[Oisf-users] libhtp and reassembly

[Victor Julien]

On 11/06/2014 07:12 PM, Michał Purzyński wrote:
> What is the relation between libhtp and reassembly settings?
> 
> stream:
> (...)
> reassembly:
> depth: 12mb
> 
> and
> 
> libhtp
> 
> request-body-limit
> response-body-limit
> 
> if any? I understand that in order to have like 1GB request/response
> body limits you need to reassemble them. Or did I get it wrong?
> 

You are right. Currently stream.depth rules all and isn't automagically
updated to match HTTP body settings. So to get 1gb body inspection
you'll need at least 1gb stream depth as well.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------