Project

General

Profile

Actions

Bug #2495

closed

Stream depth and filestore interaction

Added by Eric Leblond almost 6 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

In the case where stream reassembly depth is set 0 and where file store stream-depth is non null, Suricata is stopping the streaming as soon as filestore is triggered resulting in truncated capture and fileinfo.


Related issues 3 (0 open3 closed)

Related to Suricata - Bug #2264: file-store.stream-depth not working as expected when configured to a specfic valueClosedGiuseppe LongoActions
Related to Suricata - Bug #2506: filestore v1: with stream-depth not null, files are never truncated ClosedJeff LucovskyActions
Related to Suricata - Support #2369: option force-filestore generate truncated fileClosedActions
Actions #2

Updated by Victor Julien over 5 years ago

  • Target version changed from 4.1rc1 to TBD
Actions #3

Updated by Victor Julien about 5 years ago

  • Status changed from New to Assigned

I see the PR was merged. Should this be closed?

Actions #4

Updated by Andreas Herz almost 5 years ago

  • Status changed from Assigned to Closed
Actions #5

Updated by Andreas Herz almost 5 years ago

  • Status changed from Closed to Assigned

waiting for an additional PR

Actions #6

Updated by Andreas Herz almost 5 years ago

  • Target version changed from TBD to 70
Actions #7

Updated by Andreas Herz almost 5 years ago

maybe related to #2264 and #2506 which have it other way round with the settings?

Actions #8

Updated by Victor Julien over 4 years ago

  • Related to Bug #2264: file-store.stream-depth not working as expected when configured to a specfic value added
Actions #9

Updated by Victor Julien over 4 years ago

  • Related to Bug #2506: filestore v1: with stream-depth not null, files are never truncated added
Actions #10

Updated by Victor Julien over 4 years ago

  • Related to Support #2369: option force-filestore generate truncated file added
Actions #11

Updated by Victor Julien about 4 years ago

  • Assignee changed from Eric Leblond to OISF Dev
Actions #12

Updated by Victor Julien about 4 years ago

It is unclear why the ticket can't be closed. We need an explanation of this and preferably a test case. I'll close the ticket soon if there will be no further updates.

Actions #13

Updated by Victor Julien over 3 years ago

  • Status changed from Assigned to Closed
  • Assignee deleted (OISF Dev)
  • Target version deleted (70)
Actions

Also available in: Atom PDF