Jason Ish wrote in #note-3: > I wonder if ever setting this to the default is a good idea. I think it might break a lot of tools and possibly be confusing. > ... That's a good idea. We don't have a section like this in our documentatio...Jeff Lucovsky
When pcap-log runs with `conditional: alerts` or `conditional: tag`, Suricata keeps a small pcap header next to every TCP segment. The memory for that header gets added to the stream reassembly memory counter twice, but it's only subtrac...Jeff Lucovsky
When a rule uses bsize, Suricata checks at load time whether the rule's contents can fit in the buffer, and rejects the rule if they can't. That check gets some rules wrong in both directions. It only looks at the first bsize on a buf...Jeff Lucovsky
My understanding is that there's no leak and hence, this issue is about code cleanup w/no functional change. Thus, I don't think a backport is necessary.Jeff Lucovsky
https://github.com/OISF/suricata/pull/16421 The "ether" object keeps describing the ethernet header as captured, so for a RARP frame on a VLAN, "ether.ether_type" is still 33024 (0x8100). What's new is a top-level "unknown_ether_typ...Jeff Lucovsky
https://github.com/OISF/suricata/pull/16421 Alerts for a packet with the decoder.ethernet.unknown_ethertype event now include the ethertype the decoder could not handle, in a top-level "unknown_ether_type" field. It is an integer, l...Jeff Lucovsky