Fixed potential bugs in the JSON output when the "sslCertificate" element was present in the incoming IFPIX. The bugs manifested as two "sslCertList" keys paired with differing values (objects) or an "sslCertList" key paired with no value.

super_mediator Release 1.14.0, 2026-Aug-6

Downloads

super_mediator-1.14.0.tar.gz (988KiB)

(SHA256=9975e8e656f07c47bdc38765cf0aa05d9e933ef897032b797987f293070c3cc2)

Changelog

When present in the incoming IPFIX (YAF 2.20), include the ja4 element in TLS records.
Changed ICMPv6 TEXT and JSON export to match ICMPv4 by putting icmpTypeIPv6 and icmpCodeIPv6 info the sourceTransportPort and destinationTransportPort fields, respectively.
Added the dnsQueryResponse element to the JSON output for DNS records.
Added the reverseVlanId element as an optional output field (RVLAN and RVLANINT).
Added the ability to filter on the reverseVlanId.
Added the yafLayer2SegmentId element as an optional output field (L2SEGMENT).
Fixed an issue in the JSON output of MySQL DPI: The mysqlCommandText fields are now exported as an array instead of as multiple objects with the same key.
Improved the parsing of TLS certificates to accept more certificates, to verify data, and to report problems.
Changed "make install" to write reference copies of the sample super_mediator.conf file and start-up files (for systemd and SysV init.d) under $prefix/share/super_mediator.
Changed "make install" so the sample super_mediator.conf file is no longer installed in /etc or $prefix/etc.
Updated super_mediator.spec to reflect the changes to "make install".

super_mediator Release 1.13.4, 2026-Aug-5

Downloads

super_mediator-1.13.4.tar.gz (969.3KiB)

(SHA256=b242d09673a468baabc28acbd92f2b60ecf50e29e6e26191a1dc1baad6ca3f41)

Changelog

Improved the parsing of TLS certificates to accept more certificates.

super_mediator Release 1.13.3, 2026-Jul-21

Downloads

super_mediator-1.13.3.tar.gz (969.2KiB)

(SHA256=534c8ec8292a4ec08192616c87b415a3987546b0c700390755ea685102fcd3d5)

Changelog

Fixed bugs (extraneous octets) in the calculation of the MD5 and SHA1 hashes of complete TLS certificates.

super_mediator Release 1.13.2, 2026-May-14

Downloads

super_mediator-1.13.2.tar.gz (969.2KiB)

(SHA256=571cf92be79990a4200d4c7e4403de72ee250f103787289d74f18bd9fd5f5966)

Changelog

Fixed bugs where multiple threads could modify the same state and result in a lock-up or a crash.

super_mediator Release 1.13.1, 2026-Apr-24

Downloads

super_mediator-1.13.1.tar.gz (968.6KiB)

(SHA256=03e41f74d71294059a1ac77ea514b615a405d8d4d34c4550ca93ccccbc3101ae)

Changelog

Changed the maximum values for ROTATE_MIN_SIZE and ROTATE_MAX_SIZE to support files larger than 2GB.

super_mediator Release 1.13.0, 2025-Nov-20

Downloads

super_mediator-1.13.0.tar.gz (966.1KiB)

(SHA256=88a7e4fd1b078ef977fb0c8e42e7c5f74a0bd8b6308c27ef4971b0f3ed1b2be4)

Changelog

NOTE: The names of JSON and TEXT output files have changed when ROTATE is used.
Added support for filtering a record based on its forward or reverse TCP flag fields, packet count fields, and byte count fields.
Added the ability for an Exporter to delay output-file rotation if the file's size is below a threshold and to advance rotation if the size exceeds a threshold.
Modified collectors that poll for files to process the files by modification time instead of by name, handling the oldest modification time first.
Changed the names of JSON and TEXT files to include a five decimal digit serial number when file rotation is active, e.g., "prefix.20251030112233-01234.json".
Updated systemd unit files to use more proper startup and shutdown methods.
Removed unnecessary spaces from JSON output.
Modified the configuration file parser to support hexadecimal numbers.
Fixed bugs where the comparison operator was ignored for filters using IPv6 addresses or the IP version.
Fixed bugs when filter statements appeared in both COLLECTOR blocks and a FILTER block.
Fixed a bug where the FILTER block ignored the AND_FILTER statement.
Changed the FILTER block to ignore filters using the COLLECTOR field as described in the documentation.
Improved the validation of the configuration file; the new super_mediator may error for configuration files that older versions accepted.
Changed the release number in the super_mediator.spec file to 1.
Deprecated the STATS token. Use STATS_ONLY instead.

super_mediator Release 1.12.0, 2025-Jul-24

Downloads

super_mediator-1.12.0.tar.gz (945.3KiB)

(SHA256=a86b9d6be912d57a02f391b678674b21fae3ad34e5c1df772d072eddffb6df0d)

Changelog

Added support for reading the mid-encryption records produced by YAF 2.17.
Changed how the --fields and --groups options are handled when the option is repeated. The new behavior uses the final occurrence of the option instead of the first.
Changed the --watch option to require either --move or the newly added --delete option.
Added a --test-config option that causes super_mediator to exit after parsing the configuration file.
Added support for "EXPORTER JSON" in the configuration file.
Changed --output-mode to accept FILE and FILEHANDLER for writing IPFIX files.
Improved the option handling to make it more strict and to catch issues earlier.
Added a "make check" target.
Fixed bugs in the JSON output of summarization (SSL_DEDUP, DEDUP) records.

super_mediator Release 1.10.3, 2025-Jul-24

Downloads

super_mediator-1.10.3.tar.gz (901.9KiB)

(SHA256=0e0732619caadcee9237ae36b8998625cbd49f6d9ed3b473fa5850c63fefaf1b)

Changelog

Fixed a bug where certain TLS DPI content was exported as invalid JSON.

super_mediator Release 1.11.2, 2025-Apr-17

Downloads

super_mediator-1.11.2.tar.gz (914.1KiB)

(SHA256=9c901504f7c0fcba2749c38a45907db495afdd72077b67e4bd58e0b12880dc1e)

Changelog

Fixed a bug that could cause invalid JSON output of TLS sub-records.
Fixed issues when building an RPM on RHEL8.

super_mediator Release 1.10.2, 2025-Jan-30

Downloads

super_mediator-1.10.2.tar.gz (895.3KiB)

(SHA256=96b307b2dc668e1a616dd39fdb40a655e22d00b2ea88c1d9ef3c456e00033a74)

Changelog

Fixed memory leaks in the directory poller.

super_mediator Release 1.11.1, 2025-Jan-23

Downloads

super_mediator-1.11.1.tar.gz (908.6KiB)

(SHA256=35000387ab221e0ef15ddde37675cfeae7adf4e3dfb871f5532fddf89f447e42)

Changelog

Fixed memory leaks in the periodic file-globbing (directory polling) code.
Added a log message giving the signal that caused super_mediator to exit.

super_mediator Release 1.11.0, 2024-Aug-29

Downloads

super_mediator-1.11.0.tar.gz (902.9KiB)

(SHA256=bc52ad4a4b8ed3909cdbaace24900d8f3aefc14a9addec816164ce95eb2f577d)

Changelog

Added support for reading and writing the micro- and nanosecond time fields produced by YAF-2.16.
Introduced a TIME_UNITS command in the configuration file and a --time-units command-line option to control what time unit(s) are used in TEXT and JSON Exporters.
Modified JSON output of IPv6 records to include source- and destinationIPv6Address keys in addition to source- and destinationIPv4Address keys. Previously only the IPv4Address keys were used.
Fixed a bug in JSON output of TLS records (introduced in v1.8.0) where sslCertVersion was not printed when its value was 0.
Added support for running super_mediator as a systemd service.
Updated the RPM spec file: enhanced RHEL9 compatibility, made openssl a requirement, and enabled type-export.
Modified configure to use pkg-config when searching for OpenSSL.
Fixed a compilation error when building with Spread Toolkit support.

super_mediator Release 1.10.1, 2024-Mar-28

Downloads

super_mediator-1.10.1.tar.gz (891.4KiB)

(SHA256=50d34a78b21fe9e49332c0b3592e930699e69c96756671fac60e82308bb9d4bc)

Changelog

Fixed a crash when exporting TEXT or JSON forms of de-duplicated DNS AAAA records.
Ensured incoming de-duplicated DNS AAAA records are exported in the 1.10.0 layout.
Fixed a bug where the DNS_RR FULL setting produced shorted DNS_RR records.
Fixed a minor bug in the payload hexdump output written by TEXT exporters.

super_mediator Release 1.10.0, 2023-Dec-21

Downloads

super_mediator-1.10.0.tar.gz (888.9KiB)

(SHA256=a169166b22319ea054751a352828c818b68f7a7b77a2f0f1005e95ca326cadc4)

Changelog

Added support for updated TLS and SSH templates generated by YAF 2.15 containing the JA3- and HASSH-related elements.
Added a new template for export of de-duplicated DNS AAAA records to resolve an issue where a binary IPv6 address was being stored in an IPFIX string.
In the JSON output of TLS certificates, replaced some sslObjectIdXX labels with meaningful names.
Fixed a bug where an incoming IPv4 record having a sourceIPv4Address of 0.0.0.0 was exported as an IPv6 IPFIX record with the source and destination addresses set to ::.
Fixed a bug where an IPv4 address of 0.0.0.0 was printed as the IPv6 address ::.
Fixed a bug in the JSON output of an SMTP subrecord when it was followed by an additional subrecord.
Fixed a compilation error when including SiLK support and SiLK was built without IPv6 support.

super_mediator Release 1.9.1, 2023-Feb-9

Downloads

super_mediator-1.9.1.tar.gz (872KiB)

(SHA256=eefd4535b1d98444e92f5465362bc28d72e8335b46ddbfb4a1ad176f6bcfc13c)

Changelog

Made the configure test for OpenSSL more robust to support newer releases.
Fixed a compilation error on some systems due to a misplaced #include.

super_mediator Release 1.9.0, 2022-Jun-8

Downloads

super_mediator-1.9.0.tar.gz (870.5KiB)

(SHA256=a5547967eaa87afabdd0f2419f6149ea248ac26c85d44ce2369785a8ae42e685)

Changelog

Added support for labeling records based on data from a SiLK IPSet or a SiLK Prefix Map.
Added support for labeling records with a sensor and flowtype similar to SiLK's rwflowpack tool.
Added support for OpenSSL 3.0.1.
Changed JSON output of SSL records for unknown sslObjectType values: For unknown value X, key sslCertObjectIDX is replaced by sslCertIssuerObjectIdX or sslCertSubObjectIdX. When X is 1, EmailAddress is used (e.g., sslCertIssuerEmailAddress) and when X is 25 DomainComponent is used.
Changed the super_mediator.spec file to configure the build using --with FEATURE options to rpmbuild.
Fixed a small bug in JSON output of rewritten SSL certificates.
Fixed bugs in TEXT export of very old YAF SSL data.
Changed the template scopes for the YAF stats template and Tombstone template to match those used by YAF.
Fixed a bug in MAC address printing where a trailing ":" appeared.

super_mediator Release 1.8.0, 2020-Dec-22

Downloads

super_mediator-1.8.0.tar.gz (743.1KiB)

(SHA256=d42ce8b1b0f830b384b031cc29d3dd08fff61adf408a76fb5b5088e63b10a688)

Changelog

Added a new switch, --rewrite-ssl-certs, which restructures the template used for TLS/SSL certificates for IPFIX exporters. The template uses specific IEs for some fields in an SSL certificate. The --rewrite-ssl-certs switch also allows a super_mediator to read the new SSL template from an upstream super_mediator. Deduplication of the rewritten certificates is not supported.
Added the ability to read the new SMTP DPI records exported by YAF 2.12.0.
Added the observation domain ID to JSON output.

super_mediator Release 1.7.1, 2019-Oct-24

Downloads

super_mediator-1.7.1.tar.gz (728.8KiB)

(SHA256=42f95148bc0301555ba0b3f4ff46246e12904e7d5f9d7851ed04b847a9df6473)

Changelog

Added ability to preserve observation domain of incoming records.
Changed scope of Tombstone records to 3 for consistency with YAF.
Fixed a crash when TCP collector and CLI --input are used concurrently.

super_mediator Release 1.7.0, 2019-Mar-18

Downloads

super_mediator-1.7.0.tar.gz (729.2KiB)

(SHA256=b4c8949df6791f34b614b5bd2bbf1631ca5c2510d14e551b12c859f9943341fb)

Changelog

Support for FixBuf 2.3.0 added, and is now required.
New YAF stats messages supported.
New Tombstone format supported.
Race condition addressed when exporter configured to GZIP and MOVE files.
Dynamically generated dedup template names added.
Option record bug fixes.

super_mediator Release 1.5.3.1, 2018-Oct-29

Downloads

super_mediator-1.5.3.1.tar.gz (700.7KiB)

(SHA256=ee04201170017f5123fa7ffc30972ad080b633a1c25edc070f1a0848b46ef2cc)

Changelog

Maintenance release for 1.5.3
Fix race condition resulting from using GZIP_FILES and MOVE

super_mediator Release 1.6.0, 2018-Apr-30

Downloads

super_mediator-1.6.0.tar.gz (724.1KiB)

(SHA256=eec12b7cab5164cb7e110c24931989e645c7ef59691d2b6937f4cc26c3ae508d)

Changelog

Support for FixBuf 2.0.0 added, and is now required.
Derive information elements from included XML files.
Support for tombstone records added.
Fixed flow output bugs where information elements were transposed.
Support for cmake build removed.

super_mediator Release 1.5.3, 2017-Oct-19

Downloads

super_mediator-1.5.3.tar.gz (699.7KiB)

(SHA256=4f46dcff1646cc211446477ee70794c15a0b01fe9d3907cad5462b45b36103c9)

Changelog

Added template metadata (name and description) record output (libfixbuf 1.8.0 or greater required).

super_mediator Release 1.5.2, 2017-Mar-8

Downloads

super_mediator-1.5.2.tar.gz (691.8KiB)

(SHA256=1a76a1e6a8a4e4fe4fd84f6110566b32ffcd8b987ea50d64d47190c1a31e3d26)

Changelog

Fix compile error introduced in version 1.5.1

super_mediator Release 1.5.1, 2017-Mar-6

Downloads

super_mediator-1.5.1.tar.gz (691.8KiB)

(SHA256=d17614b592734d1f60380315c073df769f60ae66f67acb7025d8afc7a560f0dd)

Changelog

Add --become-user and --become-group command line options
Bug Fix for compiling on Alpine Linux

super_mediator Release 1.5.0, 2017-Jan-5

Downloads

super_mediator-1.5.0.tar.gz (688.3KiB)

(SHA256=e07fd5545e41a935ff0a7df90a3e7a91ae869f3bd8f051b7d58816ad62c93da7)

Changelog

Add support for adding VLAN/Observation IDs to deduplication keys
Changed format of DEDUP Exporters (added flow start time associated with flow key hash)
Add ability to insert EXPORTER name in deduplication output records
Add ability to read gzip'd IPFIX files
Other Bug Fixes