Project

General

Profile

Actions
Copy link

Bug #2495

closed

Stream depth and filestore interaction

Added by Eric Leblond over 6 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
4.0.4, 4.1beta1
Effort:
Difficulty:
Label:

Description

In the case where stream reassembly depth is set 0 and where file store stream-depth is non null, Suricata is stopping the streaming as soon as filestore is triggered resulting in truncated capture and fileinfo.

Related issues 3 (0 open — 3 closed)

Related to Suricata - Bug #2264: file-store.stream-depth not working as expected when configured to a specfic valueClosedGiuseppe LongoActions
Related to Suricata - Bug #2506: filestore v1: with stream-depth not null, files are never truncated ClosedJeff LucovskyActions
Related to Suricata - Support #2369: option force-filestore generate truncated fileClosedActions
Actions
Copy link
 #2

Updated by Victor Julien over 6 years ago

  • Target version changed from 4.1rc1 to TBD
Actions
Copy link
 #3

Updated by Victor Julien almost 6 years ago

  • Status changed from New to Assigned

I see the PR was merged. Should this be closed?

Actions
Copy link
 #4

Updated by Andreas Herz over 5 years ago

  • Status changed from Assigned to Closed
Actions
Copy link
 #5

Updated by Andreas Herz over 5 years ago

  • Status changed from Closed to Assigned

waiting for an additional PR

Actions
Copy link
 #6

Updated by Andreas Herz over 5 years ago

  • Target version changed from TBD to 70
Actions
Copy link
 #7

Updated by Andreas Herz over 5 years ago

maybe related to #2264 and #2506 which have it other way round with the settings?

Actions
Copy link
 #8

Updated by Victor Julien over 5 years ago

  • Related to Bug #2264: file-store.stream-depth not working as expected when configured to a specfic value added
Actions
Copy link
 #9

Updated by Victor Julien over 5 years ago

  • Related to Bug #2506: filestore v1: with stream-depth not null, files are never truncated added
Actions
Copy link
 #10

Updated by Victor Julien over 5 years ago

  • Related to Support #2369: option force-filestore generate truncated file added
Actions
Copy link
 #11

Updated by Victor Julien almost 5 years ago

  • Assignee changed from Eric Leblond to OISF Dev
Actions
Copy link
 #12

Updated by Victor Julien over 4 years ago

It is unclear why the ticket can't be closed. We need an explanation of this and preferably a test case. I'll close the ticket soon if there will be no further updates.

Actions
Copy link
 #13

Updated by Victor Julien over 4 years ago

  • Status changed from Assigned to Closed
  • Assignee deleted (OISF Dev)
  • Target version deleted (70)
Actions
Copy link

Also available in: Atom PDF