=======
Changes in 1.4.1

+ added -Z option to servsock  to change the timezone to the local 
  one (-Z 0) instead of UTC. This is now default. The equivalent
  configuration file option is "TimeZone".

+ corrected bug if transcation was disabled (reported by Dominik)

+ added offset to event_reference to get unique values even after
  a restart of snort. (last_cid+1 is used for this feature.)
  -> Requires a Reference = 2 value in servsock.conf

+ corrected bug if last_cid has to be adjusted on restart

+ added -I flag to program getpacket to print some informations 
  of the packet like MAC addresses. 

+ added -V flag to print vendor informations based on the mac
  addresses (the list of mac addresses is taken from ettercap.)

+ configure checks now if the snort sources are patched

=======
Changes in 1.4.0

+ added checks to configure for the use of absolute path

+ increased some buffer in socket_database for large payloads

+ the payload is now the last value in the insert string -> if it
  exceeds the buffer size it is simply truncated

+ changed default directrory for config files to ${prefix}/etc/flop
  and not using --sysconfdir (does not work with C header files).

+ added default priority of 2 in rules.pl for rules whithout priority
  or classification -> Bleeding snort rules <Alex.Butcher@bristol.ac.uk>

+ corrected bug in rules.pl according class_id, this should start
  wiht 1, not with 0.

+ replaced strtol by strtoul in getpacket.c, there could be a
  a misinterpreation due to signed long -> resulted in negative
  payload length. 

+ added init scripts from Alex Butcher in contrib directory

+ mysql query results in getpacket.c where destroyed before they
  were used. 

+ removed possible NULL values in signature table <Alex.Butcher@bristol.ac.uk>

+ some pre-initialization of variables

+ check for old value of SO_RCVBUF of the unix domain socket in 
  sockserv.c and change it only if the desired value is greater

+ check that the receive buffer is used less or equal to size of 
  used variable buffer size

+ added check for size of pcap packet in sockserv.c and ignore it 
  if it is greater than the receive buffer of the unix domain 
  socket for atomar operations

+ more verbose error message in DGrecv()

+ increase of SO_SNDBUF for the socket to be able to fetch at least a
  64k pcap packet in spo_alert_unixsock_db.c

+ truncate packet if larger than SO_SNDBUF in spo_alert_unixsock_db.c

+ better log/error messages in spo_alert_unixsock_db.c

  => all part of patches for snort-2.1.3 and newer
=======
Changes in 1.3.0:

+ added log facility to snort/FLoP

+ added -Q option for quiet: don't write alerts to /var/log/snort

+ removed double alerts if log feature is enabled, we now check
  if the log packet is the same as the previous alert packet.

+ corrected bug in fpg.c resulting in SIGSEGV.

+ sockserv/servsock now verify the result of (m|c)alloc and invoke
  drop to free some memory if it fails.

+ corrected a mistake in the signal handler on linux
========
Changes since 1.0 up to 1.2.3:

+ a handshake is implemented between sockserv and servsock. This is used
  to inform sockserv if there are problems like a missing database.
 
+ swap file feature with servsock: If there is a problem with the database
  the buffered alert are stored in a swap file and the connection to the
  remote sensor is closed. If a reconnect happens and the database is back
  then first the swap file is read in.

+ FLoP runs at least on Linux, Solarix, OpenBSD and FreeBSD. 

+ the use of libbind is now optional

+ with a slight extension of the database the full payload can be stored
  in the database and a pcap file can be rebuild with the program getpacket

+ Debug code is compiled in by default and can be activated via command
  line or the configuration file

+ a perl script (contrib/rules.pl) is able to insert the signatures and
  references based on the rule files into the database

+ on servsock the sensor name is printed during output of statistics in
  addtion to the PID

+ on servsock a negative unixsocketpriority reverts the scheme, a value
  of -2 only alerts on files with priority 1 or 2.

