Added by Cole Dishington over 2 years ago. Updated about 1 year ago.
Description
By default, flow reuse is forced in low memory conditions no matter the state of the flow (see src/flow-hash.c:FlowGetNew:690).
Could we add some config to optionally disable this forced flow-reuse behavior?
PR=https://github.com/OISF/suricata/pull/10232
SV_PR=https://github.com/OISF/suricata-verify/pull/1607
This feature was requested due to HTTP packets, from a previously blocked TCP connection, getting through during high traffic load. This occurred when a blocked TCP connection's flow was re-used and subsequent packets from the previously blocked TCP connection were not categorized as HTTP.
This was only observed in emergency mode, as the flow timeouts are much shorter.
The solution proposed is to not re-use potentially active flows in emergency mode.
In this solution, new flows will be blocked until older flows are timeout out.
Seems the last PR was https://github.com/OISF/suricata/pull/11667, to get this into 8 there are just a few weeks left.