From: Mike Stepanek (mstepane) Date: Fri, 13 Mar 2020 14:43:25 +0000 (+0000) Subject: Merge pull request #2065 in SNORT/snort3 from ~DERAMADA/snort3:h2i_flow_data_size... X-Git-Tag: 3.0.0-270~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a5200069435c90f859c671fd223581534c423ec1;p=thirdparty%2Fsnort3.git Merge pull request #2065 in SNORT/snort3 from ~DERAMADA/snort3:h2i_flow_data_size to master Squashed commit of the following: commit b4ed56e4d29821bd549824de43845861fc062b62 Author: deramada Date: Fri Mar 6 10:18:28 2020 -0500 http2_inspect: update dev notes with memory calculations --- diff --git a/src/service_inspectors/http2_inspect/dev_notes.txt b/src/service_inspectors/http2_inspect/dev_notes.txt index f3e76a10d..0804f45fd 100644 --- a/src/service_inspectors/http2_inspect/dev_notes.txt +++ b/src/service_inspectors/http2_inspect/dev_notes.txt @@ -42,3 +42,14 @@ use status reason phrases, so the status line passed to NHI will not include one only the HTTP version and the status code. H2I supports the NHI test tool. See ../http_inspect/dev_notes.txt for usage instructions. + +Memory requirements: Http2FlowData represents all H2I information in a flow. It does not account +for the entries in the hpack dynamic table. The formula below estimates the size of an entry +in the dynamic table: +name.length() + value.length() + RFC_ENTRY_OVERHEAD (32 as defined by the RFC) + +Using the formula and some sample pcaps, the average size of the dynamic table is 1645 bytes. +Dynamically allocated objects related to http_inspect are considered separate and are not +included. Temporary objects (frame_data and frame_header) are ignored. The remaining dynamically +allocated are Http2Infractions (8 bytes * 2) and Http2EventsGen(24 bytes * 2) +Therefore, the memory required by http2 per flow: sizeof(Http2FlowData) + 1645 + 16 + 48