From a3282da01c550043c95411f9d0474cab07f1f859 Mon Sep 17 00:00:00 2001
From: Juliana Fajardini <jufajardini@oisf.net>
Date: Tue, 3 Mar 2026 10:44:48 -0300
Subject: [PATCH] stream/tcp: add `tcp.async_stream` stats counter

The counter is incremented when the engine detects an asynchronous TCP
stream and stream.async-oneside: true.

Same as with midstream pickups, we want more visibility into when the
engine is applying this setting.

Task #8339
---
 etc/schema.json  | 4 ++++
 src/stream-tcp.c | 8 ++++++++
 src/stream-tcp.h | 2 ++
 3 files changed, 14 insertions(+)

diff --git a/etc/schema.json b/etc/schema.json
index 80523be8b4..8f51207a48 100644
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -8266,6 +8266,10 @@
                         "active_sessions": {
                             "type": "integer"
                         },
+                        "async_stream": {
+                            "type": "integer",
+                            "description": "Number of times the engine inspected an asynchronous TCP stream (if stream.async-oneside enabled)"
+                        },
                         "insert_data_normal_fail": {
                             "type": "integer"
                         },
diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index d1f660962e..9ec203ddee 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -1243,6 +1243,7 @@ static int StreamTcpPacketStateNone(
         if (stream_config.async_oneside) {
             SCLogDebug("ssn %p: =~ ASYNC", ssn);
             ssn->flags |= STREAMTCP_FLAG_ASYNC;
+            StatsCounterIncr(&tv->stats, stt->counter_tcp_async_stream);
         }
 
         /** window scaling for midstream pickups, we can't do much other
@@ -1343,6 +1344,7 @@ static int StreamTcpPacketStateNone(
         if (stream_config.async_oneside) {
             SCLogDebug("ssn %p: =~ ASYNC", ssn);
             ssn->flags |= STREAMTCP_FLAG_ASYNC;
+            StatsCounterIncr(&tv->stats, stt->counter_tcp_async_stream);
         }
 
         /* sequence number & window */
@@ -1512,6 +1514,7 @@ static int StreamTcpPacketStateNone(
         if (stream_config.async_oneside) {
             SCLogDebug("ssn %p: =~ ASYNC", ssn);
             ssn->flags |= STREAMTCP_FLAG_ASYNC;
+            StatsCounterIncr(&tv->stats, stt->counter_tcp_async_stream);
         }
 
         /** window scaling for midstream pickups, we can't do much other
@@ -2401,6 +2404,8 @@ static int StreamTcpPacketStateSynSent(
         if (!stream_config.async_oneside)
             return 0;
 
+        StatsCounterIncr(&tv->stats, stt->counter_tcp_async_stream);
+
         /* we are in ASYNC (one side) mode now. */
 
         /* one side async means we won't see a SYN/ACK, so we can
@@ -5703,6 +5708,8 @@ int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt,
         {
             SCLogDebug("ssn %p: removing ASYNC flag as we have packets on both sides", ssn);
             ssn->flags &= ~STREAMTCP_FLAG_ASYNC;
+            /* since the stream isn't really async, let's decrease the counter */
+            StatsCounterDecr(&tv->stats, stt->counter_tcp_async_stream);
         }
     }
 
@@ -6185,6 +6192,7 @@ TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data)
 
     stt->counter_tcp_wrong_thread = StatsRegisterCounter("tcp.pkt_on_wrong_thread", &tv->stats);
     stt->counter_tcp_ack_unseen_data = StatsRegisterCounter("tcp.ack_unseen_data", &tv->stats);
+    stt->counter_tcp_async_stream = StatsRegisterCounter("tcp.async_stream", &tv->stats);
 
     /* init reassembly ctx */
     stt->ra_ctx = StreamTcpReassembleInitThreadCtx(tv);
diff --git a/src/stream-tcp.h b/src/stream-tcp.h
index c214a8a478..cb8a9b98c7 100644
--- a/src/stream-tcp.h
+++ b/src/stream-tcp.h
@@ -112,6 +112,8 @@ typedef struct StreamTcpThread_ {
     StatsCounterId counter_tcp_wrong_thread;
     /** ack for unseen data */
     StatsCounterId counter_tcp_ack_unseen_data;
+    /** async sessions */
+    StatsCounterId counter_tcp_async_stream;
 
     /** tcp reassembly thread data */
     TcpReassemblyThreadCtx *ra_ctx;