Documentation #6284
Updated by Juliana Fajardini Reichow 9 months ago
The `stream.inline` config parameter isn't very clear in what changing this setting means, to the engine.
This may lead to user confusion, and possibly to outcomes very different from their expectations (cf
https://forum.suricata.io/t/question-about-stream-inline/3868).
We need to better document what the possible values ('auto', 'yes', and 'no') mean in terms of Suricata behavior.
It would be good to also have an a SV test to showcase this usage and configuration, and ideally a glossary indicating
terms in Suricata documentation (and codebase) that can be used to refer to IPS mode (as it seems to be the case here).
These could become separate tickets if that'd be easier.