PHREL v2.1.0 (07/05/26) - http://www.digitalgenesis.com

Change Log:

  v2.1.0 (07/05/26) - Performance enhancement
   - Replace global hash mutex with 4096 striped locks for concurrent capture
     and data-thread processing.
   - Batch packet reads and cache current second in the capture loop.
   - Maintain incremental rolling PPS sum at capture time; skip idle hash
     entries on the data thread.
   - Compact per-host IP keys and embedded sample arrays (one malloc per host).
   - Rename the 'jump' configuration/CLI option to 'action', with drop,
     reject, and accept as dedicated parser tokens.

  v2.0.0 (07/05/26) - Major enhancement (Breaking change)
   - Replace the hand-written configuration parser with a flex/bison
     subsystem. Configuration syntax now uses brace blocks (options { }
     and phrel { }) with semicolon-terminated statements. Angle-bracket
     blocks (<threshold>, <redis>, etc.) are no longer supported.
   - Install the default configuration to /etc/phrel/phreld.conf. When
     invoked with no command-line options, the daemon reads this file on
     startup; -C/--config overrides the path. When other command-line
     options or a BPF expression are given, a configuration file is not
     required unless -C is specified. traceoptions [ configuration ] logs
     the parsed configuration when enabled (also enabled automatically when
     debug >= 2).
   - Replace iptables/ip6tables fork/exec with libnftables for firewall
     enforcement. phreld now requires nftables (RHEL 8+, Ubuntu 22.04+, or
     any distro with a nf_tables-backed kernel and libnftables installed).
   - Enforcement now uses a dedicated 'inet phreld' nftables table with flat
     per-host rules instead of per-host iptables chains inserted into
     filter/INPUT.
   - Removed the '--iptables'/'-x' and '--ip6tables'/'-y' command line
     options and the 'iptables'/'ip6tables' configuration file keys. There
     is no iptables fallback.
   - Added the 'nft-priority' option to control where the phreld hook chain
     is evaluated relative to other netfilter hooks.
   - 'jump' is now limited to standard nftables verdicts (drop, reject,
     accept) rather than an arbitrary iptables chain name.
   - phreld now removes its entire nftables table on startup (clearing any
     orphaned rules from a previous crash) and on clean shutdown/restart.
   - Remove Net-SNMP / SNMP trap support entirely. Removed the '--snmptrap'/'-S'
     command line option and '<snmptrap>' configuration blocks, along with the
     libsnmptrap library, trap module, and MIB files. Net-SNMP is no longer an
     optional build dependency.
   - Replace optional MySQL cross-instance sync with Redis (hiredis).
     Removed --enable-mysql, all db_* / <database> CLI and config options,
     libmysqlclient build dependency, and docs/mysql-phrel.sql schema.
   - Added --enable-redis, <redis> configuration block, and redis_host,
     redis_port, redis_sock, redis_user, redis_pass, instance_id, instance-file,
     sync_algo, and sync_threshold options. Default sync_algo is combined
     (local.avg + sum of peer avgs) for correct load-balancer detection;
     sync_threshold 2 PPS; check_interval 30 seconds.
   - Added optional instance_id with auto-assignment via Redis INCR and
     persistence to instance_file (default ~/phreld.id). Redis connect
     failure logs a warning and phreld continues without cross-instance sync.
   - Enable Redis support by default in RPM and Debian packages (hiredis-devel /
     libhiredis-dev). Override with rpmbuild --define 'redis 0' to disable.
   - Fix redis_foreach_host() pipelining when reading stats from multiple
     peers. Rename calc-interval config key to check-interval.

  v1.1.0 (07/03/26) - Major enhancement
   - Import source into git and modernize the autotools build system.
   - Require libpcap via pkg-config; add optional SNMP and MySQL support.
   - Improve packet capture, logging, signal handling, and SNMP trap support.
   - Refactor hash management, thread data handling, and iptables chain updates.
   - Add secure string helpers and scrub sensitive configuration data from memory.
   - Remove the obsolete dump option and simplify configuration handling.
   - Add systemd service support; replace the SysV init script with phreld.service.
   - Add RPM and Debian packaging with make pkg, rpm, and deb targets.
   - Ship a default phreld.conf that rate limits ICMP to 10 packets per second.
   - Update installation instructions and copyright years.

  v1.0.2 (05/31/13) - Bug fix
   - Fixed a compile failure when NetSNMP was not available.
   - Cleaned up a number of warnings.

  v1.0.1 (04/20/13) - Bug fix
   - Fixed a segfault on startup related to specific server interfaces.
   - Fixed a bug with excluded CIDR prefix ranges.
   - Cleaned up a number of warnings and removed my_end() call.

  v1.0.0 (09/09/11) - Major enhancement
   - Added support for IPv6.
   - Added support for setting direction of capture.
   - Added graceful handling of malloc() failures.

  v0.9.8 (01/25/09) - Major enhancement (Never Released)
   - Added syncronization between instances of PHREL via MySQL, which is useful
     with server farms behind load balancers.

  v0.9.7 (07/21/08) - Bug fix and minor enhancement (Never Released)
   - Applied patch kindly provided by Steve Grubb of Red Hat, which fixed
     a hand full of issues and improved security.
   - Added spec file and init script also provided by Steve Grubb.
   - Included the article "Protecting your DNS Infrastructure with PHREL"
     with the documentation.

  v0.9.6 (10/19/06) - Bug fix
   - Command line thresholds are no longer required if they are specificed
     within the configuration file.

  v0.9.5 (04/15/06) - Bug fix and minor enhancement
   - Fixed several incorrect uses of memset() which prevented proper
     initialization of internal structures, causing seg faults on some systems.
   - Updated with enterprises number assigned by Internet Assigned Numbers
     Authority (IANA).
   - Made promiscuous mode a configurable option and changed default to disable
     promiscuous mode.
   - Lowered max chain size to 28 characters and shortened chain names due to
     length restrictions in Fedora Core 4. Reported by Bekar.
   - Added support for a configuration file.

  v0.9.4 (03/26/06) - Bug fix and minor enhancement
   - Cleaned up SNMP trap code.
   - Added support for startup, shutdown and restart SNMP traps.
   - Added check for verifying iptables binary is valid and executable.
   - Added support for include prefix ranges.
   - Fixed typos in man page.

  v0.9.3 (03/22/06) - Bug fix and minor enhancement
   - Fixed assert failure on incoming traffic from 0.0.0.0/32 (spoofed).
   - Added support for SNMP traps.
   - Created MIB for PHREL using temporary enterprises number. Included in the
     mibs directory.
   - Added support for net-snmp, dmalloc, pthread and libpcap to the configure
     script.
   - Cleaned up include headers and fixed compiler warnings.
   - Added man page.

  v0.9.2 (03/06/06) - Bug fix and minor enhancement
   - Fixed all compiler warnings.
   - Memory for samples is now dynamically allocated.
   - Fixed fork on startup bug.
   - Added option for user definable chain instead of DROP.
   - Better handling of failed chain inserts.
   - Added work around for select() bug.

  v0.9.1 (03/05/06) - Minor enhancement
   - Capture code rewritten to use select to call libpcap which allows PHREL to
     shutdown when there is no incoming traffic.
   - Added options for configurable intervals.
   - Added option for configuring PPS algo.
   - Converted from inet_ntoa() to inet_ntop() for thread safety.

  v0.9.0 (03/02/06) - Initial release
   - Implemented exclusions.
   - Implemented per threshold burst and decay.