From 3dc24a967a0527ce533de82e7dd36b7fe026f43a Mon Sep 17 00:00:00 2001 From: Giuseppe Longo Date: Fri, 24 Nov 2023 09:54:53 +0100 Subject: [PATCH] doc: add upgrade section for 8 --- doc/userguide/upgrade.rst | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst index fd6e275010..345087fe55 100644 --- a/doc/userguide/upgrade.rst +++ b/doc/userguide/upgrade.rst @@ -38,6 +38,19 @@ Upgrading 7.0 to 8.0 -------------------- .. note:: ``stats.whitelist`` has been renamed to ``stats.score`` in ``eve.json`` +Major changes +~~~~~~~~~~~~~ +- SIP parser has been updated to inspect traffic carried by TCP as well. + SIP keywords can still match on their respective fields in addition + to these improvements. + Transactions are logged with the same schema regardless of which + transport protocol is carrying the payload. + Also, SIP protocol is detected using pattern matching and not only + probing parser. +- ``SIP_PORTS`` variable has been introduced in suricata.yaml +- Application layer's ``sip`` counter has been split into ``sip_tcp`` and ``sip_udp`` + for the ``stats`` event. + Upgrading 6.0 to 7.0 --------------------