Actions
Support #1400
closedReordering packet in Suricata
Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:
Description
When extracting file from HTTP (upload or download file) and SMTP (attachment in mail), i find many files have been truncated.
After testing clearly, I know this issue due to the packets were out of order.
Once Suricata has packet out of order (or have GAP), it not supports and stop dumping file anyway.
So, extract file processing not done!
If we reorder whole packets in network, it costs expensively.
Should we reorder packets only in extracting file case?
Actions