hey sorry for previous message i was wrong the suricata version was 7.0.8 not 6.
What I want to achieve is have a max-file-size to extract from suricata engine lets say 300mb. To my understanding fixing stream-depth to 300mb is the solution right it will not process the 300mb tcp stream and ignore other part so I won’t never get file size more than 300mb? And other thing is even after running pcaps and live traffic sometime small files gets state truncated even if the size if less than stream-depth is it expected behavior?