From 205bc1e2884b28dc9b016f116f5c54e0d569eb5d Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 13 Apr 2022 14:00:37 +0200 Subject: [PATCH] app-layer: disable stream app tracking on no parser If protocol has no parser enabled or implemented, disable the app progress tracking in the stream engine to reduce the workload in the stream engine. --- src/app-layer-parser.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index 97172b7046..43accd7217 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -1259,8 +1259,12 @@ int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow const uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1; /* we don't have the parser registered for this protocol */ - if (p->StateAlloc == NULL) + if (p->StateAlloc == NULL) { + if (f->proto == IPPROTO_TCP) { + StreamTcpDisableAppLayer(f); + } goto end; + } if (flags & STREAM_GAP) { if (!(p->option_flags & APP_LAYER_PARSER_OPT_ACCEPT_GAPS)) {