Open Information Security Foundation

04/13/2025

11:54 PM Suricata Bug #7651: Regular PPPOE packets are getting dropped as decoder.ppp.unsup_proto

Locally I have made DecodePPPUncompressedProto and DecodePPPOESession just return TM_ECODE_OK for the following proto... Thomas Winter

04/09/2025

03:05 AM Suricata Bug #7651 (New): Regular PPPOE packets are getting dropped as decoder.ppp.unsup_proto

After upgrading from suricata 7.0.6 to 7.0.8, we found that PPP packets were getting dropped.
The packets were getti... Thomas Winter

12/21/2023

11:35 PM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

Should use "emergency-closed" not "emergency_closed" otherwise you get a deprecated warning log. Thomas Winter

12/06/2023

08:30 PM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

Feel free to close this now. Thomas Winter

11/27/2023

04:07 AM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

The cause was this patch c50ef8cc21 ("flow: fix TCP closed default initialization") which increased the timeout for T... Thomas Winter

11/24/2023

04:36 AM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

The streamingBuffer rework seems to be a red herring. I think it just increased memuse just enough to hit the memcap.... Thomas Winter

01:40 AM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

So far I have only seen this issue when using trex and another traffic generator.
Running multiple continuous curl t... Thomas Winter

11/23/2023

01:41 AM Suricata Documentation #6552: doc: add tcp timeout fix to upgrade guide

I've attached massif.out.3238 which is 4.0.6 with ReassembleRealloc at 17.1MB peak.
I've attached massif.out.2298 wh... Thomas Winter

11/20/2023

01:33 AM Suricata Documentation #6552 (Closed): doc: add tcp timeout fix to upgrade guide

I have bisected two git commits that have caused large increases in memory use.
This one https://github.com/OISF/s... Thomas Winter

11/08/2023

11:28 PM Suricata Optimization #6454 (Closed): detect: force os to release memory on rule reload

Rule reload results in large chunks of memory being freed as the as the old signature tables are discarded. The OS ma... Thomas Winter