@ -62,33 +62,40 @@ Specific settings
Exception policies are implemented for:
Exception policies are implemented for:
.. list-table :: Exception Policy configuration variables
.. list-table :: Exception Policy configuration variables
:widths: 20, 18, 62
:widths: 18, 18, 18, 44
:header-rows: 1
:header-rows: 1
* - Config setting
* - Config setting
- Policy variable
- Policy variable
- Affects
- Expected behavior
- Expected behavior
* - stream.memcap
* - stream.memcap
- memcap-policy
- memcap-policy
- Flow or packet
- If a stream memcap limit is reached, apply the memcap policy to the packet and/or
- If a stream memcap limit is reached, apply the memcap policy to the packet and/or
flow.
flow.
* - stream.midstream
* - stream.midstream
- midstream-policy
- midstream-policy
- Flow
- If a session is picked up midstream, apply the midstream policy to the flow.
- If a session is picked up midstream, apply the midstream policy to the flow.
* - stream.reassembly.memcap
* - stream.reassembly.memcap
- memcap-policy
- memcap-policy
- Flow or packet
- If stream reassembly reaches memcap limit, apply memcap policy to the
- If stream reassembly reaches memcap limit, apply memcap policy to the
packet and/or flow.
packet and/or flow.
* - flow.memcap
* - flow.memcap
- memcap-policy
- memcap-policy
- Packet
- Apply policy when the memcap limit for flows is reached and no flow could
- Apply policy when the memcap limit for flows is reached and no flow could
be freed up. **Policy can only be applied to the packet.**
be freed up. **Policy can only be applied to the packet.**
* - defrag.memcap
* - defrag.memcap
- memcap-policy
- memcap-policy
- Packet
- Apply policy when the memcap limit for defrag is reached and no tracker
- Apply policy when the memcap limit for defrag is reached and no tracker
could be picked up. **Policy can only be applied to the packet.**
could be picked up. **Policy can only be applied to the packet.**
* - app-layer
* - app-layer
- error-policy
- error-policy
- Flow or packet
- Apply policy if a parser reaches an error state. Policy can be applied to packet and/or flow.
- Apply policy if a parser reaches an error state. Policy can be applied to packet and/or flow.
To change any of these, go to the specific section in the suricata.yaml file
To change any of these, go to the specific section in the suricata.yaml file