Tracking ticket: which parts of the engine should be dynamic
Updated by Lars Sætaberget almost 3 years ago
When suggesting this I was mostly thinking of things relevant to performance tuning. Such as interface parameters like bpf-filters, ring-size, buffer-size etc. or stream parameters like reassembly depth, bypass yes/no, memcaps and so on.
It would also be nice to have a "live config reload" feature in suricatasc for example, much like live rule reload, when we have "enough" dynamic parameters.