Project

General

Profile

Actions

Bug #4650

closed
PM VJ

Stream TCP raw reassembly is leaking

Bug #4650: Stream TCP raw reassembly is leaking

Added by Peter Manev over 4 years ago. Updated almost 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

(originally reported y Eric Leblond)

It seems we have a leak in memory when TCP raw reassembly is enabled. Raw reassembly memuse is always going up. When deactivating it, the leak is gone. The leak seems to affect the flow that get cleaned far slowly.
Application layer triggering raw reassembly on TX border is helping a lot to reduce memory usage.

Peter to create a reproducible setup with trex.


Related issues 7 (0 open7 closed)

Related to Suricata - Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stoppedClosedVictor JulienActions
Related to Suricata - Bug #4766: Flow leaked when flow->use_cnt access race happensClosedVictor JulienActions
Related to Suricata - Bug #4778: flow/bypass: app-layer/stream resources not freed when bypass activatedClosedVictor JulienActions
Related to Suricata - Bug #4808: flow: worker-evicted flows need to be processed quickerClosedVictor JulienActions
Related to Suricata - Optimization #4653: Flow cleaning with chunked approach is memory hungryClosedVictor JulienActions
Related to Suricata - Optimization #4652: GAP handling improvements seem expensiveRejectedActions
Related to Suricata - Bug #4828: flow: flows not evicted & freed in timeClosedVictor JulienActions

AH Updated by Andreas Herz over 4 years ago Actions #1

  • Related to Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped added

VJ Updated by Victor Julien over 4 years ago Actions #2

Wonder if this could be related to #4766. If a flow gets stuck before its stream memory is released it might start to add up.

@Eric Leblond do we clean up the flows stream/app-layer memory when we switch to bypass?

VJ Updated by Victor Julien over 4 years ago Actions #3

  • Related to Bug #4766: Flow leaked when flow->use_cnt access race happens added

VJ Updated by Victor Julien over 4 years ago Actions #4

  • Related to Bug #4778: flow/bypass: app-layer/stream resources not freed when bypass activated added

VJ Updated by Victor Julien over 4 years ago Actions #5

  • Related to Bug #4808: flow: worker-evicted flows need to be processed quicker added

VJ Updated by Victor Julien over 4 years ago Actions #6

  • Status changed from New to In Progress
  • Assignee set to Victor Julien
  • Target version set to 7.0.0-beta1

VJ Updated by Victor Julien over 4 years ago Actions #7

  • Related to Optimization #4653: Flow cleaning with chunked approach is memory hungry added

VJ Updated by Victor Julien over 4 years ago Actions #8

VJ Updated by Victor Julien over 4 years ago Actions #9

  • Related to Bug #4828: flow: flows not evicted & freed in time added
Actions

Also available in: PDF Atom