Suricata

Found while creating CTF challenge against curl CVE-2023-38039

Script to create traffic was

import socket

HOST = "127.0.0.1"  # Standard loopback interface address (localhost)
PORT = 8001  # Port to listen on (non-privileged ports are > 1023)

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.bind((HOST, PORT))
    s.listen()
    conn, addr = s.accept()
    with conn:
        print(f"Connected by {addr}")
        while True:
            data = conn.recv(1024)
            if not data:
                break
            conn.sendall(b"HTTP/1.1 200 OK\n")
            for i in range(1024*1024):
                conn.sendall(b"Name%d: value%d\n" % (i, i))

Most time is spent in htp_process_response_header_generic. doing the htp_table_get