# Stream bypass documentation note

**URL:** <https://forum.suricata.io/t/stream-bypass-documentation-note/2295>\
**Category:** Developers\
**Created:** [March 7, 2022, 10:11pm UTC](https://forum.suricata.io/t/stream-bypass-documentation-note/2295 "2022-03-07T22:11:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jweeks](https://avatars.discourse-cdn.com/v4/letter/j/ec9cab/32.png) [@jweeks](https://forum.suricata.io/u/jweeks)\
**Post date:** [March 7, 2022, 10:11pm UTC](https://forum.suricata.io/t/stream-bypass-documentation-note/2295/1 "2022-03-07T22:11:17Z")

</div>

For the Suricata docs:

[https://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html?highlight=reassembly#stream-engine](https://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html?highlight=reassembly#stream-engine)

There is a comment:

```auto
bypass can lead to missing important traffic. Use with care.

```

I’d like to understand more about what this means; if the stream has reached it’s reassembly depth, doesn’t that mean that any new packets wouldn’t be inspected by Suricata anyway?

How would bypassing this traffic cause Suricata to miss traffic?

Thanks,  
Jeff

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [March 10, 2022, 8:15pm UTC](https://forum.suricata.io/t/stream-bypass-documentation-note/2295/2 "2022-03-10T20:15:58Z")

</div>

There are a lot of factors that play a role when parts of a flow are not further investigated. But yes, depending on your setup another option might already result in passing packets. The main idea is that in general you don’t want to look into a huge payload in the middle. Especially elephant flows consume a lot of resources without any good reason, thus you’re mostly interested in the metadata and the first parts of the payload.