Open Information Security Foundation

09/03/2021

12:48 PM Suricata Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped

(Possible) Related forum posts:
https://forum.suricata.io/t/kernel-drops-and-optimization-recommendations/1044/5
... Andreas Herz

12:38 PM Suricata Support #2725: stream/packet on wrong thread

There has been mostly research on this topic, but no easy fix yet. What would help if we get all the details of a set... Andreas Herz

12:35 PM Suricata Optimization #4651: malloc / memory handling improvement

Do you have more details on your ideas?
So you see a big difference on setups that don't use either tcmallor or jema... Andreas Herz

07/12/2021

02:50 PM Suricata Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped

I did a check on all deployments and while I can see the issue everywhere I can also confirm that it's not solely rel... Andreas Herz

07/07/2021

06:50 PM Suricata Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped

Comparing the two outputs between the good and the bad one you can see that the good one has 92% in the SCMallocFunc ... Andreas Herz

01:09 PM Suricata Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped

I added two valgrind runs with massif enabled, as you can see one has stable memory usage, the other has a steady inc... Andreas Herz

06/30/2021

08:58 PM Suricata Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped

A deeper dive revealed:
last known good commit https://github.com/OISF/suricata/commit/48605f48674b1478a7dfcb03d67... Andreas Herz

06/18/2021

10:04 PM Suricata Support #4521: what's the wrong with my installing suricata

please provide your suricata config file and the command line command how suricata is running exactly, ideally some s... Andreas Herz

05/27/2021

11:37 AM Suricata Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped

good catch, we did a rebuild with the same versions that are used for 6.0 but no change, 5.0 still looking good and 6... Andreas Herz

09:16 AM Suricata Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped

midstream pickup is not enabled.
Both runs you see are the same traffic (via trex), same config it's just the diff... Andreas Herz