Project

General

Profile

Actions
Copy link

Documentation #5910

open

devguide: explain possible differences in data inspection with inline stream or not

Added by Juliana Fajardini Reichow over 2 years ago. Updated 5 days ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
9.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

The inline stream engine controls when and how data is inspected. In some cases, this may result in an asymmetry when traffic is inspected in inline mode or not (e.g. it would be possible to see [one] extra alert in inline mode when compared to non-inline mode).

When: ACKed or non-ACKed data.
How: by [ACKed] chunks?

This seems important to be documented, as in some cases - say, when running similar tests in IDS vs IPS mode, there could be a mismatch in the number of alerts generated, due to that.

Related issues 2 (2 open — 0 closed)

Related to Suricata - Documentation #5513: userguide: add a chapter for IPS modeIn ProgressVictor JulienActions
Related to Suricata - Documentation #4351: doc: explain the engine logic to trigger inspection of TCP dataIn ReviewShivani BhardwajActions
Actions
Copy link

Also available in: Atom PDF