Open Information Security Foundation

12/05/2021

04:35 PM Suricata Bug #4873 (New): smb midstream probing check affects performance

Have been chasing this for a bit.
I have a reproducible case repay with trex (configs are available in the in... Peter Manev

11/11/2021

06:31 AM Suricata Bug #4817: smtp: smtp transaction not logged if no email is present

Originally reported on the SELKS project https://github.com/StamusNetworks/SELKS/issues/346
Private pcap Peter Manev

09/29/2021

09:21 AM Suricata Bug #4273: protodetect: SEGV due to NULL ptr deref

Seems the fix in
https://github.com/catenacyber/suricata/tree/protodetect-midstream-gap-4273-v2
fixes the issues ,... Peter Manev

09/11/2021

06:27 AM Suricata Bug #4672: PR 6336 QA alert deviation

Seems related mostly to http_useragent/to_server.
I have not found a single stream reproducible case so far.
The... Peter Manev

08/27/2021

12:38 PM Suricata Bug #4655 (New): Dataset dumping to disk seems limited to 1000

If a dataset needs to be dumped/saved it seems there is some sort of cap to 1000 entrees being written on disk. Peter Manev

12:34 PM Suricata Bug #4654 (Closed): tcp: insert_data_normal_fail can hit without triggering memcap

(originally reported y Eric Leblond)
It seems it is failing only on memory issue but we don't see memcap firing... Peter Manev

12:33 PM Suricata Optimization #4653 (New): Flow cleaning with chunked approach is memory hungry

(originally reported y Eric Leblond)
Disabling the chunk approach results in a faster convergence of flow and me... Peter Manev

12:31 PM Suricata Optimization #4652 (New): GAP handling improvements seem expensive

(originally reported y Eric Leblond)
We got a big performance increase with disabling the GAP handling (GAP handli... Peter Manev

12:29 PM Suricata Optimization #4651 (New): malloc / memory handling improvement

Using tcmalloc/jmalloc for example is improving packet drop a lot on busy systems which suggest potential malloc/memo... Peter Manev

12:26 PM Suricata Bug #4650 (In Progress): Stream TCP raw reassembly is leaking

(originally reported y Eric Leblond)
It seems we have a leak in memory when TCP raw reassembly is enabled. Raw r... Peter Manev