When pcap-log runs with `conditional: alerts` or `conditional: tag`, Suricata keeps a small pcap header next to every TCP segment. The memory for that header gets added to the stream reassembly memory counter twice, but it's only subtrac...Jeff Lucovsky
When a rule uses bsize, Suricata checks at load time whether the rule's contents can fit in the buffer, and rejects the rule if they can't. That check gets some rules wrong in both directions. It only looks at the first bsize on a buf...Jeff Lucovsky
My understanding is that there's no leak and hence, this issue is about code cleanup w/no functional change. Thus, I don't think a backport is necessary.Jeff Lucovsky
https://github.com/OISF/suricata/pull/16421 The "ether" object keeps describing the ethernet header as captured, so for a RARP frame on a VLAN, "ether.ether_type" is still 33024 (0x8100). What's new is a top-level "unknown_ether_typ...Jeff Lucovsky
https://github.com/OISF/suricata/pull/16421 Alerts for a packet with the decoder.ethernet.unknown_ethertype event now include the ethertype the decoder could not handle, in a top-level "unknown_ether_type" field. It is an integer, l...Jeff Lucovsky
A rule using @fileext@ or @file.name@ misses a file when an earlier file of the same transaction did not match, if the two files are inspected in different passes. With both files in one packet the same rule alerts. h3. Reproducer ...Jeff Lucovsky