Merge in SNORT/snort3 from ~MMATIRKO/snort3:mp_id to master
Squashed commit of the following:
commit
4ac2befd5591bd5526f84b8d2d483e16d98de1e9
Author: Michael Matirko <mmatirko@cisco.com>
Date: Fri Nov 1 20:42:56 2024 -0400
thread: get_relative_instance_number now zero-based
switch ( flow.key->pkt_type )
{
case PktType::IP:
- out << "Instance-ID: " << get_relative_instance_number() << " IP " << flow.key->addressSpaceId << ": " << src_ip << " " << dst_ip;
+ out << "Instance-ID: " << get_relative_instance_number() + 1<< " IP " << flow.key->addressSpaceId << ": " << src_ip << " " << dst_ip;
break;
case PktType::ICMP:
- out << "Instance-ID: " << get_relative_instance_number() << " ICMP " << flow.key->addressSpaceId << ": " << src_ip << " type " << src_port << " "
+ out << "Instance-ID: " << get_relative_instance_number() + 1 << " ICMP " << flow.key->addressSpaceId << ": " << src_ip << " type " << src_port << " "
<< dst_ip;
break;
case PktType::TCP:
- out << "Instance-ID: " << get_relative_instance_number() << " TCP " << flow.key->addressSpaceId << ": " << src_ip << "/" << src_port << " "
+ out << "Instance-ID: " << get_relative_instance_number() + 1 << " TCP " << flow.key->addressSpaceId << ": " << src_ip << "/" << src_port << " "
<< dst_ip << "/" << dst_port;
if (flow.session)
{
break;
case PktType::UDP:
- out << "Instance-ID: " << get_relative_instance_number() << " UDP " << flow.key->addressSpaceId << ": "<< src_ip << "/" << src_port << " "
+ out << "Instance-ID: " << get_relative_instance_number() + 1 << " UDP " << flow.key->addressSpaceId << ": "<< src_ip << "/" << src_port << " "
<< dst_ip << "/" << dst_port;
break;
{ return instance_id; }
unsigned get_relative_instance_number()
-{
- // Added +1 here so we get instance numbers starting from 1 for display purposes
+{
+ // Maintain the zero-based counting that we previously used; first pkt thread = 0
const SnortConfig* sc = SnortConfig::get_conf();
- return instance_id + sc->id_offset + 1;
+ return instance_id + sc->id_offset;
}
SThreadType get_thread_type()
<< dipstr << " " << dport << " "
<< std::to_string(to_utype(protocol))
<< " AS=" << address_space_id
- << " ID=" << get_instance_id();
+ << " ID=" << get_relative_instance_number();
if (inter_group_flow)
oss << " GR=" << sgroup << "-" << dgroup;
namespace snort
{
unsigned get_instance_id() { return 3; }
+unsigned get_relative_instance_number() { return 3; }
Packet::Packet(bool) {}
Packet::~Packet() = default;
{
return 0;
}
+
+ unsigned get_relative_instance_number()
+ {
+ return 0;
+ }
}
void AppIdSession::set_ss_application_ids(AppId service_id, AppId client_id, AppId payload_id,
<< dipstr << " " << dport << " "
<< std::to_string(to_utype(proto))
<< " AS=" << p.pkth->address_space_id
- << " ID=" << get_instance_id();
+ << " ID=" << get_relative_instance_number();
if (p.is_inter_group_flow())
{
<< dipstr << ":" << dport << " "
<< "proto " << std::to_string(to_utype(proto))
<< " AS=" << p.pkth->address_space_id
- << " ID=" << get_instance_id();
+ << " ID=" << get_relative_instance_number();
if (p.is_inter_group_flow())
{
std::ostringstream oss;
oss << eh->to_string()
<< " AS=" << p.pkth->address_space_id
- << " ID=" << get_instance_id();
+ << " ID=" << get_relative_instance_number();
if (p.is_inter_group_flow())
{