In suricata, does mpm mean that it can generate 2 alerts for 1 packet?
Can I set the detect to stop when a alert occurs while 1 packet is being inspected?
If the flow is removed due to timeout or prune, will the memory used by the stream and reassembly engines be returned?
My suricata is in a leak of memory in the flow, stream, reassembly and http analysis engines. When the memory reaches memcap, tcp gap occurs, and after a long time, ssn drop occurs, and traffic leakage occurs. My traffic environment is mainly web traffic, and it occurs as low as 5G and as many as 20G.
What settings can be applied to eliminate the memory leak? The settings related to flow are as follows. Should I increase the number of flow recyclers? Any ideas are great, so let me know what settings to try.
emergency-recovery: 30 prune-flows: 5 managers: 2 recyclers: 4