userguide: highlight exception policy effects

Some exception policies can only be applied to entire flows or
individual packets, for some exception scenarios. Make this easier to
read, in the documentation.

Related to
Task #5816
pull/10805/head
Juliana Fajardini 1 year ago committed by Victor Julien
parent caf590d51f
commit 94b111283d

@ -62,33 +62,40 @@ Specific settings
Exception policies are implemented for: Exception policies are implemented for:
.. list-table:: Exception Policy configuration variables .. list-table:: Exception Policy configuration variables
:widths: 20, 18, 62 :widths: 18, 18, 18, 44
:header-rows: 1 :header-rows: 1
* - Config setting * - Config setting
- Policy variable - Policy variable
- Affects
- Expected behavior - Expected behavior
* - stream.memcap * - stream.memcap
- memcap-policy - memcap-policy
- Flow or packet
- If a stream memcap limit is reached, apply the memcap policy to the packet and/or - If a stream memcap limit is reached, apply the memcap policy to the packet and/or
flow. flow.
* - stream.midstream * - stream.midstream
- midstream-policy - midstream-policy
- Flow
- If a session is picked up midstream, apply the midstream policy to the flow. - If a session is picked up midstream, apply the midstream policy to the flow.
* - stream.reassembly.memcap * - stream.reassembly.memcap
- memcap-policy - memcap-policy
- Flow or packet
- If stream reassembly reaches memcap limit, apply memcap policy to the - If stream reassembly reaches memcap limit, apply memcap policy to the
packet and/or flow. packet and/or flow.
* - flow.memcap * - flow.memcap
- memcap-policy - memcap-policy
- Packet
- Apply policy when the memcap limit for flows is reached and no flow could - Apply policy when the memcap limit for flows is reached and no flow could
be freed up. **Policy can only be applied to the packet.** be freed up. **Policy can only be applied to the packet.**
* - defrag.memcap * - defrag.memcap
- memcap-policy - memcap-policy
- Packet
- Apply policy when the memcap limit for defrag is reached and no tracker - Apply policy when the memcap limit for defrag is reached and no tracker
could be picked up. **Policy can only be applied to the packet.** could be picked up. **Policy can only be applied to the packet.**
* - app-layer * - app-layer
- error-policy - error-policy
- Flow or packet
- Apply policy if a parser reaches an error state. Policy can be applied to packet and/or flow. - Apply policy if a parser reaches an error state. Policy can be applied to packet and/or flow.
To change any of these, go to the specific section in the suricata.yaml file To change any of these, go to the specific section in the suricata.yaml file

Loading…
Cancel
Save