userguide: update defrag settings options

We were still mentioning that there were only three options.

(cherry picked from commit 3c74e443bdd6e666692b1c1da1d0389268b0eec7)

diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst
index 9096c59a449654c2844325e1767f3874d8ef62fe..d6574560b726344754aae10ac0899f2d689e8984 100644 (file)
--- a/doc/userguide/configuration/suricata-yaml.rst
+++ b/doc/userguide/configuration/suricata-yaml.rst
@@ -928,19 +928,21 @@ a component of Suricata; the defragment-engine. After a fragmented
 packet is reconstructed by the defragment-engine, the engine sends on
 the reassembled packet to rest of Suricata.
 
-There are three options within defrag: max-frags, prealloc and
-timeout. At the moment Suricata receives a fragment of a packet, it
+At the moment Suricata receives a fragment of a packet, it
 keeps in memory that other fragments of that packet will appear soon
 to complete the packet. However, there is a possibility that one of
 the fragments does not appear. To prevent Suricata for keeping waiting
 for that packet (thereby using memory) there is a timespan after which
-Suricata discards the fragments. This occurs by default after 60
+Suricata discards the fragments (timeout). This occurs by default after 60
 seconds.
 
 ::
 
   defrag:
-    max-frags: 65535
+    memcap: 32mb
+    hash-size: 65536
+    trackers: 65535    # number of defragmented flows to follow
+    max-frags: 65535   # number of fragments do keep (higher than trackers)
     prealloc: yes
     timeout: 60