mirror of https://github.com/OISF/suricata
protocol detection: handle very unbalanced case
Some traffic is very unbalanced. For example a 4 bytes request followed by 12mb of response data. If the 4 bytes don't lead to the protocol being detected, then app layer processing won't start, but it will not give up either. It will just wait for more data. This leads to piling up data on the opposite side. Observed: TS: 4 bytes. PP failed (bit set), PM has not given up (bit not set). This makes sense as max_depth is not yet reached. TC: 12mb. PP and PM failed (bits set). As ts-PM never gives up, we never consider proto detect complete, so all segments in either direction are still kept in the session. This patch adds a cutoff for this case: - IF for TS we have PP bit set, PM not set, AND - we have TC both bits set, AND - proto is unknown, AND - TC data is 100k already, THEN - give up on protocol detection. The same for the opposite direction.pull/945/head
parent
ed46fd715d
commit
1bd189a076
Loading…
Reference in New Issue