Added by Victor Julien over 13 years ago. Updated almost 5 years ago.
Description
During start up (mostly detection engine init) we alloc and free enormous amounts of small memory blocks. This leads to memory fragmentation.
This task is a place holder for tracking that. Addressing all/most of this is going to be a long term effort.
Files
| fragmentation-leak.png (150 KB) fragmentation-leak.png | Gianni Tedesco, 05/24/2021 11:26 PM |
Actually the main culprit of heap fragmentation is reassembly. Keep doing increasing realloc() as we do for tcp stream reassembly is worst-case behaviour, and it can cause several gigabytes of excess heap to be used up. The only way to get it back is to attach gdb and call malloc_trim(0).
Reassembly buffers need to be a chain of fixed size blocks to avoid this situation. You can copy the blocks out to the final (per-thread) buffer at the end, just before injecting the packet for inspection.
Or at least, appears to be around reassembly and state for protocols at least. Will investigate further.
