Skip to main content

RIOS Release Notes

RIOS release notes are consolidated here, starting with RIOS 8.8.0. Releases prior to this version are posted in the archives.

General guidelines on upgrading RIOS can be found here.

RIOS 9.0.0​

RE2000, RE4000, RE10, RE100, RE110, RX10, RS30, RS40, RVM (Requires rWeb 9.6 or higher)

This release provides support for the new RE110 device, multiple filter improvements, and various bug fixes.

info

While the RE110 can be run on rWeb versions starting from rWeb 9.6, fully correct device status requires rWeb 10.1 or later.

New Features

  • Device support for the new RE110 device, a 100G system with higher performance than the RE100.

Enhancements

  • A single filter list is now shared between all filter threads. RIOS.8.8.0 introduced sharing a single configuration between all filter threads. RIOS.9.0.0 extends that to filter list entries. The new sharing model offers the following advantages:
    • Faster response to changes.
    • Higher performance.
    • Scalability to 200G and 400G systems.
  • Improved performance of AT1, AT2, and AT3 algorithms when whole subnets are being attacked rather than individual addresses (aka "carpet bombing"). This is achieved by:
    • Victims observed by different filter threads are combined into one cohesive list.
    • Thresholds to identify attacks will dynamically adjust to traffic conditions, such as number of destinations, packet rate, and packet responsiveness. This improves filtering across all platforms at lower attack rates.
  • Improved performance of UDP and ICMP filtering, both for individual victims and whole subnets ("carpent bombing"). This primarily improves the filtering ability of AT17, AT22, and AT23 in the following ways:
    • Internal weights are now dynamically calculated based on packet rates and distribution.
    • Additional control to distinguish spoofed and non-spoofed mitigation.
    • Non-spoofed mitigation uses analysis of recent historical packets to improve mitigation.
  • Improved DNS validation under AT19:
    • Excessive any-query requests are counted and filtered.
    • Excessive recursion desired requests and responses are counted and filtered.
  • RIOS VMs installed starting from 9.0 will now generate an automatic 100G trial license, valid for 1 week. This will allow users to set up a test deployment faster.

Bug Fixes

  • Fixed a bug where choosing to drop a protocol under AT62 protocol controls would still get dropped even if that protocol was also added to the "IP protocol numbers to exclude from drop rules".
  • Restructured some logging, mainly by dropping log levels of various repetitive events that did not need to be present at the INFO level.
  • Base OS updates for security patches and new physical & virtual hardware support. One signifcant update is that our management interface firewall changed from iptables to nftables.
  • Fixed a case where filter list entries could continuously have their block times extended while in Monitor mode. Entries will now expire and be re-added if they are relevant so that they don't exceed their configured block time.
  • Fixed an issue where some filter list entry update messages were not properly being sent to rWeb.

RIOS 8.8.2​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 9.6 or higher)

This release has a few fixes for filtering behavior and some platform fixes.

Bug Fixes

  • Fixed a case where Force-On mode for AT1, AT2, and AT3 could create duplicate victims.
  • Fixed an edge case where suspected AT1, AT2, and AT3 victims are not sampled properly, potentially resulting in under filtering of attacks.
  • Fixed a structural bug for session tracking used in AT8 that could prevent some subtypes of attack from being detected properly.
  • Tightened TCP timeouts used by the database connection between rWeb and RIOS for better stability during management plane disruptions.
  • Fixed a problem in platform code that would erroneously decide certain hardware revision devices could not be upgraded past RIOS 8.4.7. If you've already upgraded past this version your device is not susceptible.

RIOS 8.8.1​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 9.6 or higher)

This release addresses a few platform stability issues.

Bug Fixes

  • Fixed a race condition in AT61 regex handling that could cause a segfault of the agent applying regexes. This fix both prevents the race condition and allows new regex entries to start being tested faster (a few seconds compared to a half minute or longer).
  • Fixed an issue where the agent portion of the platform would not be restarted properly after a segfault (e.g. the previous bug). The segfault would not bring down traffic, but would prevent reporting and session oriented mitigations from working properly.
  • Fixed an issue that could prevent AT61 Rule Builder rules from properly running on each port in a multi-port system (RS30, RS40).
  • Fixed an overflow error that could be observed when calculating RX/TX errors for device interface statistics. This would prevent device statistics from being recorded for the cycle where the overflow occurred.

RIOS 8.8.0​

RE2000, RE4000, RE10, RE100, RX10, RS30, RS40, RVM (Requires rWeb 9.6 or higher)

This release adds support for a much larger number of AT1/AT2/AT3 Force On mode prefixes, and some performance enhancements for both idle and active devices.

Enhancements

  • RIOS devices now support much larger AT1/AT2/AT3 Force On mode prefix limits (4096 for each attack type, up from 64). Devices will now report their supported limits, which are read correctly by rWebs running 9.6 or later (otherwise the previous value of 64 prefixes is assumed).
  • Updated DPDK drivers.

Bug Fixes

  • Fixed an issue where a filter list message could be sent with a 0 timestamp, causing incorrect start and stop timestamp calculations.
  • Changed power managment for DPDK systems to reduce power consumption and temperature when traffic is idle. This is most noticeable on RS40 devices with unused port pairs.
  • Discourage using core 0 as a data core for RVMs during setup. This core tends to be used by the OS for scheduling a lot of tasks, so it's better for data intensive workloads to be handled elsewhere.