2011-10-20 - Snort 2.9.1.2
[*] Improvements
  * Fixed an issue where Snort would sometimes stop processing traffic in a
    persistent HTTP 1.1 connection with a UTF-32 encoded response followed by
    a UTF-16 encoded response.

2011-10-05 - Snort 2.9.1.1
[*] New Additions
  * Added the ability to use shared memory (linux only) for the
    experimental IP reputation preprocessor. See README.reputation for details.

  * Added a Unix control socket (linux only), used to issue commands to
    running Snort processes. Currently, it is only used by the IP
    Reputation preprocessor for communication regarding the shared memory.
    See the Snort Manual and the tools/control directory for more details.

[*] Improvements
  * Improved HTTP Inspect and rule processing for both raw compress
    and zlib deflated data. Expanded coverage of normalization for
    Unicode encoded data.

  * Updated HTTP Inspect PAF support to better handle HTTP 1.1 responses.

2011-08-23 - Snort 2.9.1

[*] New Additions
  * HTTP aware TCP reassembly support within HTTP Inspect and
    Stream5, allowing Snort to more intelligently inspect HTTP
    requests and responses.  See README.stream5 subsection
    related to Protocol Aware Flushing (PAF).

  * SIP preprocessor to identify SIP call channels and provide
    rule access via new rule option keywords.  See the Snort
    Manual and README.sip for details.

  * POP3 & IMAP preprocessors to decode email attachments in
    Base64, Quoted Printable, and uuencode formats, and updates
    to SMTP preprocessor for decoding email attachments encoded
    as Quoted Printable and uuencode formats.  See the Snort
    Manual, README.pop, README.imap, and README.SMTP for details.

  * Add support for reading large pcap files.

  * IP Reputation preprocessor, allowing Snort to blacklist or
    whitelist packets based on their IP addresses. This
    preprocessor is still in an experimental state, so please
    report any issues to the Snort team.
    See README.reputation for more information.

  * DCE aware TCP reassembly has been added to the dcerpc2 preprocessor.
    See README.stream5 subsection related to Protocol Aware Flushing (PAF).

[*] Improvements
  * Logging of HTTP URL (host and filename), SMTP attachment
    filenames and email recipients when Snort generates events
    on related traffic.

  * Updates to give shared library rules direct access to gzip
    decoding capabilities.

  * Rule Option Improvements:

    - Updates to content modifier http_cookie to not include
      the HTTP header names themselves in the buffer.  This change
      may affect existing rules that leverage this keyword.

    - Updates to the file_data and base64_data rule option keywords
      and added a pkt_data rule option keyword that sets the buffer
      to be used for subsequent content/pcre/etc rule options.

    - Updates to the tcp flag rule option keyword to support 'C'
      and 'E' for CWR and ECN bits.

    - Updates to byte_extract rule option keyword to support
      the same string formats as with byte_test and byte_jump.

  * Updates to Snort's build infrastructure and autoconf script
    for portability and improved checks for library dependencies.

  * Many updates and improvements to the Snort documentation.  Special
    thanks to all of the contributors from the Snort community for
    working with us and making the documentation more accurate and
    usable.

  * Updates to the sensitive data preprocessor for handling HTTP
    traffic and reducing false positives.

  * Updates to Snort's config parsing to give more meaningful
    error messages relating to snort.conf errors and configuration
    display at startup.

  * Updates to Snort's active response packets whether via response
    keyword or part of inline normalization.

  * Improvements to HTTP Inspect processing of chunked HTTP data.

  * Updates to the statistics Snort prints to console or syslog
    at exit for different preproessors.

  * To facilitate easier building of Snort on many of the different
    platforms supported, Snort now uses pkg-config to check for
    certain library locations. Obtain pkg-config from freedesktop.org.

  * HTTP Inspect has new options to detect the following anomalies:
    - Excessive whitespace in a folded header line
    - Series of HTTP chunks with small lengths

  * SIP preprocessor has new alerts for the following anomalies:
    - Invalid SIP version
    - Unknown SIP method
    - SIP method mis-match
    - Missing content-type header

  * Several bug fixes for Stream5's Protocol Aware Flushing

  * Fixed a bug where the socket output plugin sent the wrong data when
    IPv6 was enabled

  * Other bug fixes, see ChangeLog for more details.
