From: Victor Julien <victor@inliniac.net>
Date: Fri, 11 Dec 2015 15:05:42 +0000 (+0100)
Subject: http: more sane body inspection/tracking defaults
X-Git-Tag: suricata-3.0RC3~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fae2836039ef56daebcc222e41be3b4ad445b27c;p=thirdparty%2Fsuricata.git

http: more sane body inspection/tracking defaults
---

diff --git a/suricata.yaml.in b/suricata.yaml.in
index a2e4dbe6eb..6614906f13 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1441,14 +1441,14 @@ app-layer:
 
            # Can be specified in kb, mb, gb.  Just a number indicates
            # it's in bytes.
-           request-body-limit: 3072
-           response-body-limit: 3072
+           request-body-limit: 100kb
+           response-body-limit: 100kb
 
            # inspection limits
            request-body-minimal-inspect-size: 32kb
            request-body-inspect-window: 4kb
-           response-body-minimal-inspect-size: 32kb
-           response-body-inspect-window: 4kb
+           response-body-minimal-inspect-size: 40kb
+           response-body-inspect-window: 16kb
 
            # auto will use http-body-inline mode in IPS mode, yes or no set it statically
            http-body-inline: auto