mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
ed47bf5dd8
Packets received in segmented mbufs that cannot be linearized are inspected as a copy. In the copy modes (IPS/TAP), modifications made to the copy (inline stream normalization, the replace keyword) did not reach the mbufs, so the unmodified packet was forwarded. Chains larger than the maximum packet size were truncated for inspection but forwarded in full, and chains that could not be copied were forwarded uninspected. When Suricata modifies a copied packet, it now writes the data back to the mbuf chain before transmitting it. Chains that cannot be inspected in full or transmitted are dropped: chains larger than the maximum packet size, chains with more segments than the copy interface can transmit, and malformed chains. Forwarding chains requires the multi-segment TX offload, which replaces MBUF_FAST_FREE and selects a slower TX path on some NICs. As mbufs sized from the MTU rarely lead to chains on physical NICs, forwarding them is opt-in through the new tx-segmented-mbufs interface setting (default false), which both copy interfaces must share. Without it, chains that cannot be linearized are dropped in the copy modes. The drops are counted in capture.dpdk.segmented_drops and capture.dpdk.segmented_too_large. In IPS mode, they are also counted in ips.blocked with the new capture_error drop reason, so that the drop reasons explain the blocked packets. Ticket: 6012 |
1 week ago | |
|---|---|---|
| .. | ||
| 3rd-party-integration | ||
| _static | ||
| appendix | ||
| capture-hardware | 1 week ago | |
| configuration | 1 week ago | |
| devguide | 3 weeks ago | |
| file-extraction | 1 year ago | |
| firewall | 3 weeks ago | |
| install | 11 months ago | |
| ips | 10 months ago | |
| licenses | ||
| lua | 3 weeks ago | |
| manpages | 5 months ago | |
| output | 3 weeks ago | |
| partials | 3 weeks ago | |
| performance | 5 months ago | |
| plugins | ||
| protocols | ||
| reputation | ||
| rule-management | 8 months ago | |
| rules | 1 week ago | |
| upgrade | ||
| .gitignore | ||
| Makefile.am | 9 months ago | |
| Makefile.sphinx | ||
| README.md | ||
| acknowledgements.rst | ||
| command-line-options.rst | ||
| conf.py | 6 months ago | |
| convert.py | ||
| docutils.conf | ||
| generate-evedoc.sh | ||
| index.rst | ||
| initscripts.rst | ||
| install.rst | 2 months ago | |
| make-sense-alerts.rst | ||
| public-data-sets.rst | 8 months ago | |
| quickstart.rst | 4 months ago | |
| requirements.txt | ||
| security.rst | ||
| support-status.rst | ||
| unix-socket.rst | ||
| upgrade.rst | 3 weeks ago | |
| verifying-source-files.rst | 10 months ago | |
| what-is-suricata.rst | ||
README.md
Suricata User Guide
This directory contains the Suricata Guide. The Suricata Developer's guide is included as a chapter of the Guide. The Sphinx Document Generator is used to build the documentation. For a primer os reStructuredText see the reStructuredText Primer.
Verifying Changes
There are a number of output formats to choose from when making the source documentation locally (e.g. html, pdf, man).
The documentation source can be built with make -f Makefile.sphinx html. Substitute the 'html' word for desired output format.
There are different application dependencies based on the output desired.