Added by Andreas Herz about 6 years ago. Updated almost 4 years ago.
Description
It might be helpful to introduce a stream depth event rule to validate if it's working as expected and to get an overview of possible elephant flows
This sounds like it could be interesting but I'd need some more information.
Are you asking for an event to be triggered is the stream.depth would be exceeded?
Exactly, so this could help to detect elephant flows or helps in testing if this feature works properly if you have a flow that should trigger it but doesn't.
I would compare it as another helper like we already have with packets on wrong threads etc.
Suricata: https://github.com/OISF/suricata/pull/7623
Suricata-verify: https://github.com/OISF/suricata-verify/pull/879