Project

General

Profile

Actions

Optimization #4653

closed

Flow cleaning with chunked approach is memory hungry

Added by Peter Manev over 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

(originally reported y Eric Leblond)

Disabling the chunk approach results in a faster convergence of flow and memory usage during the replay.
It seems the end of the flow hash was not correctly cleaned. See fix: https://github.com/regit/suricata/commit/bb2ee7ef031e74c3c03268470f1fefd96b6adc3a
Affected versions - 6.x / master


Related issues 2 (0 open2 closed)

Related to Suricata - Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stoppedClosedVictor JulienActions
Related to Suricata - Bug #4650: Stream TCP raw reassembly is leakingClosedVictor JulienActions
Actions #1

Updated by Andreas Herz over 2 years ago

  • Related to Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped added
Actions #2

Updated by Victor Julien over 2 years ago

  • Related to Bug #4650: Stream TCP raw reassembly is leaking added
Actions #3

Updated by Victor Julien almost 2 years ago

  • Status changed from New to Closed
  • Assignee set to Victor Julien
  • Target version set to 7.0.0-beta1

https://github.com/OISF/suricata/pull/7534/commits/e9d2417e0ff34f72f824a11f9d840adeeb534256 keeps the chunked approach, but makes the timing much more aggressive based on memuse vs memcaps.

Actions

Also available in: Atom PDF