Suricata

Problematic :
- file reconstruction does not work on ip stream
- luajit only receives chunks of the stream (1250 bytes max)
- Malwares and large exploits can be injected via non-http flows, but it is impossible to perform a confirmation check (via lua or 3rd-party software) because the matched stream can not be properly passed to them.

Solution :
A new feature to store the stream to a file. Preferably enabled by a keyword in a rule to avoid storing every matching rule.