doc: update stream-depth description

diff --git a/doc/userguide/file-extraction/file-extraction.rst b/doc/userguide/file-extraction/file-extraction.rst
index b725c302786e14309a038fa7ecfd83fef512c30e..1e7d14231bc7833b5dbd9618fb1c114ccfc46b11 100644 (file)
--- a/doc/userguide/file-extraction/file-extraction.rst
+++ b/doc/userguide/file-extraction/file-extraction.rst
@@ -27,7 +27,7 @@ Settings
 
 *stream.checksum_validation* controls whether or not the stream engine rejects packets with invalid checksums. A good idea normally, but the network interface performs checksum offloading a lot of packets may seem to be broken. This setting is enabled by default, and can be disabled by setting to "no". Note that the checksum handling can be controlled per interface, see "checksum_checks" in example configuration.
 
-*file-store.stream-depth* controls how far into a stream reassembly is done. Beyond this value no reassembly will be done. This means that after this value the HTTP session will no longer be tracked. By default a setting of 1 Megabyte is used. 0 sets it to unlimited. If set to no, it is disabled and ``stream.reassembly.depth`` is considered. Non-zero values must be greater than ``stream.stream-depth`` to be used.
+*file-store.stream-depth* controls how far into a stream reassembly is done. Beyond this value no reassembly will be done. This means that after this value the HTTP session will no longer be tracked. By default a setting of 1 Megabyte is used. 0 sets it to unlimited. If set to no, it is disabled and stream.reassembly.depth is considered. Non-zero values must be greater than ``stream.stream-depth`` to be used.
 
 *libhtp.default-config.request-body-limit* / *libhtp.server-config.<config>.request-body-limit* controls how much of the HTTP request body is tracked for inspection by the http_client_body keyword, but also used to limit file inspection. A value of 0 means unlimited.
 
@@ -76,7 +76,9 @@ Setting ``file-store.stream-depth`` to 0 permits store of the entire file;
 here, 0 means "unlimited."
 
 ``file-store.stream-depth`` will always override ``stream.reassembly.depth``
-when filestore keyword is used.
+when filestore keyword is used. However, it is not possible to set ``file-store.stream-depth``
+to a value less than ``stream.reassembly.depth``. Values less than this amount are ignored
+and a warning message will be displayed.
 
 A protocol parser, like modbus, could permit to set a different
 store-depth value and use it rather than ``file-store.stream-depth``.