Project

General

Profile

Actions

Bug #6499

open

tcp.active_sessions and flow.active count will never reduce when using trex

Added by xiaolong li about 1 year ago. Updated 15 days ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
low
Difficulty:
Label:

Description

I use trex v2.97 to test suricata v7.0.2 and found some problems.

1. The tcp.active_sessions and flow.active count in stats.log will never reduce to zero after trex stop.

The trex command:

./t-rex-64 -f cap2/many_client_example.yaml -d 300 -p -m 30000

2. Sometimes the tcp.active_sessions will be a very big number at startup, looks like the int has overflow.

------------------------------------------------------------------------------------
Date: 11/7/2023 -- 15:02:49 (uptime: 0d, 00h 03m 39s)
------------------------------------------------------------------------------------
Counter                                       | TM Name                   | Value
------------------------------------------------------------------------------------
capture.kernel_packets                        | Total                     | 18
capture.afpacket.polls                        | Total                     | 28592
capture.afpacket.poll_timeout                 | Total                     | 28592
tcp.active_sessions                           | Total                     | 18446744073709465109
flow.active                                   | Total                     | 18446744073709465109
flow.end.state.closed                         | Total                     | 86507
flow.end.tcp_state.closed                     | Total                     | 86507
flow.mgr.full_hash_pass                       | Total                     | 19
flow.mgr.rows_per_sec                         | Total                     | 65724
flow.spare                                    | Total                     | 702745
flow.mgr.rows_maxlen                          | Total                     | 10
flow.mgr.flows_checked                        | Total                     | 334237
flow.mgr.flows_notimeout                      | Total                     | 107828
flow.mgr.flows_timeout                        | Total                     | 226409
flow.mgr.flows_evicted                        | Total                     | 231859
flow.mgr.flows_evicted_needs_work             | Total                     | 782
memcap_pressure                               | Total                     | 23
memcap_pressure_max                           | Total                     | 23
flow.recycler.recycled                        | Total                     | 86507
flow.recycler.queue_avg                       | Total                     | 142
flow.recycler.queue_max                       | Total                     | 26073
tcp.memuse                                    | Total                     | 224190400
tcp.reassembly_memuse                         | Total                     | 3134808688
http.memuse                                   | Total                     | 83106865
flow.memuse                                   | Total                     | 293977408

Files

stats.bignum.log (42.3 KB) stats.bignum.log xiaolong li, 11/16/2023 04:30 AM
suricata.yaml (77.9 KB) suricata.yaml xiaolong li, 11/16/2023 04:30 AM
trex_cfg.yaml (455 Bytes) trex_cfg.yaml xiaolong li, 11/16/2023 04:30 AM
stats.log (5.8 MB) stats.log xiaolong li, 11/16/2023 04:30 AM

Subtasks 1 (1 open0 closed)

Bug #6515: tcp.active_sessions and flow.active count will never reduce when using trex (7.0.x backport)AssignedOISF DevActions

Related issues 1 (0 open1 closed)

Related to Suricata - Bug #7365: flow-manager: multi Flow Manager memory leak problemClosedVictor JulienActions
Actions #1

Updated by Victor Julien about 1 year ago

  • Description updated (diff)
  • Priority changed from Low to Normal
  • Target version changed from 7.0.3 to 8.0.0-beta1
Actions #2

Updated by Victor Julien about 1 year ago

  • Label Needs backport to 7.0 added
Actions #3

Updated by OISF Ticketbot about 1 year ago

  • Subtask #6515 added
Actions #4

Updated by OISF Ticketbot about 1 year ago

  • Label deleted (Needs backport to 7.0)
Actions #5

Updated by Victor Julien 15 days ago

  • Related to Bug #7365: flow-manager: multi Flow Manager memory leak problem added
Actions #6

Updated by Victor Julien 15 days ago

This is possibly caused by the same issue as #7365 reports as in your suricata.yaml there are 3 flow.manager's.

Actions

Also available in: Atom PDF