Project

General

Profile

Actions

Documentation #6284

open

userguide: document what's the impact of `stream.inline`

Added by Juliana Fajardini Reichow about 1 year ago. Updated 12 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The `stream.inline` config parameter isn't very clear in what changing this setting means, to the engine.
This may lead to user confusion, and possibly to outcomes very different from their expectations (cf
https://forum.suricata.io/t/question-about-stream-inline/3868).

We need to better document what the possible values ('auto', 'yes', and 'no') mean in terms of Suricata behavior.

It would be good to also have an SV test to showcase this usage and configuration, and ideally a glossary indicating
terms in Suricata documentation (and codebase) that can be used to refer to IPS mode (as it seems to be the case here).

These could become separate tickets if that'd be easier.

Actions

Also available in: Atom PDF