From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stefan Schantl <stefan.schantl@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH 00/20] Suricata Configuration Updates
Date: Fri, 01 Mar 2019 20:01:26 +0100
Message-ID: <cf1ca24ad2dd9ae53cc9ee51495b4bd6a0d9a844.camel@ipfire.org>
In-Reply-To: <BFD17C1E-66F7-4437-A7B5-2272BE9765C1@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1968032080143448764=="
List-Id: <development.lists.ipfire.org>

--===============1968032080143448764==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

> Hi,
> 
> Did you apply all of them in order?
> 

Yes, I did.

The reported two patches did not apply.

However, the changes on the second patch depends on modifications of
the first one, but why does the first one does not apply by using "git
am" ? 

> It is not very helpful to only merge half the patchset.
> 
> Did you use pwclient?
> 
> -Michael
> 
> > On 1 Mar 2019, at 17:09, Stefan Schantl <stefan.schantl(a)ipfire.org>
> > wrote:
> > 
> > Hello Michael,
> > 
> > thanks for working on optimizing the suricata configuration file.
> > 
> > I've merged all of the patches except number "8" and "10" which
> > does
> > not apply with "git am".
> > 
> > When simple adding the changes with "patch" the changes can be
> > applied
> > - any idea why this happened?
> > 
> > Thanks in advance,
> > 
> > -Stefan 
> > > I have worked on suricata's configuration.
> > > 
> > > My objective was to use more system resources (because suricata
> > > did
> > > not use much RAM, etc.)
> > > to make it faster and to be able to have some deeper decoding and
> > > matching.
> > > 
> > > Please review these changes and let me know what you think.
> > > 
> > > All in all, suricata should not use more than 1G of RAM which I
> > > think
> > > is a very good
> > > amount. If your system is weaker than that, there is no point in
> > > running an IPS.
> > > 
> > > On my system in my office, this runs with a hand full of rules
> > > enabled from the
> > > Emerging Threats Community set at around 110MB of RAM.
> > > 
> > > Michael Tremer (20):
> > >  Revert "Suricata: detect DNS events on port 853, too"
> > >  suricata: Set max-pending-packets to 1024
> > >  suricata: Set default packet size to 1514
> > >  suricata: Set detection profile to high
> > >  suricata: Drop profiling section from configuration
> > >  suricata: Drop some commented stuff from configuration
> > >  suricata: Drop sections that require Rust
> > >  suricata: Configure HTTP decoder
> > >  suricata: Allow 32MB of RAM for DNS decoding
> > >  suricata: Drop parsers I have never heard of
> > >  suricata: We do not use any IP reputation lists
> > >  suricata: Log to syslog
> > >  suricata: Use the correct path for the magic database
> > >  suricata: Use 64MB of RAM for defragmentation
> > >  suricata: Use up to 256MB of RAM for the flow cache
> > >  suricata: Log to syslog like a normal process
> > >  suricata: Increase memory size for the stream engine
> > >  suricata: Disable decoding for Teredo
> > >  suricata: Start capture first and then load rules
> > >  suricata: Fix syntax error
> > > 
> > > config/etc/syslog.conf        |   2 +-
> > > config/suricata/suricata.yaml | 282 +++++----------------------
> > > -----
> > > ----------
> > > 2 files changed, 30 insertions(+), 254 deletions(-)
> > > 

--===============1968032080143448764==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUFCQ2dBZEZpRUVXTzBOWHRTcnZo
YXN5dERuVHRkT0ZZK1RzdDRGQWx4NWdZWUFDZ2tRVHRkT0ZZK1QKc3Q0amlnLzlGaEdVYUhOUGlQ
WHNsT0hWTmN0RzhQWFhJeUlRaEF4b1JtdllWNC8xbjM1UmF4czZpMWNkRlBiRwp4NDlYTG41eWlV
aDN1S05uVGVSTkRnMUcrcFZaTm0vMkZIbjZFMDhYaVZDMXE0ekxjL2JFc01jZm5Dd2JCVm1sCnpn
OC8vZGJTSUtiTjZveEROcW8xd28wRmpQZlFEL1JONVdncDhzY01acGxMWi9vNUt4T0dYeHpCMHJI
aWdodGwKU1hRRDNkY1N1azhHTThCdW5qbHRCdHg1aEtHeEVQdWljNVBiYW5BbEI3OEhuQ2RGRDFk
YXgwM3NuVlVMd3R4UApDdUEvQnN4OVkramFicDJNZFFGb09JMHlZc3pHWTZuanhMR2pwNDNQeko1
RUpLU2hOZndIZ3hKZ2lIbGdNMUFjCm85aklMR2YvaThpakdiUkVOOG1ZaEpPSkIrSXZia3UzQnVD
djRPWDVRRkxJZ0NYQ2tQa3pWYXArL091MmRXRDMKdWZ0RWZBWnlzNzM1RnptV0MvTWRpTHg4VXlp
RDB2aWVkdEFVMVdQb0t3anFweG9xT1FLQnI1VUt4SGpPeThmbwozYzJYRVdWajRYNnFaaXg2dVd5
OHNKZ0YzdzZaWEswSGNPSFJsOFhLOWFyOG1zYVIzcG5UNXNVaEdPQmFxVEQ4CjZrcXNuWTRKKzhM
cWdZMWcxbXFXTVY0aHhzUlZORTVxNW14T2N1bkdETHBoYitTZ1Zvc2M2TWMrNE1wTEsyVEsKdHlI
R2poK3d1YmpUY2ZZMnVDNDh1M1NQVUZ6RG9pTnVBYlEwbnFHMlBPbTY5NE9UNVdRZHlxZkIwenFR
OUY4cworemJ5V2RVY3o0ejJHMDEzVHYxS0lPSVJpaTVEb2U5R1h5VnUyVE1rT1d6bDRhV2pJRE09
Cj1oMVBrCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo=

--===============1968032080143448764==--