SMTP file extraction in Suricata

Tue, 11 Nov 2014 10:47:42 +0000

In 2.1beta2 the long awaited SMTP file extraction support for Suricata finally appeared. It has been a long development cycle. Originally started by BAE Systems, it was picked up by Tom Decanio of FireEye Forensics Group (formerly nPulse Technologies) followed by a last round of changes from my side. But it’s here now.

It contains:

a MIME decoder
updates to the SMTP parser to use the MIME decoder for extracting files
SMTP JSON log, integrated with EVE
SMTP message URL extraction and logging

As it uses the Suricata file handling API, it shares almost everything with the existing file handling for HTTP. The rule keyword work and the various logs work automatically with SMTP as well.

Suricata 1.1.1 released

Wed, 07 Dec 2011 18:34:50 +0000

A maintenance update for the Suricata 1.1 series was just released. It fixed an important issue. In some cases Suricata could crash on SMTP traffic.

The full announcement for the 1.1.1 release is here.

Naturally, the issue has also been fixed in the 1.2 development branch.

Smtp on Inliniac

SMTP file extraction in Suricata

Suricata 1.1.1 released