Project

General

Profile

Actions
Copy link

Bug #3633

closed

file-store.stream-depth not working as expected when configured to a specfic value (4.1.x)

Added by Victor Julien about 4 years ago. Updated about 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
4.1.8
Affected Versions:
4.1.5, 4.1.6, 4.1.7
Effort:
Difficulty:
Label:

Description

Given the following config below - 

outputs.14.file-store.stream-depth = 0
stream.reassembly.depth = 2mb

Suricata will file extract any file any size

Given this other config below - 

outputs.14.file-store.stream-depth = 5mb
stream.reassembly.depth = 2mb

Suricata will only extract files which are up to 2mb in size - aka the "stream.reassembly.depth" configured value. However the expected result is the files extracted to be up to 5Mb as configured by "outputs.14.file-store.stream-depth"

Observed on 4.0.1 and latest git master.

Related issues 1 (0 open — 1 closed)

Copied from Suricata - Bug #2264: file-store.stream-depth not working as expected when configured to a specfic valueClosedGiuseppe LongoActions
Actions
Copy link

Also available in: Atom PDF