Project

General

Profile

Actions
Copy link

Optimization #4653

closed

Flow cleaning with chunked approach is memory hungry

Added by Peter Manev about 3 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
7.0.0-beta1
Effort:
Difficulty:
Label:

Description

(originally reported y Eric Leblond)

Disabling the chunk approach results in a faster convergence of flow and memory usage during the replay.
It seems the end of the flow hash was not correctly cleaned. See fix: https://github.com/regit/suricata/commit/bb2ee7ef031e74c3c03268470f1fefd96b6adc3a
Affected versions - 6.x / master

Related issues 2 (0 open — 2 closed)

Related to Suricata - Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stoppedClosedVictor JulienActions
Related to Suricata - Bug #4650: Stream TCP raw reassembly is leakingClosedVictor JulienActions
Actions
Copy link
 #1

Updated by Andreas Herz about 3 years ago

  • Related to Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped added
Actions
Copy link
 #2

Updated by Victor Julien almost 3 years ago

  • Related to Bug #4650: Stream TCP raw reassembly is leaking added
Actions
Copy link
 #3

Updated by Victor Julien over 2 years ago

  • Status changed from New to Closed
  • Assignee set to Victor Julien
  • Target version set to 7.0.0-beta1

https://github.com/OISF/suricata/pull/7534/commits/e9d2417e0ff34f72f824a11f9d840adeeb534256 keeps the chunked approach, but makes the timing much more aggressive based on memuse vs memcaps.

Actions
Copy link

Also available in: Atom PDF