Suricata 8.0 Unleashed: Faster, Safer Network Defense with Rust & New Protocols

The stable release of Suricata 8.0 has officially been unveiled—a powerful open-source intrusion detection and network traffic analysis system developed by the OISF foundation. This marks the first major update in two years since the debut of Suricata 7.0. Version 8 represents a significant milestone in the project’s evolution, with a pronounced emphasis on performance, advanced detection capabilities, enhanced security, and support for modern network protocols.

Among the most noteworthy enhancements is the accelerated performance of the engine. Rule loading efficiency has been improved, PCAP file parsing has been streamlined, and initialization has been optimized through reengineered port grouping algorithms and MPM caching. These improvements collectively contribute to faster and more reliable traffic processing.

From a security perspective, critical components have been refactored into Rust—a memory-safe language—to mitigate vulnerabilities traditionally associated with unsafe C code. Libraries for handling FTP, MIME, ENIP, and HTTP (via LibHTP) have been rewritten. Protocol support has also been broadened to include ARP, DoH, LDAP, mDNS, POP3, SDP, and WebSocket.

The rules engine has undergone significant refinement. New keywords have been introduced (such as tcp.wscale, pgsql.query, from_base64, and entropy), along with transactional rule support and the ability to detect missing buffers. Additional buffers and keywords for parsing DNS, SMTP, TLS, FTP, MIME, and other protocols have been incorporated. An experimental firewall mode has also emerged, enabling Suricata to operate as a firewall with default policies and a formalized rule logic.

Lua support has been overhauled: Lua 5.4 is now embedded, running within an isolated sandbox and enabled by default. This enhances the security of executing user-defined scripts while preventing access to system-level resources. However, these changes also preclude loading external Lua libraries and restrict access to the os module.

Suricata has become more modular and easier to embed as a library. Developers can now use custom threads and packet sources, as well as fine-tune log output at a low level. Plugin support has expanded, with examples provided for dynamically registering new parsers (including SNMP) and application plugins. Traffic capture using Napatech and PF_RING has also been modularized into separate components.

Logging has become more precise. Logs now include exceptions and policy applications, expanded memory and overflow statistics, and new EVE output schemas. Users have the ability to suppress null counters and tailor the log structure to their specific operational needs.

The codebase continues to undergo “Rustification”: over 62,000 lines of Rust code were added in this release alone. In total, 2,090 files were modified—470 of them written in Rust and 1,294 in C. Rust support has been updated to version 1.75.0.

For PF_RING users, a critical change: the packet capture mechanism is now implemented as a plugin and requires explicit configuration adjustments.