http: more sane body inspection/tracking defaults

diff --git a/suricata.yaml.in b/suricata.yaml.in
index a2e4dbe6eb6b46745fe41075e46e83cb9b831aaf..6614906f13d20564c62f78754ea80e160c88512e 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1441,14 +1441,14 @@ app-layer:
 
            # Can be specified in kb, mb, gb.  Just a number indicates
            # it's in bytes.
-           request-body-limit: 3072
-           response-body-limit: 3072
+           request-body-limit: 100kb
+           response-body-limit: 100kb
 
            # inspection limits
            request-body-minimal-inspect-size: 32kb
            request-body-inspect-window: 4kb
-           response-body-minimal-inspect-size: 32kb
-           response-body-inspect-window: 4kb
+           response-body-minimal-inspect-size: 40kb
+           response-body-inspect-window: 16kb
 
            # auto will use http-body-inline mode in IPS mode, yes or no set it statically
            http-body-inline: auto