Project

General

Profile

Actions
Copy link

Optimization #4652

closed

GAP handling improvements seem expensive

Added by Peter Manev over 2 years ago. Updated over 1 year ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

(originally reported y Eric Leblond)

We got a big performance increase with disabling the GAP handling (GAP handling commits in 6.x vs 5.x ). As we are also leaking memory in stream TCP reassembly ( https://redmine.openinfosecfoundation.org/issues/4650 ) , this could also augment the pressure on memory because Suricata is not stopping the reassembly when it hits the first gap.

Related issues 2 (0 open — 2 closed)

Related to Suricata - Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stoppedClosedVictor JulienActions
Related to Suricata - Bug #4650: Stream TCP raw reassembly is leakingClosedVictor JulienActions
Actions
Copy link

Also available in: Atom PDF