Merge pull request #2065 in SNORT/snort3 from ~DERAMADA/snort3:h2i_flow_data_size...

Squashed commit of the following:

commit b4ed56e4d29821bd549824de43845861fc062b62
Author: deramada <deramada@cisco.com>
Date:   Fri Mar 6 10:18:28 2020 -0500

    http2_inspect: update dev notes with memory calculations

diff --git a/src/service_inspectors/http2_inspect/dev_notes.txt b/src/service_inspectors/http2_inspect/dev_notes.txt
index f3e76a10de1be4ea1520e0a34681581bddd62dfc..0804f45fd0b8f84ff0425371add87c77b3023125 100644 (file)
--- a/src/service_inspectors/http2_inspect/dev_notes.txt
+++ b/src/service_inspectors/http2_inspect/dev_notes.txt
@@ -42,3 +42,14 @@ use status reason phrases, so the status line passed to NHI will not include one
 only the HTTP version and the status code. 
 
 H2I supports the NHI test tool. See ../http_inspect/dev_notes.txt for usage instructions.
+
+Memory requirements: Http2FlowData represents all H2I information in a flow. It does not account 
+for the entries in the hpack dynamic table. The formula below estimates the size of an entry 
+in the dynamic table:
+name.length() + value.length() + RFC_ENTRY_OVERHEAD (32 as defined by the RFC)
+
+Using the formula and some sample pcaps, the average size of the dynamic table is 1645 bytes.
+Dynamically allocated objects related to http_inspect are considered separate and are not 
+included. Temporary objects (frame_data and frame_header) are ignored. The remaining dynamically
+allocated are Http2Infractions (8 bytes * 2) and Http2EventsGen(24 bytes * 2)
+Therefore, the memory required by http2 per flow: sizeof(Http2FlowData) + 1645 + 16 + 48