Too many open files

[strizhechenko]

https://twitter.com/strizhechenko/status/900325239678267392

if not tcp_stream:
  tcp_stream:create()
  if current_packet is not a SYN:
    tcp_stream:mark_as_corrupted()
  else:
    tcp_stream.client = current_packet.src_ip
if tcp_stream.corrupted || tcp_stream.finished:
  return
tcp_stream.dumper:new_for_current()
if current_packet.ip_src == tcp_stream.client:
  if current_packet.tcp.flags == FIN || current_packet.tcp.flags == RST:
    tcp_stream.dumper:flush()
    tcp_stream.dumper:close()
    tcp_stream:mark_as_finished()

[strizhechenko]

With #2 it now breaks at ≈13900 packets (≈1500 tcp-streams) instead of 250 streams.

[strizhechenko]

ulimit -n 8196 make you able to process ≈49000 tcp stream.