Bug #2495
closed
Stream depth and filestore interaction
Added by Eric Leblond about 6 years ago.
Updated over 3 years ago.
Description
In the case where stream reassembly depth is set 0 and where file store stream-depth is non null, Suricata is stopping the streaming as soon as filestore is triggered resulting in truncated capture and fileinfo.
- Target version changed from 4.1rc1 to TBD
- Status changed from New to Assigned
I see the PR was merged. Should this be closed?
- Status changed from Assigned to Closed
- Status changed from Closed to Assigned
waiting for an additional PR
- Target version changed from TBD to 70
maybe related to #2264 and #2506 which have it other way round with the settings?
- Related to Bug #2264: file-store.stream-depth not working as expected when configured to a specfic value added
- Related to Bug #2506: filestore v1: with stream-depth not null, files are never truncated added
- Related to Support #2369: option force-filestore generate truncated file added
- Assignee changed from Eric Leblond to OISF Dev
It is unclear why the ticket can't be closed. We need an explanation of this and preferably a test case. I'll close the ticket soon if there will be no further updates.
- Status changed from Assigned to Closed
- Assignee deleted (
OISF Dev)
- Target version deleted (
70)
Also available in: Atom
PDF