Suricata

Using 2.0dev (rev ab50387)

In my suricata.yaml I have:

  reassembly:
    memcap: 30gb

2 min after start tcp.reassembly_memuse shows that the whole amount (30GB) is used for every thread :

root@suricata:~# grep memuse /var/log/suricata/stats.log | tail -64
tcp.memuse                | AFPacketeth31             | 302434368
tcp.reassembly_memuse     | AFPacketeth31             | 32212254681
http.memuse               | AFPacketeth31             | 1385239
dns.memuse                | AFPacketeth32             | 14468098
tcp.memuse                | AFPacketeth32             | 302137200
tcp.reassembly_memuse     | AFPacketeth32             | 32212254681
http.memuse               | AFPacketeth32             | 1387903
dns.memuse                | AFPacketeth33             | 14017181
tcp.memuse                | AFPacketeth33             | 302169856
tcp.reassembly_memuse     | AFPacketeth33             | 32212254683
http.memuse               | AFPacketeth33             | 1385537
dns.memuse                | AFPacketeth34             | 14019163
tcp.memuse                | AFPacketeth34             | 302172560
tcp.reassembly_memuse     | AFPacketeth34             | 32212254683
http.memuse               | AFPacketeth34             | 1380014
....

tcp.memuse                | AFPacketeth316            | 302176576
tcp.reassembly_memuse     | AFPacketeth316            | 32212254683
http.memuse               | AFPacketeth316            | 1377703

However htop (attached) shows 12 GB mem usage in total,
but in stats.log - tcp.reassembly_memuse shows that 30GB are used right away for every thread, which is not true.