Project

General

Profile

Actions

Optimization #3538

closed

dns: use app-layer incomplete support

Added by Victor Julien over 4 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Low
Assignee:
Target version:
Effort:
Difficulty:
Label:
Protocol

Description

Remove TCP buffering. The header of each record has a length field, so we can read that and tell the stream engine how much data we expect before getting called again. This length field itself can be fragmented too, so we probably need to request a minimum size in that case.


Related issues 2 (0 open2 closed)

Related to Suricata - Feature #3444: app-layer: signal stream engine about expected data sizeClosedVictor JulienActions
Copied to Suricata - Optimization #3539: rdp: use app-layer incomplete supportClosedZach KellyActions
Actions

Also available in: Atom PDF