Project

General

Profile

Actions
Copy link

Optimization #5125

closed

Bug #5120: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (6.0.x backport)

Use configurable or more dynamic @ PACKET_ALERT_MAX@ (6.0.x backport)

Added by Jeff Lucovsky almost 3 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
High
Assignee:
Juliana Fajardini Reichow
Target version:
6.0.6
Effort:
Difficulty:
Label:

Description

Currently, PACKET_ALERT_MAX is hardcoded to 15

This turned out to be a problem writing S-V test, with many signatures (different variations of a feature) matching on the same packet
That was HTTP keywords on HTTP2 traffic, where I had one packet containing 3 requests

It would be nice to have this value be configurable from suricata.yaml

Related issues 1 (0 open — 1 closed)

Copied from Suricata - Optimization #4207: Use configurable or more dynamic @ PACKET_ALERT_MAX@ClosedJuliana Fajardini ReichowActions
Actions
Copy link
 #1

Updated by Jeff Lucovsky almost 3 years ago

  • Copied from Optimization #4207: Use configurable or more dynamic @ PACKET_ALERT_MAX@ added
Actions
Copy link
 #2

Updated by Juliana Fajardini Reichow over 2 years ago

  • Target version changed from 7.0.0-beta1 to 6.0.6
Actions
Copy link
 #3

Updated by Juliana Fajardini Reichow over 2 years ago

  • Status changed from New to In Progress
Actions
Copy link
 #4

Updated by Juliana Fajardini Reichow over 2 years ago

  • Status changed from In Progress to In Review
Actions
Copy link
 #5

Updated by Juliana Fajardini Reichow over 2 years ago

  • Status changed from In Review to Closed
Actions
Copy link
 #6

Updated by Juliana Fajardini Reichow over 2 years ago

  • Subject changed from Use configurable or more dynamic @ PACKET_ALERT_MAX@ to Use configurable or more dynamic @ PACKET_ALERT_MAX@ (6.0.x backport)
Actions
Copy link
 #7

Updated by Victor Julien over 2 years ago

  • Parent task changed from #5124 to #5120
Actions
Copy link

Also available in: Atom PDF