Global settings for the Stream5 preprocessor.
preprocessor stream5_global: \
[track_tcp <yes|no>], [max_tcp <number>], \
[memcap <number bytes>], \
[track_udp <yes|no>], [max_udp <number>], \
[track_icmp <yes|no>], [max_icmp <number>], \
[track_ip <yes|no>], [max_ip <number>], \
[flush_on_alert], [show_rebuilt_packets], \
[prune_log_max <bytes>], [disabled]
| Option | Description |
|---|---|
| track_tcp <yes|no> | Track sessions for TCP. The default is "yes". |
| max_tcp <num sessions> | Maximum simultaneous TCP sessions tracked. The default is "262144", maximum is "1048576", minimum is "1". |
| memcap <num bytes> | Memcap for TCP packet storage. The default is "8388608" (8MB), maximum is "1073741824" (1GB), minimum is "32768" (32KB). |
| track_udp <yes|no> | Track sessions for UDP. The default is "yes". |
| max_udp <num sessions> | Maximum simultaneous UDP sessions tracked. The default is "131072", maximum is "1048576", minimum is "1". |
| track_icmp <yes|no> | Track sessions for ICMP. The default is "no". |
| max_icmp <num sessions> | Maximum simultaneous ICMP sessions tracked. The default is "65536", maximum is "1048576", minimum is "1". |
| track_ip <yes|no> | Track sessions for IP. The default is "no". Note that "IP" includes all non-TCP/UDP traffic over IP including ICMP if ICMP not otherwise configured. |
| max_ip <num sessions> | Maximum simultaneous IP sessions tracked. The default is "16384", maximum is "1048576", minimum is "1". |
| disabled | Option to disable the stream5 tracking. By default this option is turned off. When the preprocessor is disabled only the options memcap, max_tcp, max_udp and max_icmp are applied when specified with the configuration. |
| flush_on_alert | Backwards compatibility. Flush a TCP stream when an alert is generated on that stream. The default is set to off. |
| show_rebuilt_packets | Print/display packet after rebuilt (for debugging). The default is set to off. |
| prune_log_max <num bytes> | Print a message when a session terminates that was consuming more than the specified number of bytes. The default is "1048576" (1MB), minimum can be either "0" (disabled) or if not disabled the minimum is "1024" and maximum is "1073741824". |