Suricata

tcp.reassembly_memuse seems to be incorrectly multipled by the number of detector threads.

The static variable ra_memeuse holds the amount of memory used by the TcpSegmentPool, which is shared across all threads.
This global variable is used to set the value of the rtv->counter_tcp_reass_memuse counter (in StreamTcpReassembleMemuseCounter()), which is in the per-thread context.

However, when tcp.reassembly_memuse is printed on stats.log it is summed across all threads, therefore reporting the actual value of ra_memuse multipiled by the number of detector threads.

Verified on version suricata 1.3.4.