Project

General

Profile

Actions

Bug #2662

closed

unix socket - memcap read/set showing unlimited where there are limited values configured by default

Added by Peter Manev about 6 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Using - This is Suricata version 4.1.0-dev (rev 033e7569)
via Unix socket - some memcaps have a default limit configured in yaml - like for example stream and stream.reassembly/flow. It seems the command via unix socket does not read those in correctly .

>>> memcap-list
Success:
[
    {
        "name": "stream",
        "value": "unlimited" 
    },
    {
        "name": "stream-reassembly",
        "value": "unlimited" 
    },
    {
        "name": "flow",
        "value": "unlimited" 
    },
    {
        "name": "applayer-proto-http",
        "value": "unlimited" 
    },
    {
        "name": "defrag",
        "value": "unlimited" 
    },
    {
        "name": "ippair",
        "value": "unlimited" 
    },
    {
        "name": "host",
        "value": "32mb" 
    }
]
>>> memcap-show stream
Success:
{
    "value": "unlimited" 
}

Actions

Also available in: Atom PDF