Open Information Security Foundation

12/21/2023

11:35 PM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

Should use "emergency-closed" not "emergency_closed" otherwise you get a deprecated warning log. Thomas Winter

12/06/2023

08:30 PM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

Feel free to close this now. Thomas Winter

11/27/2023

04:07 AM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

The cause was this patch c50ef8cc21 ("flow: fix TCP closed default initialization") which increased the timeout for T... Thomas Winter

11/24/2023

04:36 AM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

The streamingBuffer rework seems to be a red herring. I think it just increased memuse just enough to hit the memcap.... Thomas Winter

01:40 AM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

So far I have only seen this issue when using trex and another traffic generator.
Running multiple continuous curl t... Thomas Winter

11/23/2023

01:41 AM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

I've attached massif.out.3238 which is 4.0.6 with ReassembleRealloc at 17.1MB peak.
I've attached massif.out.2298 wh... Thomas Winter

11/20/2023

01:33 AM Suricata Documentation #6552 (In Review): doc: add tcp timeout fix to upgrade guide

I have bisected two git commits that have caused large increases in memory use.
This one https://github.com/OISF/s... Thomas Winter

11/08/2023

11:28 PM Suricata Optimization #6454 (Closed): Force os to release memory on rule reload

Rule reload results in large chunks of memory being freed as the as the old signature tables are discarded. The OS ma... Thomas Winter

08/10/2023

04:21 AM Suricata Feature #6261: Add GRE as a parsible protocol

https://github.com/OISF/suricata/pull/9364
https://github.com/OISF/suricata-verify/pull/1350 Thomas Winter

04:08 AM Suricata Feature #6261 (In Review): Add GRE as a parsible protocol

This will allow rules wanting to match on GRE packets without having to specify the protocol number specifically.
... Thomas Winter