Hello,
I see that reassembly memory for tcp streams are allocated only to prealloc values configured during the startup. And later when the reassembly memory is required Suricata allocates it dynamically and adds it to pool.
In my case I want to allocate most of the memory required by Suricata upfront. Is any method readily available?
I can set the prealloc to memcap/sizeof(tcp_segment)/threads_count but will it restrict the preallocated reassembly memory only to particular thread or will it be in a common pool, so that when one thread is overloaded with tcp flows it can take more memory than allocated to it(provided other threads are underloaded)?
Thanks