Hi Matthew,
Any news on the announced porting to Snort 2.x ?
I have seen HS is now the default pattern matching engine for Suricata
(congrats) but no news on the snort side (yes I know they are playing with
it in upcoming 3.0 release, but nothing in 2.x)
Regards
El mié., 1 jun. 2016 3:31, Barr, Matthew <matthew.barr(a)intel.com> escribió:
Hi all,
We have just pushed Hyperscan 4.2.0 to Github. The changelog on Github is
a good summary of what has changed since 4.1, but I will also include it
here:
[4.2.0] 2016-05-31
• Introduce an interpreter for many complex actions to replace the
use of internal reports within the core of Hyperscan (the "Rose" engine).
This improves scanning performance and reduces database size for many
pattern sets.
• Many enhancements to the acceleration framework used by NFA and
DFA engines, including more flexible multibyte implementations and more
AVX2 support. This improves scanning performance for many pattern sets.
• Improved prefiltering support for complex patterns containing very
large bounded repeats (R{M,N} with large N).
• Improve scanning performance of pattern sets with a very large
number of EOD-anchored patterns.
• Improve scanning performance of large pattern sets that use the
HS_FLAG_SINGLEMATCH flag.
• Improve scanning performance of pattern sets that contain a single
literal by improving the "Noodle" literal matcher.
• Small reductions in total stream state for many pattern sets.
• Improve runtime detection of AVX2 support.
• Disable -Werror for release builds, in order to behave better for
packagers and users with different compiler combinations than those that we
test.
• Improve support for building on Windows with MSVC 2015 (github
issue #14). Support for Hyperscan on Windows is still experimental.
• Small updates to fix warnings identified by Coverity.
• Remove Python codegen for the "FDR" and "Teddy" literal
matchers.
These are now implemented directly in C code.
• Remove the specialist "Sidecar" engine in favour of using our more
general repeat engines.
• New API function: add the hs_expression_ext_info() function. This
is a variant of hs_expression_info() that can accept patterns with extended
parameters.
• New API error value: add the HS_SCRATCH_IN_USE error, which is
returned when Hyperscan detects that a scratch region is already in use on
entry to an API function.
regards,
Matt.