Suricata

Overview
Activity
Roadmap
Issues
Wiki
Files

Custom queries

Good First Issues
OISF community

Actions

Copy link

Bug #3375

open

Tracking: file tracking/inspection performance issues

Added by Victor Julien over 4 years ago. Updated 9 months ago.

Status:

New

Priority:

Normal

Assignee:

Victor Julien

Target version:

8.0.0-beta1

Affected Versions:

4.1.5, 5.0.0

Effort:

Difficulty:

Label:

Description

In certain cases we can see the PrefilterTxFiledata at the top of perf measurements. This has uncovered various issues:

SMTP: tx id not set on files
SMTP: 'raw-message' as files support doesn't set files up properly
SMB: post-GAP we can have dangling txs that are neither updated nor closed

HTTP: pipelining requests can operate on wrong files (and set events in wrong tx)

Related issues 16 (1 open — 15 closed)

Related to Suricata - Bug #3376: http: pipelining tx id handling broken	Closed	Victor Julien	Actions
Related to Suricata - Bug #3397: smtp: file tracking issues when more than one attachment in a tx	Closed	Victor Julien	Actions
Related to Suricata - Bug #3398: smtp: 'raw-message' option file tracking issues with multi-tx	Closed	Victor Julien	Actions
Related to Suricata - Bug #3399: smb: post-GAP some transactions never close	Closed	Victor Julien	Actions
Related to Suricata - Bug #3400: smb: post-GAP file tx handling	Closed	Victor Julien	Actions
Related to Suricata - Bug #3401: smb1: 'event only' transactions for bad requests never close	Closed	Victor Julien	Actions
Related to Suricata - Bug #3393: http: pipelining tx id handling broken (4.1.x)	Closed	Victor Julien	Actions
Related to Suricata - Bug #3404: smtp: file tracking issues when more than one attachment in a tx (4.1.x)	Closed	Victor Julien	Actions
Related to Suricata - Bug #3403: smb1: 'event only' transactions for bad requests never close (4.1.x)	Closed	Victor Julien	Actions
Related to Suricata - Bug #3402: smb: post-GAP some transactions never close (4.1.x)	Closed	Victor Julien	Actions
Related to Suricata - Bug #3424: nfs: post-GAP some transactions never close	Closed	Victor Julien	Actions
Related to Suricata - Bug #3425: nfs: post-GAP file tx handling	Closed	Victor Julien	Actions
Related to Suricata - Bug #3699: smb: post-GAP file handling	Closed	Victor Julien	Actions
Related to Suricata - Bug #3700: nfs: post-GAP file handling	Closed	Victor Julien	Actions
Related to Suricata - Task #4444: files: store files in transactions instead of per flow state	Closed	Victor Julien	Actions
Related to Suricata - Task #6217: research: increased tcp.overlap after file data changes	New	Victor Julien	Actions