Snort version 3 was offered as a beta version until early in 2020.
Instead of upgrading Snort 2,
the developers completely rewrote Snort to improve its
functionality and change the way the system works.
As a result,
version 3 is a significant departure from previous versions of Snort, but
there are some similarities and a tool to help you get your configuration
and rules files prepared for the new version.
There are many new features in version 3,
and a comprehensive list is available in the Snort manual.
I figured I would highlight a few examples of the
significant increase in functionality.
One new feature that was not available in previous versions is
the ability to process raw files, like PDFs,
which involve reading the file and then processing the
data to detect potential attacks.
An example of new features added to previous capabilities are the
improvements to the port scan capability from previous versions.
This module is now more configurable and includes
the ability to block port scans.
Version 3 also includes more extensive help from the command line,
and there are more than 200 plugins available to increase its functionality.
The complete rewrite of Snort made significant improvements,
but it also created a few compatibility issues with previous
versions that will need to be overcome if you're upgrading
an existing version 2 server.
I mentioned it earlier,
but it's worth highlighting again that version 3 uses the Lua programming
language for its configuration file instead of the proprietary Snort
configuration format used in previous versions.
Version 3 uses plugins instead of preprocessors.
While many have similar functionality, at the time this course was created,
familiar additional tools like PulledPork and Barnyard are
still designed primarily for previous versions.
Even rules are written slightly differently and have
increased capabilities as a result.
Although these are significant changes,
there is a tool that can help you migrate your configuration and
rules files to version 3 called Snort2Lua. Snort2Lua is a tool that
can convert your version 2 configuration file to a Lua file that is
compatible with version 3.
It can also convert some rules files,
but not all of the options in version 2 are supported in version 3.
If Snort2Lua is unable to convert a version 2 rule,
it will convert it to the best of its capability and then
comment the rule out in the new file.
This is done so it doesn't affect Snort's operation until you're able
to review the rule and make the necessary changes.