Documentation #6284: userguide: document what's the impact of `stream.inline` - Suricata - Open Information Security Foundation

Actions

Copy link

Documentation #6284

open

userguide: document what's the impact of `stream.inline`

Added by Juliana Fajardini Reichow about 1 year ago. Updated about 1 year ago.

Status:

New

Priority:

Normal

Assignee:

OISF Dev

Target version:

8.0.0-beta1

Affected Versions:

Effort:

Difficulty:

Label:

Description

The `stream.inline` config parameter isn't very clear in what changing this setting means, to the engine.
This may lead to user confusion, and possibly to outcomes very different from their expectations (cf
https://forum.suricata.io/t/question-about-stream-inline/3868).

We need to better document what the possible values ('auto', 'yes', and 'no') mean in terms of Suricata behavior.

It would be good to also have an SV test to showcase this usage and configuration, and ideally a glossary indicating
terms in Suricata documentation (and codebase) that can be used to refer to IPS mode (as it seems to be the case here).

These could become separate tickets if that'd be easier.