CapMe 1.0.1 is now available and supports UDP traffic!

The following packages are now available:
securityonion-capme - 20121213-0ubuntu0securityonion65
securityonion-sguil-client - 20141004-0ubuntu0securityonion16
securityonion-sguil-sensor - 20141004-0ubuntu0securityonion16
securityonion-sguil-server - 20141004-0ubuntu0securityonion16

These new packages should resolve the following issue:

Issue 492: CapMe needs to handle UDP better
https://github.com/Security-Onion-Solutions/security-onion/issues/492

Thanks to Wes Lambert!

Updating
These packages are now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Release Notes
After installing the updated packages, you will need to restart sguild as follows:

sudo nsm_server_ps-restart

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Security Onion and Ubuntu's MySQL 5.1 update

Ubuntu just released new MySQL packages.  A few things to be aware of for Security Onion users:

• The update will stop MySQL in order to perform the update.  If sguild is running at the time, it will terminate as soon as MySQL stops.  Once you've successfully completed the update and MySQL is back up and running, you should run the following on your Security Onion server to start sguild:

sudo nsm_server_ps-start

• When updating a Security Onion SENSOR (that sends its alerts to a separate Security Onion server), the update will try to start MySQL, but it will hang since port 3306 is already in use (being forwarded to the server over SSH).  You can simply kill the startup since MySQL is currently not used on Security Onion sensors.  On subsequent reboots, MySQL will startup, but when /etc/init/securityonion.conf executes, it will stop MySQL and bring up the SSH tunnel with port 3306 forwarded to the server.

If you have any questions or problems, please send a detailed email to our mailing list.  Thanks!