# Streaming-buffer exceeds limit

**URL:** <https://forum.suricata.io/t/streaming-buffer-exceeds-limit/5578>\
**Category:** Help\
**Created:** [April 2, 2025, 7:32pm UTC](https://forum.suricata.io/t/streaming-buffer-exceeds-limit/5578 "2025-04-02T19:32:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhmarty](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/mhmarty/32/1175_2.png) [@mhmarty](https://forum.suricata.io/u/mhmarty)\
**Post date:** [April 2, 2025, 7:32pm UTC](https://forum.suricata.io/t/streaming-buffer-exceeds-limit/5578/1 "2025-04-02T19:32:29Z")

</div>

I have this message popping up once or twice a day in suricata.log:  
2025-04-02 13:55:09 Warning: streaming-buffer: StreamingBuffer::GrowRegionToSize() tried to alloc 1073742368 bytes, exceeds limit of 1073741824

Is that a hard-coded limit or something that be altered in settings? Is this something worth fixing?

Suricata 7.0.9 installed from package on RHEL 8

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [April 7, 2025, 8:34pm UTC](https://forum.suricata.io/t/streaming-buffer-exceeds-limit/5578/2 "2025-04-07T20:34:40Z")

</div>

Hard to tell without much more details. So please add:

- `suricata.yaml`
- `stats.log`
- `suricata.log`
- `suricata --build-info`
- Run command on how you run Suricata

---

<div class="post-metadata">

**Author:** ![maja](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/maja/32/2376_2.png) [@maja](https://forum.suricata.io/u/maja)\
**Post date:** [March 24, 2026, 8:41am UTC](https://forum.suricata.io/t/streaming-buffer-exceeds-limit/5578/3 "2026-03-24T08:41:41Z")

</div>

This ist indeed a hardcoded limit in util-streaming-buffer.c:

```auto
    if (size > BIT_U32(30)) { // 1GiB
        if (!g2s_warn_once) {
SCLogWarning("StreamingBuffer::GrowRegionToSize() tried to alloc %u bytes, exceeds limit of %" PRIu32, size, BIT_U32(30));
            g2s_warn_once = true;
        }
return SC_ELIMIT;
    }

```

I have exactly the same problem on our napatech-driven multi-gigabit sensors with suricata 8.0.3 and 8.0.4. And it seems to be independent of the stream memcap settings in the suricata.yaml, since these are way bigger than 1GB.

If that limit is reached, we get many napatech overflow drops, and suricata simply restarts itself (or its service is restarted by systemd).

I do not know whether this is a desired behavior or not.

Thx, MaJa

---

<div class="post-metadata">

**Author:** ![maja](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/maja/32/2376_2.png) [@maja](https://forum.suricata.io/u/maja)\
**Post date:** [March 25, 2026, 5:46am UTC](https://forum.suricata.io/t/streaming-buffer-exceeds-limit/5578/4 "2026-03-25T05:46:29Z")

</div>

Is it possible to find out what kind of flow (ips, ports) is responsible for this large buffer resize request?

E.g., trigger a stream event rule?

Thx, MaJa