Project

General

Profile

Actions

Optimization #4653

closed

Flow cleaning with chunked approach is memory hungry

Added by Peter Manev about 1 year ago. Updated 4 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

(originally reported y Eric Leblond)

Disabling the chunk approach results in a faster convergence of flow and memory usage during the replay.
It seems the end of the flow hash was not correctly cleaned. See fix: https://github.com/regit/suricata/commit/bb2ee7ef031e74c3c03268470f1fefd96b6adc3a
Affected versions - 6.x / master


Related issues 2 (1 open1 closed)

Related to Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stoppedIn ProgressVictor JulienActions
Related to Bug #4650: Stream TCP raw reassembly is leakingClosedVictor JulienActions
Actions #1

Updated by Andreas Herz about 1 year ago

  • Related to Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped added
Actions #2

Updated by Victor Julien 11 months ago

  • Related to Bug #4650: Stream TCP raw reassembly is leaking added
Actions #3

Updated by Victor Julien 4 months ago

  • Status changed from New to Closed
  • Assignee set to Victor Julien
  • Target version set to 7.0rc1

https://github.com/OISF/suricata/pull/7534/commits/e9d2417e0ff34f72f824a11f9d840adeeb534256 keeps the chunked approach, but makes the timing much more aggressive based on memuse vs memcaps.

Actions

Also available in: Atom PDF