Optimization #5121: Use configurable or more dynamic @ PACKET_ALERT_MAX@ (5.0.x backport) - Suricata - Open Information Security Foundation

Actions

Copy link

Optimization #5121

closed

Bug #5124: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport)

Use configurable or more dynamic @ PACKET_ALERT_MAX@ (5.0.x backport)

Added by Jeff Lucovsky about 2 years ago. Updated almost 2 years ago.

Status:

Closed

Priority:

High

Assignee:

Juliana Fajardini Reichow

Target version:

5.0.10

Effort:

Difficulty:

Label:

Description

Currently, PACKET_ALERT_MAX is hardcoded to 15

This turned out to be a problem writing S-V test, with many signatures (different variations of a feature) matching on the same packet
That was HTTP keywords on HTTP2 traffic, where I had one packet containing 3 requests

It would be nice to have this value be configurable from suricata.yaml

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Jeff Lucovsky about 2 years ago

Copied from Optimization #4207: Use configurable or more dynamic @ PACKET_ALERT_MAX@ added

Actions

Copy link

Updated by Juliana Fajardini Reichow almost 2 years ago

Target version changed from 7.0.0-beta1 to 5.0.10

Actions

Copy link

Updated by Juliana Fajardini Reichow almost 2 years ago

Status changed from New to In Progress

Actions

Copy link

Updated by Juliana Fajardini Reichow almost 2 years ago

Status changed from In Progress to In Review

PR for review: https://github.com/OISF/suricata/pull/7379

Actions

Copy link

Updated by Juliana Fajardini Reichow almost 2 years ago

Subject changed from Use configurable or more dynamic @ PACKET_ALERT_MAX@ to Use configurable or more dynamic @ PACKET_ALERT_MAX@ (5.0.x backport)

Actions

Copy link