Skip to main content

RIOS 8.0-8.7 Release Notes

The release notes of RIOS versions between 8.0.x and 8.7.x are shown here. Older version release notes are available in the older combined format (alongside rWeb) for previous versions back to 5.2, as shown in the sidebar.

RIOS 8.7.3​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

Bug Fixes

  • Fix for the bug in RIOS 8.7.0 - 8.7.2 where handling specifically corrupted TCP packets can cause an engine segfault.

RIOS 8.7 Critical Bug Notice​

danger

There is a bug present in RIOS 8.7 versions that can cause RIOS to crash. This bug is not present in RIOS versions prior to 8.7.0, so if you are running an 8.7 version we recommend immediately downgrading to RIOS 8.6.3 or upgrading to RIOS 8.7.3 or later.

RIOS has a chance to crash when processing specific kinds of corrupted TCP packets if all of the following are true for the zone that handles that packet:

  • The device is running RIOS 8.7.0 - RIOS 8.7.2
  • At least one AT filter mode is not set to Off
  • Any of the following combinations of configuration is set:
    • AT62 is set to Monitor or Off
    • AT62 is set to Auto and "IP Protocol Control > Drop packets with invalid layer 3 length" is unset
    • AT62 is set to Auto and "TCP Protocol Control > Allow partial headers" is set

RIOS 8.7.2​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

danger

It's recommended to downgrade to RIOS 8.6.3 or upgrade to RIOS 8.7.3 or later at this time. See more information at this link.

This release extends SNMP support with full reporting of the HOST-RESOURCES-MIB.

Enhancements

RIOS 8.7.1​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

danger

It's recommended to downgrade to RIOS 8.6.3 or upgrade to RIOS 8.7.3 or later at this time. See more information at this link.

This release is mostly bug fixes related to logging and observability.

Bug Fixes

  • Fixed a bug where RIOS Syslog messages for attacks were no longer being generated.
  • Fixed a case where internal attacker logging could capture binary/unparseable data.
  • Fixed an edge case where configuring an IPFIX/PSAMP sample collector could flood syslog with messages. This required configuring a collector address on the same subnet as the RIOS device's management address, but without any host actively assigned to that address. This will no longer fill up syslog with errors, but if there are problems they will be reported under the various PSAMP send failure categories on the device summary page.

RIOS 8.7.0​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

danger

It's recommended to downgrade to RIOS 8.6.3 or upgrade to RIOS 8.7.3 or later at this time. See more information at this link.

New Features

  • On a per-device basis, devices running this version can be set to no longer unwrap IPv4/IPv6 encapsulated or GRE packets and instead handle it in the Zone based on the outermost visible IP header. Additional tunneled traffic handling controls are also available under AT62.

Bug Fixes

  • Reverted a change to power management in a packet handling call that was causing RX overruns.

RIOS 8.6.3​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

Bug Fixes

  • Fixed an issue where filter list algorithms wouldn't create a victim in specific circumstances. This would cause the device to report addresses as filtered but not actually drop relevant traffic.

RIOS 8.6.2​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

Bug Fixes

  • Fixed an issue introduced by the OS update in RIOS 8.5.0 where a log file was no longer being rotated properly, causing full disks and subsequent upgrade problems. If you encounter an issue when attempting to upgrade from 8.5 or a previous 8.6 release, reboot your device first and then upgrade to this release.

RIOS 8.6.1​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

Bug Fixes

  • Fixed an issue introduced in RIOS 8.4.6 where the victim attack threshold check can now prevent attack packets from being dropped properly, notably for blacklists.
  • Fixed an issue introduced in RIOS 8.5.0 where any blacklist, whitelist, or graylist entries applied to the Default Zone (either local or global).
  • Fixed a bug for internal attacker logging where it would erroneously log a 0.0.0.0 address source and destination with non-existent attack type AT0.

RIOS 8.6.0​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

warning

There are two bugs in this release that were carried over from RIOS 8.4.6 and 8.5.0. It's recommended to upgrade to 8.6.2 instead.

New Features

Enhancements

  • In support of IPFIX/PSAMP, SNMP will now report interface traffic using ifIndexes that match the data port shown in rWeb. Previously RIOS's management port would be reported using ifIndex 1 (with the data plane ports counting up from 2), and now it will reported using ifIndex 65536.

RIOS 8.5.0​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

warning

There is a bug in this release that was carried over from RIOS 8.4.6, and a new bug that was carried over into 8.6.0. Since 8.5.0 was introduced shortly before 8.6.0, it's recommended to upgrade to 8.6.2 instead.

Enhancements

  • Overhauled internal configuration structures. As a result, configuration changes should be applied much faster (previously it could take up to 30 seconds but now should be 10 or less).
  • Updated base OS and upgraded multiple system packages.

Bug Fixes

  • Fixed a case where AT61 victims could be marked with an incorrect subtype.
  • rFlow samples (used by rWeb for victim sample packets and computing Top List et al.) will now match the ports from rWeb. rWeb and RIOS will send rFlow data with a source and destination port of 61166. Previously RIOS would select a random source port, ignoring what was sent in the subscription rFlow message from rWeb.
  • Fixed a case where empty PPTP messages (sometimes used for keepalives) could be erroneously flagged by AT62 as having invalid length (subtype 19).

RIOS 8.4.7​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

warning

The bug fixed in this release is present in RIOS 8.4.6, 8.5.0, and 8.6.0. It is recommended that you upgrade to either 8.4.7 if staying in 8.4 or 8.6.2 if upgrading to a later release.

Bug Fixes

RIOS 8.4.6​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

warning

This release introduced a bug that is also present in RIOS 8.5.0 and 8.6.0. It is recommended that you upgrade to either 8.4.7 if staying in 8.4 or 8.6.1 if upgrading to a later release.

Bug Fixes

RIOS 8.4.5​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

Enhancement

  • Increased performance of large packet handling for the RE100.

Bug Fixes

RIOS 8.4.3​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

warning

This release has a critical fix for a bug introduced in RIOS 8.4. If you're running any previous RIOS 8.4 version we recommend upgrading to this one immediately.

Bug Fixes

  • Critical fix to prevent a segfault which can occur in previous RIOS 8.4 versions when an IPv6 filter list entry is added after one or more IPv4 filter list entries.

RIOS 8.4.2​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

Enhancement

  • Greatly reduced the false positive rate observed for AT5.

RIOS 8.4.1​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

Bug Fixes

  • Fixed a problem where RIOS reported victim address family incorrectly for UDP and ICMP attacks (AT17, 19, 23, and 25 always, and AT18, 22, and 24 sometimes) to rWeb. This would cause IPv4 victims to sometimes render as IPv6 in rWeb (and vice versa), but would not affect the actual filtering of the attack.

RIOS 8.4.0​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 8.1 or higher)

Enhancements

  • Improved filtering for UDP (mostly under AT17) and ICMP (mostly under AT23).

  • Improved efficiency of AT9 filtering.

  • Further AT1 performance improvements.

  • Support to validate Explicit Congestion Notification (ECN) flags. Ahead of an rWeb release with graphical controls, this support can be enabled by using advanced configuration to set the keys of at_1_validate_ecn_flags or at_2_validate_ecn_flags to "on". When at_1_validate_ecn_flags is enabled the following packets will be dropped:

    • TCP/SYN packets with ECN field = CE in the IP header
    • TCP/SYN packets with CWR = 1, ECE = 0 or CWR = 0, ECE = 1

    When at_2_validate_ecn_flags is enabled the following packets will be dropped:

    • TCP/SYN-ACK packet with CWR = 1, ECE = 1 or CWR = 1, ECE = 0 Both will be reported under AT1 or AT2 with the numerical subtype 5.

  • The base model number of a RIOS VM will now be displayed as "RVM", as the underlying capacity is license controlled.

  • Included explicit setup for a 40G RIOS VM, with an accompanying license level for that capacity.

  • The base OS was upgraded to a newer kernel version.

Bug Fixes

  • Fixed an issue where "Drop invalid length packets" under "UDP Protocol Control" in the AT62 Invalid Packets could drop GRE and PPTP traffic.
  • Fixed an issue where AT62 would not properly allow ICMPv6 ping echo and response packets when "Drop all ICMP Traffic" and "Except Ping" were checked.
  • VM RIOS devices that are using a CPU missing required features will now raise an 'insufficient resources' alarm with the description 'unsupported cpu'.
  • Fixed an issue where speed and duplex on Myri based systems were reported incorrectly.
  • Fixed a scaling problem that would cause AT19 rate limiting to over filter.

RIOS 8.3.5​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, VM10 (Requires rWeb 8.1 or higher)

Bug Fixes

  • Fixed issue where tcpdump wasn't correctly using the configured snaplen value when it was larger than 1023 but at or below the maximum value.
  • Fixed issue where TCP options for session setup packets weren't being handled correctly, potentially causing false positives.

RIOS 8.3.4​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, VM10 (Requires rWeb 8.1 or higher)

Bug Fixes

  • Fix to reduce sensitivity of AT1 mitigation while under attack that can cause delays in session establishment from non-attacker IPs to the victim.

RIOS 8.3.3​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, VM10 (Requires rWeb 8.1 or higher)

Bug Fixes

  • Fixed a condition that could cause an RS30 or RX10 to experience an extremely long reboot process. This only happens on these platforms (and this release is a recommended upgrade for them) but other platforms do not need to upgrade to this release.

RIOS 8.3.2​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, VM10 (Requires rWeb 8.1 or higher)

Other Changes

  • Default values of the at_XX_attack_packet_count_victim_reporting_threshold are now changed from 0 to 10. This means that by default the device will only report victims to rWeb that exceed a packet count of 10, unless this value is set explicitly by rWeb. If you see attack traffic reported but no victims, this may be the reason. You can override this behavior by changing the value for a given attack type back to 0 to receive full reporting again, or to a different threshold based on your requirements. This affects reporting of the victim only; attack behavior will be dropped in either case.

RIOS 8.3.1​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, VM10 (Requires rWeb 8.1 or higher)

Enhancements

Bug Fixes

  • Added fix for segfaults caused by processing invalid length TCP options.
  • Added additional check for IPv6 null addressing.
  • Added additional checks for truncated or missing L4 headers (UDP, TCP, ICMP).

Other Changes

  • Added a guard against a potentially incorrect radix tree operation.
  • Added internal checks and counters for multi segment packets.

RIOS 8.3.0​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, VM10 (Requires rWeb 8.1 or higher)

Enhancements

  • A zone wide threshold value is now used for certain attack type/subtype behaviors to limit victim creation in cases where it won't unduly impact most hosts. This should dramatically reduce low rate false positive/noisy reporting for devices running RIOS 8.3.0.
  • AT62 reporting of checksum errors now has two new subtypes, 28 (TCP) and 29 (UDP) to make it distinct from subtype 18 (IPv4). Earlier versions of RIOS will still report all checksum errors as subtype 18.
  • AT3 has a variety of new subtypes to cover situations uncovered while fixing bugs described further below.

Bug Fixes

  • Changed some usages of internal percent calculation checks.
  • Added a fix for some additional cases where an attack might not correctly capture any sample packets.
  • Fixed an issue where AT3 was flagging selective ACK (SACK) packets incorrectly as duplicate packets.
  • Fixed an issue where AT3 wasn't correctly tracking duplicates after a closed session continued to send traffic. This behavior is now a new subtype (6).
  • Adjusted AT3 so TCP Keepalive packets are handled differently. They will no longer be considered generic duplicate ACKs but handled differently under their own subtypes (7, 8) for when this mechanism specifically is abused.
  • The config ranges of maximum duplicates for various algorithms have now changed. RIOS 8.3.0 will still accept old configuration values from rWeb but will change this value to the new maximum if the configuration exceeds this value. The maximum values are now as follows:
Attack TypeOld Maximum DuplicatesNew Maximum
AT16314
AT26314
AT36362
AT56314
  • Added a fix for potential UB (Undefined Behavior) for specific radix tree inserts.
  • Fixed an issue where DNS parsing expected a valid header and at least one valid section, but there are legal packets that have a valid header but no additional section.
  • Fixed a bug that could cause AT4 to report victims even if the allowed percentage was 100%.
  • Fixed a hashing problem that could cause subpar filtering for IPv6 AT1 and AT2 victims.
  • Fixed a separate hashing problem that could create suboptimal hashes used when processing UDP and DNS payloads.
  • Fixed an issue where IPv4 packets with a reserved bit not equal to 0 were being flagged as AT4 versus their correct type, AT62 ST7 Invalid IP Header flags
  • Fixed a bug where AT8 victims were being reported with a subtype 1 lower than their actual value. This also affected sample packet generation.
  • Greatly reduced AT5 false positive rate caused by not performing certain traffic ratio checks.

RIOS 8.2.1​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.1 or higher)

New Features

  • Victim reporting by devices can now have packet minimum thresholds. This fundamentally changes reporting of victims but can drastically reduce the workload on rWeb, particularly in situations where the bulk of attack traffic is from large scale blacklists.

Bug Fixes

  • Fixed case where RE100 would report incorrect speed on its interfaces if they were not plugged in.
  • KVM/Virtio ports will now report "not available" if information about port speed, duplex and flow control configuration can't be conveyed properly by the host (versus "unknown").
  • Fixed issue where logging of junk data could happen when processing truncated packets.
  • RIOS Syslog Messages will now use the zone name versus the "customer" (group) name for attacks.
  • Victim start and end times are now left shifted to more accurately align with when the actual attack traffic started and ended.
  • Fixed a condition where LLCF error messages would loop continuously in the logs.
  • Resized an internal memory structure that was using more memory than was actually required.
  • Fixed an issue where an AT61 regex wouldn't load if there wasn't also at least one HTTP ruleset defined.
  • Fixed an issue where an AT61 regex wouldn't properly process IPv6 payloads.
  • Fixed an issue where the database's password file could be loaded twice.
  • Updated the manufacturing load to point to our current NTP servers.
  • Fixed an issue where certain interface information specific to RX10 and RS30 devices was no longer being included in the support upload. In addition to fixing this, more status information is now included.
  • Fixed an issue where speed and duplex information was being incorrectly reported for RX10 and RS30 devices.

RIOS 8.2.0​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.1 or higher)

New Features

Bug Fixes

  • Fixed case where a UDP flood attack sending identical packets could be undetected.
  • Fixed conditions that could cause AT19, AT20, and AT21 attack traffic to be filtered but not correctly report the victim.
  • Fixed several percentage based checks that were not being calculated correctly.
  • Fixed cases where victim counters were not reset properly, causing new victims using that memory to over report the amount of the attack traffic they actually saw.
  • Fixed case where zone attack traffic counts could be wrong if all attack types were set to monitor mode.
  • Fixed case where certain victims could have inflated packet counts due to matching multiple algorithms while in filter mode.
  • Fixed case where AT1 Force-on victims would not send sample packets.
  • Fixed a filter list check for when multiple attack types are listed and the primary listing may no longer be valid.

RIOS 8.1.1​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.1 or higher)

Enhancements

  • Enhanced tracking of miscellaneous victims.
  • Implemented hardware checksums (IPv4, TCP, and UDP headers) across more platforms (RS40, RE10, RE100).

Bug Fixes

  • There are conditions where LLCF will not work correctly on the RS40/RE10 (caused by external physical failures, such as a bad SFP). When this condition is detected it will now generate an alarm. Currently this alarm has a unique description for this behavior that won't be displayed in rWeb 8.1.0, but this will be added in a future release.
  • Fixed several handling processes related to incomplete packets. In most cases these would be dropped on the live Internet (as routers will drop an IPv6 packet without a complete address, for example) but we needed to make sure they were handled consistently.
  • Fixed reporting of ICMPv6 traffic. Previously it was being categorized as 'Other' rather than 'ICMP' when looking at Traffic Summary protocol charts.
  • Fixed case where a kernel panic or other reboot condition could fail to properly engage the built in bypass if "hardware bypass on power loss" was enabled (affecting RE2K, RE4K, RE10, RS40).

RIOS 8.1.0​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.1 or higher)

New Features

  • Device support for the new RE100 device.
  • Support for new HTTP Rule parsing under AT61.

Enhancements

  • Updated interface drivers*.*

Bug Fixes

  • Fixed a bug where the regex manager (AT61) could use an incorrect configuration, including failing to add more than one ruleset to a zone.
  • Fixed filter list entries that were not being handled correctly when the zone was in monitor mode.
  • Reduced rate of packet capture manager log entries on the RG. Previously it was excessive making it hard to see logs from other subsystems.
  • DPDK devices now handle non-contiguous lcore and socket ids.
  • Fix to ensure rFlow samples always have a correct attack type and subtype.
  • Fixed an initialization error that could cause a segfault in a subsystem, resulting in a longer boot process.
  • Fixed an error in new data reporting that could be caused by table lock conflicts.
  • Fix for internal logging about sent packet samples.
  • Fix for traffic sampling to be back at 1 in 10k (previously was 1.0679 in 10k).
  • Fix for RG where it could be internally set to use smaller limits than are actually allowed.
  • Fix for samples that could be sent with incorrect VLAN ID in sample header (this was always recalculated on reception by rWeb and reported correctly, but since it could be sent wrong this should be fixed as a matter of principle).
  • Fix for potential segfault based on receiving a packet truncated in the layer 3 header. An additional fix was made to address a potential segfault that could occur when doing a packet capture while a truncated packet was received.
  • Fix for potential segfault caused by network driver reception of IPv6 packets.
  • Changed AT6 to perform its checks after IP header validation in AT62.
  • Various rFlow fixes and enhancements, mostly edge cases, some performance gains, and increased space to ensure more samples are sent at an appropriate pace (previously could be bursty, causing problems when testing multiple loaded RE100s).
  • Fix for case where DPDK could use flags not supported by virtio drivers.
  • Increased amount of memory used for session tracking statistics.
  • Devices manufactured in this version will no longer point to our deprecated syslog or time servers by default.
  • Fix for unnecessary quoting being added to some SNMP output.

RIOS 8.0.6​

RE2000, RE4000, RE10, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.0 or higher)

info

This release primarily affects the VM10 only. If you are not running a VM10, you can safely ignore this release. If you are running a VM10, you should check that VM10 meets the new required memory minimums prior to upgrading.

Enhancements

  • The zone, prefix, and whitelist/blacklist capacity for a VM10 are being increased to match those of other equivalent 10G devices. As a result, we have also increased the required memory minimums for various interface configurations of the VM as shown on the requirements table here.

RIOS 8.0.5​

RE2000, RE4000, RE10, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.0 or higher)

Bug Fixes

  • Fix for AT3 where duplicate ACK packets were not being counted correctly within a selective ACK (SACK) session.

RIOS 8.0.4​

RE2000, RE4000, RE10, RX10, RS10, RS30, RS40, RG, VM10 (Requires rWeb 8.0 or higher)

New Features

  • Checksum validation will now be performed on the IPv4 header, TCP header, and UDP header (if present). This control is on by default and can be turned off through the following advanced controls (use a value of 'false'): at_62_check_ipv4_hdr_checksum, at_62_check_tcp_pkt_checksum, at_62_check_udp_pkt_checksum

Bug Fixes

  • Fix for where UDP, ICMP, and AT9 detector sensitivity reduces drastically after 198 days of uptime so most attacks were not picked up as expected.
  • Fix for where AT1 and AT2 filter sensitivity reduces after 198 days so that some attack traffic leaks.

RIOS 8.0.3​

RE2000, RE4000, RE10, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.0 or higher)

Bug Fixes

  • Re-calibrated ICMP filtering that was not working correctly at certain traffic rates.
  • Additional temperature control measures for DPDK devices.

RIOS 8.0.1​

RE2000, RE4000, RE10, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.0 or higher)

Bug Fixes

  • Fix for excessive heat caused by CPU not idling on ports without traffic on DPDK (RE10, RS40, VM) platforms.
  • Fix for a kernel bug that was causing the database to be restarted even when it was already operational. This bug could impact other services but most often affected the database.
  • Fix for LLDP to properly get the system hostname.

RIOS 8.0.0​

RE2000, RE4000, RE10, RX10, RS30, RS40, RG, VM10 (Requires rWeb 8.0 or higher)

New Features

Enhancements

  • Updated DPDK drivers.
  • Enhanced inter-blade communications on the RG.

Bug Fixes

  • Added additional logging for packet samples that are dropped due to no room in their buffer.
  • Fix for incorrect subtype labeling of AT62 sample packets.
  • Fix for some FIN packets incorrectly being counted as RST packets under some conditions.
  • Fix for IPv6 packets with IPv4 compatible addresses, embedded addresses, or loopback addresses that could be forwarded depending on AT62 settings when they should be tested further.
  • Added additional debug logging for RX and TX offload capabilities.
  • Fix for potential segfault that could occur when the victim list is full and an attempt to add an AT61 victim is made.
  • Fix for potential segfault in license handling code.
  • Fix for minor database initialization bug.