diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst index 4af0ad1c72..4de3971c94 100644 --- a/doc/userguide/upgrade.rst +++ b/doc/userguide/upgrade.rst @@ -57,6 +57,9 @@ Major changes Instead, both the SDP parser and logger depend on being invoked by another parser (or logger). - ARP decoder and logger have been introduced. Since ARP can be quite verbose and produce many events, the logger is disabled by default. +- It is possible to see an increase of alerts, for the same rule-sets, if you + use many stream/payload rules, due to Suricata triggering TCP stream + reassembly earlier. Upgrading 6.0 to 7.0 --------------------