Suricata

Seeing a lot of those after a while on my firewall box running nfq inline.

I'm requesting that we make segment pools a user configurable option. Perhaps we also need some payload sizes between 1448 and 65535. Might also be nice to just have an option to set a generic memcap for reassembly.

/* We define serveral pools with prealloced segments with fixed size * payloads. We do this to prevent having to do an malloc call for every * data segment we receive, which would be a large performance penalty. * The cost is in memory of course. */
#define segment_pool_num 8
static uint16_t segment_pool_pktsizes[segment_pool_num] = {4, 16, 112, 248, 512,
768, 1448, 0xffff};
static uint16_t segment_pool_poolsizes[segment_pool_num] = {2048, 3072, 3072,
3072, 3072, 8192,
8192, 512};