mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
ed47bf5dd8
Packets received in segmented mbufs that cannot be linearized are inspected as a copy. In the copy modes (IPS/TAP), modifications made to the copy (inline stream normalization, the replace keyword) did not reach the mbufs, so the unmodified packet was forwarded. Chains larger than the maximum packet size were truncated for inspection but forwarded in full, and chains that could not be copied were forwarded uninspected. When Suricata modifies a copied packet, it now writes the data back to the mbuf chain before transmitting it. Chains that cannot be inspected in full or transmitted are dropped: chains larger than the maximum packet size, chains with more segments than the copy interface can transmit, and malformed chains. Forwarding chains requires the multi-segment TX offload, which replaces MBUF_FAST_FREE and selects a slower TX path on some NICs. As mbufs sized from the MTU rarely lead to chains on physical NICs, forwarding them is opt-in through the new tx-segmented-mbufs interface setting (default false), which both copy interfaces must share. Without it, chains that cannot be linearized are dropped in the copy modes. The drops are counted in capture.dpdk.segmented_drops and capture.dpdk.segmented_too_large. In IPS mode, they are also counted in ips.blocked with the new capture_error drop reason, so that the drop reasons explain the blocked packets. Ticket: 6012 |
7 days ago | |
|---|---|---|
| .. | ||
| suricata-yaml | ||
| dropping-privileges.rst | ||
| exception-policies.rst | 7 months ago | |
| global-thresholds.rst | 1 year ago | |
| includes.rst | ||
| index.rst | ||
| landlock.rst | ||
| multi-tenant.rst | 1 year ago | |
| snort-to-suricata.rst | ||
| suricata-yaml.rst | 7 days ago | |
| systemd-notify.rst | ||