Tcp.reassembly_gap number hundreds of millions, how to go to solve

My tcp.reassembly_gap number keeps going up, which way should I start to solve it?



what version are you running and how do you run in with which config?

The drops can be a cause or a source of the gaps. You should also look into the whole stats, check the load on the system and make sure the traffic is correct. See also 9.11. Performance Analysis — Suricata 6.0.10 documentation for some guidance.