[Oisf-users] af-packet rollover

[Peter Manev]

On Mon, Feb 8, 2016 at 5:21 PM, Jason Holmes <jholmes at psu.edu> wrote:
> Hi,
>
> I ran across the following comment a while ago about the rollover option for
> af-packet:
>
> https://github.com/inliniac/suricata/commit/6ec1340cb771190083cd71ac360a85fdf54e8cdf
>
> It says, "Rollover option is causing issue with TCP streaming code because
> packets from the same flow to be treated out of order. As long as the
> situation is not fixed in the streaming engine, it is a bad idea
> to enable it by default."
>
> Based on this comment, I've never enabled the rollover option.  Is it still
> the case that the rollover option causes issues in the streaming engine?

To the best of my knowledge this is still the case.

>
> Thanks,
>
> --
> Jason Holmes
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC:
> http://oisfevents.net



-- 
Regards,
Peter Manev