Merge pull request #628 in SNORT/snort3 from misc_perf to master
Squashed commit of the following:
commit
7b11ea83413f1af8f0f5a847a0177637deca1d45
Author: Russ Combs <rucombs@cisco.com>
Date: Fri Sep 16 17:32:17 2016 -0400
Refactored BitOp related. Only instantiate on demand. Move accessor out of stream_api
for better encapsulation in ips_flowbits. Eliminate useless methods.
Added stream.ip_frags_only so we can avoid processing non-ICMP-TCP-UDP-frags where not
needed. This avoids creating flows etc. Beware - appID wants flows for everything
at the moment.
Fixed double counting of ip session timeouts and prunes as well as
double counting of udp session timeouts.
Changed stale pruning to prune 1 at a time to resolve excessive latency caused
by pruning. Timeouts are pruned one at a time too, although it remains to be
seen if this is adequate for idle timeouts where connection events are concerned.
Changed default cache sizes to match 2.X.
FlowControl::max_flows() and FlowControl::prune_flows() no longer used; deleted.
Shutdown purging was being counted as prunes in stream_tcp. This is fixed but
still need to fix stream.user prunes which includes shutdown stuff.
Added a crude total and max to packet latency stats to calculate average packet time
a la 2.X. Still only totals about half of runtime so needs to be revisited. It is not
supposed to include stuff like decode so it may be ok.
Fixed stream_tcp to close a scan session immediately (was timing out). So a SYN
that gets a RST results in closed and getting cleared.
Fixed some annoying legacy naming issues. So inspector data on a flow is now
flow_data instead of application_data. Also C-style functions like
get_x_from_y() are now simply C++-style get_x().
Cleanup default conf.