Project

General

Profile

Actions
Copy link

Optimization #4652

closed

GAP handling improvements seem expensive

Added by Peter Manev over 3 years ago. Updated about 2 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

(originally reported y Eric Leblond)

We got a big performance increase with disabling the GAP handling (GAP handling commits in 6.x vs 5.x ). As we are also leaking memory in stream TCP reassembly ( https://redmine.openinfosecfoundation.org/issues/4650 ) , this could also augment the pressure on memory because Suricata is not stopping the reassembly when it hits the first gap.

Related issues 2 (0 open — 2 closed)

Related to Suricata - Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stoppedClosedVictor JulienActions
Related to Suricata - Bug #4650: Stream TCP raw reassembly is leakingClosedVictor JulienActions
Actions
Copy link
 #1

Updated by Andreas Herz over 3 years ago

  • Related to Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped added
Actions
Copy link
 #2

Updated by Victor Julien about 3 years ago

  • Related to Bug #4650: Stream TCP raw reassembly is leaking added
Actions
Copy link
 #3

Updated by Victor Julien about 2 years ago

  • Status changed from New to Closed

I'm closing this as its not very specific, other than pointing out that doing more work has a cost. If there are more specific issues, please create a new ticket.

Actions
Copy link
 #4

Updated by Victor Julien about 2 years ago

  • Status changed from Closed to Rejected
Actions
Copy link

Also available in: Atom PDF