Project

General

Profile

Actions

Bug #3158

closed

'wrong thread' tracking inaccurate for bridging IPS modes

Added by Victor Julien about 5 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

When using IPS with AF_PACKET the worker threads are created per interface. So a connection/flow will be handled one interface for one side of the traffic and another interface for the opposing side. This means that by design different threads process a single flow.

The code should consider this when checking the 'wrong thread' logic.

AF_PACKET and NETMAP are affected.


Related issues 1 (1 open0 closed)

Related to Suricata - Optimization #2725: stream/packet on wrong threadFeedbackOISF DevActions
Actions

Also available in: Atom PDF