Suricata

The SNMP transaction vector length can grow to large values eventually causing packet loss due to excessive time spent in rs_snmp_get_tx_iterator.

At a production site, this manifested as
1. Packet loss: packet loss occurred at rates well within the machine's capacity. Packet loss was nearly always present.
2. Excessive time in rs_snmp_get_tx_iterator (as measured by perf). Several readings showed it with 45% of time spent (displayed by perf).

Through observations obtained by capturing live network traffic, the attached pcap was synthetically constructed to demonstrate the issue. The key thing is the unbalanced ratio of requests to responses.