Suricata

Can we get into this exact same situation if instead of useless packets we get tiny packets that xfer a body for example? So each packet does in fact update the state?

Victor Julien wrote in #note-7:

Can we get into this exact same situation if instead of useless packets we get tiny packets that xfer a body for example? So each packet does in fact update the state?

I wrote "and then we get from the server many one-byte packets that are not yet acknowledged by the client."

So, these are tiny packets that transfer a body.
They are useless just until the client acks them which happens at the end of the pcap.

Do you mean having the same pcap with stream.inline mode ? Or that each tiny packet with body gets acked by the client ?
Or what do I not understand in this question ?

What if they are acknowledged? Or indeed if we are in inline mode and have to inspect each unack'd packet? I think my concern is that we should not timeout if we do this type of inspection/logging per packet, for any packet size or type.

Unneeded snprintf call in filestore should get optimized.

Victor Julien wrote in #note-9:

What if they are acknowledged? Or indeed if we are in inline mode and have to inspect each unack'd packet? I think my concern is that we should not timeout if we do this type of inspection/logging per packet, for any packet size or type.

You look right : with my patch, I go from 2 seconds to 30 seconds by setting stream.inline=true
61% is spent in OutputTxLogFiles. and 33% in snprintf in OutputFilestoreLogger

https://github.com/OISF/suricata/pull/10504