# Question about stream.inline

**URL:** https://forum.suricata.io/t/question-about-stream-inline/3868
**Category:** Help
**Tags:** suricata
**Created:** [August 28, 2023, 10:39am UTC](https://forum.suricata.io/t/question-about-stream-inline/3868 "2023-08-28T10:39:06Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)
#### Post date: [August 28, 2023, 10:39am UTC](https://forum.suricata.io/t/question-about-stream-inline/3868/1 "2023-08-28T10:39:06Z")

</div>

Hi there,

I am using Suricata in IDS mode only. When i set `stream.inline: yes` i get a big increase of alerts of the following rule:

```auto

alert ssh $EXTERNAL_NET any -> $HOME_NET 22 (msg:"ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack"; flow:established,to_server; content:"SSH-"; content:"libssh"; within:20; threshold: type both, count 5, seconds 30, track by_src; reference:url,doc.emergingthreats.net/2006546; classtype:attempted-admin; sid:2006546; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

```

What is the reason behind this behaviour? Should i leave `stream.inline: yes` or switch it to "“auto” or “no”?

Thanks!

---

<div class="post-metadata">

### Author: ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)
#### Post date: [August 29, 2023, 9:50pm UTC](https://forum.suricata.io/t/question-about-stream-inline/3868/2 "2023-08-29T21:50:40Z")

</div>

Hello,

We’re trying to better understand this situation. Would you be able to provide a pcap showcasing the traffic that is generating more alerts when `stream.inline` is “yes”?

Also, could you tell us which version of Suri you are running, just so we have a bigger picture?

Thanks in advance!

---

<div class="post-metadata">

### Author: ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)
#### Post date: [August 30, 2023, 9:58am UTC](https://forum.suricata.io/t/question-about-stream-inline/3868/3 "2023-08-30T09:58:24Z")

</div>

I am using the latest stable version of Suricata. I will try to get a PCAP but it will take some time.

Thanks!

---

<div class="post-metadata">

### Author: ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)
#### Post date: [August 30, 2023, 4:35pm UTC](https://forum.suricata.io/t/question-about-stream-inline/3868/4 "2023-08-30T16:35:27Z")

</div>

Alright, and thanks!

So far, as a heads-up, this may be a case of lack of documentation. If you set `stream.inline: no` you don’t get the increase, right? What happens if you keep that as `no` but pass the command-line option `--simulate-ips`? Are the results similar to having it as `stream.inline: yes`?

---

<div class="post-metadata">

### Author: ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)
#### Post date: [August 31, 2023, 2:44pm UTC](https://forum.suricata.io/t/question-about-stream-inline/3868/5 "2023-08-31T14:44:59Z")

</div>

Hi!

The results appear not to be similar. With `stream.inline: auto` and --simulate-ips i do not have the increase. In IDS mode should i leave this to “no” or “auto”?

Thanks!

---

<div class="post-metadata">

### Author: ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)
#### Post date: [September 6, 2023, 12:50pm UTC](https://forum.suricata.io/t/question-about-stream-inline/3868/6 "2023-09-06T12:50:13Z")

</div>

Thanks for your answer 🙂

I would say that `auto` is a safer option, for now.