
Use for outputting results in the unified format Unified2, also applied by the Snort project, allowing the use of standard analysis tools such as barnyard2. Integration with products like BASE, Snorby, Sguil, and SQueRT is possible. Supports output in PCAP format;<\/li>\n
Support for automatic protocol detection (IP, TCP, UDP, ICMP, HTTP, TLS, FTP, SMB, etc.), allowing rules to operate only on the protocol type, without being tied to port numbers (e.g., blocking HTTP traffic on a non-standard port). Availability of decoders for protocols HTTP, SSL<\/a>, TLS, SMB, SMB2, DCERPC, SMTP, FTP, LDAP, and SSH;<\/li>\n