From e6cf7ae8fa0ce5fdb10e36b53ec2181b9f149ecd Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 30 Sep 2016 12:04:40 +0200 Subject: [PATCH] yaml: improve stream-depth comments --- suricata.yaml.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/suricata.yaml.in b/suricata.yaml.in index 9d6f65231c..54cfc0868e 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -405,7 +405,9 @@ outputs: # sha1 and sha256 #force-hash: [md5] force-filestore: no # force storing of all files - stream-depth: 1mb # reassemble 1mb into a stream, set to no to disable + # override global stream-depth for sessions in which we want to + # perform file extraction. Set to 0 for unlimited. + #stream-depth: 0 #waldo: file.waldo # waldo file to store the file_id across runs # output module to log files tracked in a easily parsable json format @@ -701,7 +703,7 @@ app-layer: # If the limit is reached, app-layer-event:modbus.flooded; will match. #request-flood: 500 - # Stream reassembly size for modbus, default is 0 + # Stream reassembly size for modbus. By default track it completely. stream-depth: 0 enabled: no