Enum MemcapPolicy 

#[non_exhaustive]
pub enum MemcapPolicy {
    Ignore,
    DropFlow,
    DropPacket,
    PassThrough,
}

Available on crate feature tracker only.

Tracker-wide memcap policy — what to do when the total reassembly buffering across all flows trips the configured memcap. Mirrors Suricata’s stream.reassembly.memcap-policy vocabulary, collapsed to the four behaviors that make sense for a passive analyzer.

Set on crate::FlowTrackerConfig::reassembly_memcap_policy; the cap itself is crate::FlowTrackerConfig::reassembly_memcap.

#[non_exhaustive] — additive forever.

New in 0.18.0 (issue #17 close).

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Ignore

Default. Count the violation and change nothing — buffering continues past the cap. Matches Suricata’s memcap-policy: ignore, which is likewise a reporting mode rather than an enforcement one.

A single AnomalyKind::GlobalMemcapHit fires per tick on the first violation; later violations in the same tick coalesce into it.

This does not bound memory. Choose DropPacket to actually enforce the cap, or PassThrough / DropFlow to reclaim what is already buffered.

DropFlow

Stop reassembling the violating flow — both sides are released (ReassemblyStop::Memcap) — while the flow stays tracked until its transport end (so its later packets are not mistaken for a new connection). Session parsers on the flow stop reading both sides (two side stops with EndReason::BufferOverflow), then close once (detail "both sides stopped"). Released whether or not a side had a reassembler yet, and whatever the reassembler’s release does: the driver drops it and keeps only its final counters. Use when you’d rather lose one flow’s L7 than corrupt analysis on it.

Before 0.25 this ended the flow with Ended { reason: BufferOverflow } and forgot it.

DropPacket

Refuse the segment that would push past the memcap, keeping the flow and everything already buffered. The reassembler stays usable; the refused bytes surface as a gap (crate::SessionParser::on_gap) once later data arrives.

The decision is made before the segment is handed to the reassembler — Reassembler::segment cannot be undone — so it is conservative: a reassembler that would have deduplicated the payload is still charged its full length.

PassThrough

Stop reassembling the offending side only (ReassemblyStop::Memcap) and release what it holds, but keep the flow in the tracker. Flow accounting continues; session parsers stop reading that side (EndReason::BufferOverflow); the other side goes on.

Since 0.25 crate::FlowDriver drops the side’s reassembler (keeping only its final counters), so the memory is freed whatever Reassembler::release does.

Implementations

impl MemcapPolicy

pub fn as_str(&self) -> &'static str

Stable slug for metric labels.

Trait Implementations

impl Clone for MemcapPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for MemcapPolicy

impl Debug for MemcapPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MemcapPolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for MemcapPolicy

Available on crate feature serde only.

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for MemcapPolicy

impl Hash for MemcapPolicy

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for MemcapPolicy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for MemcapPolicy

Available on crate feature serde only.

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for MemcapPolicy