From: Russ Combs <rucombs@cisco.com>
Date: Mon, 24 Nov 2014 15:37:56 +0000 (-0500)
Subject: added help for peg counts
X-Git-Tag: 3.0.0-233~1168^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=359f666f954483bb375400ec24b26bf6d0cb731d;p=thirdparty%2Fsnort3.git

added help for peg counts
---

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 06d59bfb9..3dfb1d924 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -6,6 +6,7 @@ BUILT_SOURCES = \
 builtin.txt \
 commands.txt \
 config.txt \
+counts.txt \
 gids.txt \
 help.txt \
 modules.txt \
@@ -82,6 +83,9 @@ commands.txt: $(snort)
 config.txt: $(snort)
 	$(snort) $(plugin_path) --markup --help-config | sort -k 3 > $@
 
+counts.txt: $(snort)
+	$(snort) $(plugin_path) --markup --help-counts | sort -k 2 > $@
+
 gids.txt: $(snort)
 	$(snort) $(plugin_path) --markup --list-gids | sort -n  -k 1.4 > $@
 
diff --git a/doc/reference.txt b/doc/reference.txt
index 6c5a97c05..4ead489ca 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -22,6 +22,10 @@ include::params.txt[]
 
 include::config.txt[]
 
+=== Counts
+
+include::counts.txt[]
+
 === Generators
 
 include::gids.txt[]
diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc
index e39f73bff..8e7922211 100644
--- a/src/codecs/ip/cd_icmp4.cc
+++ b/src/codecs/ip/cd_icmp4.cc
@@ -46,10 +46,10 @@
 namespace{
 
 
-const char* pegs[]
+const PegInfo pegs[]
 {
-    "bad checksum",
-    nullptr
+    { "bad checksum", "non-zero icmp checksums" },
+    { nullptr, nullptr }
 };
 
 struct Stats
@@ -98,7 +98,7 @@ public:
     const RuleMap* get_rules() const override
     { return icmp4_rules; }
 
-    const char** get_pegs() const override
+    const PegInfo* get_pegs() const override
     { return pegs; }
 
     PegCount* get_counts() const override
diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc
index 51bd3b838..4b6af3647 100644
--- a/src/codecs/ip/cd_icmp6.cc
+++ b/src/codecs/ip/cd_icmp6.cc
@@ -45,11 +45,11 @@
 namespace
 {
 
-const char* pegs[]
+const PegInfo pegs[]
 {
-    "bad checksum (ip4)",
-    "bad checksum (ip6)",
-    nullptr
+    { "bad checksum (ip4)", "nonzero ipcm4 checksums" },
+    { "bad checksum (ip6)", "nonzero ipcm6 checksums" },
+    { nullptr, nullptr }
 };
 
 struct Stats
@@ -85,7 +85,7 @@ public:
     const RuleMap* get_rules() const override
     { return icmp6_rules; }
 
-    const char** get_pegs() const override
+    const PegInfo* get_pegs() const override
     { return pegs; }
 
     PegCount* get_counts() const override
diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 882118c5c..9881909b6 100644
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -52,10 +52,10 @@
 
 namespace{
 
-const char* pegs[]
+const PegInfo pegs[]
 {
-    "bad checksum",
-    nullptr
+    { "bad checksum", "nonzero ip checksums" },
+    { nullptr, nullptr }
 };
 
 struct Stats
@@ -106,7 +106,7 @@ public:
     const RuleMap* get_rules() const override
     { return ipv4_rules; }
 
-    const char** get_pegs() const override
+    const PegInfo* get_pegs() const override
     { return pegs; }
 
     PegCount* get_counts() const override
diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index f8bd8d115..65187eac9 100644
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -50,11 +50,11 @@ using namespace tcp;
 namespace
 {
 
-const char* pegs[]
+const PegInfo pegs[]
 {
-    "bad checksum (ip4)",
-    "bad checksum (ip6)",
-    nullptr
+    { "bad checksum (ip4)", "nonzero tcp over ip checksums" },
+    { "bad checksum (ip6)", "nonzero tcp over ipv6 checksums" },
+    { nullptr, nullptr }
 };
 
 struct Stats
@@ -100,7 +100,7 @@ public:
     const RuleMap* get_rules() const override
     { return tcp_rules; }
 
-    const char** get_pegs() const override
+    const PegInfo* get_pegs() const override
     { return pegs; }
 
     PegCount* get_counts() const override
diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index f1d80ffcb..30874332a 100644
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -50,11 +50,11 @@
 namespace
 {
 
-const char* pegs[]
+const PegInfo pegs[]
 {
-    "bad checksum (ip4)",
-    "bad checksum (ip6)",
-    nullptr
+    { "bad checksum (ip4)", "nonzero udp over ipv4 checksums" },
+    { "bad checksum (ip6)", "nonzero udp over ipv6 checksums" },
+    { nullptr, nullptr }
 };
 
 struct Stats
@@ -102,7 +102,7 @@ public:
     const RuleMap* get_rules() const override
     { return udp_rules; }
 
-    const char** get_pegs() const override
+    const PegInfo* get_pegs() const override
     { return pegs; }
 
     PegCount* get_counts() const override
diff --git a/src/framework/counts.h b/src/framework/counts.h
index d52574afe..1022b6138 100644
--- a/src/framework/counts.h
+++ b/src/framework/counts.h
@@ -31,7 +31,13 @@ struct SimpleStats
     PegCount total_packets;
 };
 
-SO_PUBLIC extern const char* simple_pegs[];
+struct PegInfo
+{
+    const char* name;
+    const char* help;
+};
+
+SO_PUBLIC extern const struct PegInfo simple_pegs[];
 
 #define array_size(a) (sizeof(a)/sizeof(a[0]))
 
diff --git a/src/framework/module.cc b/src/framework/module.cc
index 940eb5a5f..b0a76091a 100644
--- a/src/framework/module.cc
+++ b/src/framework/module.cc
@@ -74,12 +74,12 @@ void Module::show_stats()
 void Module::reset_stats()
 {
     num_counts = 0;
-    const char** pegs = get_pegs();
+    const PegInfo* pegs = get_pegs();
 
     if ( !pegs )
         return;
 
-    while ( pegs[num_counts] )
+    while ( pegs[num_counts].name )
         ++num_counts;
 
     counts.resize(num_counts);
@@ -88,9 +88,9 @@ void Module::reset_stats()
         counts[i] = 0;
 }
 
-const char* simple_pegs[] =
+const PegInfo simple_pegs[] =
 {
-    "packets",
-    nullptr
+    { "packets", "total packets" },
+    { nullptr, nullptr }
 };
 
diff --git a/src/framework/module.h b/src/framework/module.h
index c65835cee..54dbe1436 100644
--- a/src/framework/module.h
+++ b/src/framework/module.h
@@ -103,7 +103,7 @@ public:
     virtual const RuleMap* get_rules() const
     { return nullptr; };
 
-    virtual const char** get_pegs() const
+    virtual const PegInfo* get_pegs() const
     { return nullptr; };
 
     // counts and profile are thread local
diff --git a/src/main/help.cc b/src/main/help.cc
index 01dc26111..994a607ab 100644
--- a/src/main/help.cc
+++ b/src/main/help.cc
@@ -55,6 +55,7 @@ using namespace std;
 "--help this overview of help\n" \
 "--help-commands [<module prefix>] output matching commands\n" \
 "--help-config [<module prefix>] output matching config options\n" \
+"--help-counts [<module prefix>] output matching peg counts\n" \
 "--help-module <module> output description of given module\n" \
 "--help-modules list all available modules with brief help\n" \
 "--help-plugins list all available plugins with brief help\n" \
@@ -140,7 +141,7 @@ void help_signals(SnortConfig*, const char*)
 enum HelpType {
     HT_CFG, HT_CMD, HT_GID, HT_IPS, HT_MOD,
     HT_BUF, HT_LST, HT_PLG, HT_DDR, HT_DBR,
-    HT_HMO, HT_HPL, HT_DFL
+    HT_HMO, HT_HPL, HT_DFL, HT_PEG
 };
 
 static void show_help(SnortConfig* sc, const char* val, HelpType ht)
@@ -191,6 +192,9 @@ static void show_help(SnortConfig* sc, const char* val, HelpType ht)
     case HT_DFL:
         ModuleManager::dump_defaults(val);
         break;
+    case HT_PEG:
+        ModuleManager::show_pegs(val);
+        break;
     }
     ModuleManager::term();
     PluginManager::release_plugins();
@@ -268,6 +272,11 @@ void dump_dynamic_rules(SnortConfig* sc, const char* val)
     show_help(sc, val, HT_DDR);
 }
 
+void help_counts(SnortConfig* sc, const char* val)
+{
+    show_help(sc, val, HT_PEG);
+}
+
 void dump_rule_hex(SnortConfig*, const char* val)
 {
     SoManager::rule_to_hex(val);
diff --git a/src/main/help.h b/src/main/help.h
index 46686c7f9..51d49efb7 100644
--- a/src/main/help.h
+++ b/src/main/help.h
@@ -39,6 +39,7 @@ void help_module(SnortConfig* sc, const char*);
 void help_modules(SnortConfig* sc, const char*);
 void help_plugins(SnortConfig* sc, const char*);
 void help_version(SnortConfig*, const char*);
+void help_counts(SnortConfig* sc, const char*);
 
 void list_modules(SnortConfig* sc, const char*);
 void list_plugins(SnortConfig* sc, const char*);
diff --git a/src/main/modules.cc b/src/main/modules.cc
index 2dca62049..92390618c 100644
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -56,6 +56,7 @@ using namespace std;
 #include "filters/sfthreshold.h"
 #include "sfip/sf_ip.h"
 #include "main/thread.h"
+#include "utils/stats.h"
 
 #if defined(DEBUG_MSGS) || defined (REG_TEST)
 #include "file_api/file_api.h"
@@ -90,6 +91,7 @@ class DetectionModule : public Module
 public:
     DetectionModule() : Module("detection", detection_help, detection_params) { };
     bool set(const char*, Value&, SnortConfig*) override;
+    const PegInfo* get_pegs() const override { return pc_names; };
 };
 
 bool DetectionModule::set(const char*, Value& v, SnortConfig* sc)
@@ -921,6 +923,7 @@ class DaqModule : public Module
 public:
     DaqModule() : Module("daq", daq_help, daq_params) { };
     bool set(const char*, Value&, SnortConfig*) override;
+    const PegInfo* get_pegs() const override { return daq_names; };
 };
 
 bool DaqModule::set(const char*, Value& v, SnortConfig* sc)
diff --git a/src/main/snort.cc b/src/main/snort.cc
index 5c40d5950..fd8292e1b 100644
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -733,7 +733,7 @@ DAQ_Verdict ProcessPacket(
 DAQ_Verdict fail_open(
     void*, const DAQ_PktHdr_t*, const uint8_t*)
 {
-    pc.total_fail_open++;
+    aux_counts.total_fail_open++;
     return DAQ_VERDICT_PASS;
 }
 
@@ -851,7 +851,7 @@ void snort_thread_idle()
 {
     if ( flow_con )
         flow_con->timeout_flows(16384, time(NULL));
-    pc.idle++;
+    aux_counts.idle++;
 }
 
 void snort_thread_rotate()
diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc
index d9e39594a..9afd28455 100644
--- a/src/main/snort_module.cc
+++ b/src/main/snort_module.cc
@@ -44,6 +44,7 @@ using namespace std;
 #include "parser/parser.h"
 #include "parser/vars.h"
 #include "packet_io/trough.h"
+#include "utils/stats.h"
 
 #ifdef UNIT_TEST
 #include "test/unit_test.h"
@@ -281,6 +282,9 @@ static const Parameter s_params[] =
     { "--help-config", Parameter::PT_STRING, "(optional)", nullptr,
       "[<module prefix>] output matching config options" },
 
+    { "--help-counts", Parameter::PT_STRING, "(optional)", nullptr,
+      "[<module prefix>] output matching peg counts" },
+
     { "--help-module", Parameter::PT_STRING, nullptr, nullptr,
       "<module> output description of given module" },
 
@@ -460,6 +464,7 @@ public:
 #endif
 
     bool set(const char*, Value&, SnortConfig*) override;
+    const PegInfo* get_pegs() const override { return proc_names; };
 };
 
 bool SnortModule::set(const char*, Value& v, SnortConfig* sc)
@@ -647,6 +652,9 @@ bool SnortModule::set(const char*, Value& v, SnortConfig* sc)
     else if ( v.is("--help-config") )
         help_config(sc, v.get_string());
 
+    else if ( v.is("--help-counts") )
+        help_counts(sc, v.get_string());
+
     else if ( v.is("--help-module") )
         help_module(sc, v.get_string());
 
diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc
index 9173bde19..f2da52d1e 100644
--- a/src/managers/module_manager.cc
+++ b/src/managers/module_manager.cc
@@ -758,19 +758,19 @@ void ModuleManager::show_module(const char* name)
         if ( m->get_commands() )
         {
             cout << endl << "Commands: " << endl << endl;
-            show_commands(name);
+            show_commands(name, true);
         }
 
         if ( m->get_rules() )
         {
             cout << endl << "Rules: " << endl << endl;
-            show_rules(name);
+            show_rules(name, true);
         }
 
         if ( m->get_pegs() )
         {
             cout << endl << "Peg counts: " << endl << endl;
-            show_pegs(name);
+            show_pegs(name, true);
         }
         c++;
     }
@@ -778,6 +778,20 @@ void ModuleManager::show_module(const char* name)
         cout << "no match" << endl;
 }
 
+static bool selected(const Module* m, const char* pfx, bool exact)
+{
+    if ( !pfx )
+        return true;
+
+    if ( exact && strcmp(m->get_name(), pfx) )
+        return false;
+
+    else if ( !exact && strncmp(m->get_name(), pfx, strlen(pfx)) )
+        return false;
+
+    return true;
+}
+
 void ModuleManager::show_configs(const char* pfx, bool exact)
 {
     s_modules.sort(comp_mods);
@@ -788,13 +802,8 @@ void ModuleManager::show_configs(const char* pfx, bool exact)
         Module* m = p->mod;
         string s;
 
-        if ( pfx )
-        {
-            if ( exact && strcmp(m->get_name(), pfx) )
-                continue;
-            else if ( !exact && strncmp(m->get_name(), pfx, strlen(pfx)) )
-                continue;
-        }
+        if ( !selected(m, pfx, exact) )
+            continue;
 
         if ( m->is_list() )
         {
@@ -830,17 +839,16 @@ void ModuleManager::dump_defaults(const char* pfx)
     show_configs(pfx);
 }
 
-void ModuleManager::show_commands(const char* pfx)
+void ModuleManager::show_commands(const char* pfx, bool exact)
 {
     s_modules.sort(comp_mods);
-    unsigned len = pfx ? strlen(pfx) : 0;
     unsigned n = 0;
 
     for ( auto p : s_modules )
     {
         const Module* m = p->mod;
 
-        if ( pfx && strncmp(m->get_name(), pfx, len) )
+        if ( !selected(m, pfx, exact) )
             continue;
 
         const Command* c = m->get_commands();
@@ -865,10 +873,9 @@ void ModuleManager::show_commands(const char* pfx)
         cout << "no match" << endl;
 }
 
-void ModuleManager::show_gids(const char* pfx)
+void ModuleManager::show_gids(const char* pfx, bool exact)
 {
     s_modules.sort(comp_gids);
-    unsigned len = pfx ? strlen(pfx) : 0;
     unsigned c = 0;
 
     for ( auto p : s_modules )
@@ -876,7 +883,7 @@ void ModuleManager::show_gids(const char* pfx)
         const Module* m = p->mod;
         assert(m);
 
-        if ( pfx && strncmp(m->get_name(), pfx, len) )
+        if ( !selected(m, pfx, exact) )
             continue;
 
         unsigned gid = m->get_gid();
@@ -896,10 +903,9 @@ void ModuleManager::show_gids(const char* pfx)
         cout << "no match" << endl;
 }
 
-void ModuleManager::show_pegs(const char* pfx)
+void ModuleManager::show_pegs(const char* pfx, bool exact)
 {
     s_modules.sort(comp_gids);
-    unsigned len = pfx ? strlen(pfx) : 0;
     unsigned c = 0;
 
     for ( auto p : s_modules )
@@ -907,20 +913,22 @@ void ModuleManager::show_pegs(const char* pfx)
         const Module* m = p->mod;
         assert(m);
 
-        if ( pfx && strncmp(m->get_name(), pfx, len) )
+        if ( !selected(m, pfx, exact) )
             continue;
 
-        const char** pegs = m->get_pegs();
+        const PegInfo* pegs = m->get_pegs();
 
         if ( !pegs )
             continue;
 
-        while ( *pegs )
+        while ( pegs->name )
         {
             cout << Markup::item();
             cout << Markup::emphasis_on();
-            cout << Markup::escape(*pegs);
+            cout << Markup::escape(p->mod->get_name());
+            cout << "." << Markup::escape(pegs->name);
             cout << Markup::emphasis_off();
+            cout << ": " << Markup::escape(pegs->help);
             cout << endl;
             ++pegs;
         }
@@ -930,17 +938,16 @@ void ModuleManager::show_pegs(const char* pfx)
         cout << "no match" << endl;
 }
 
-void ModuleManager::show_rules(const char* pfx)
+void ModuleManager::show_rules(const char* pfx, bool exact)
 {
     s_modules.sort(comp_gids);
-    unsigned len = pfx ? strlen(pfx) : 0;
     unsigned c = 0;
 
     for ( auto p : s_modules )
     {
         const Module* m = p->mod;
 
-        if ( pfx && strncmp(m->get_name(), pfx, len) )
+        if ( !selected(m, pfx, exact) )
             continue;
 
         const RuleMap* r = m->get_rules();
@@ -1062,10 +1069,13 @@ void ModuleManager::dump_rules(const char* pfx)
         cout << "no match" << endl;
 }
 
-void ModuleManager::dump_stats (SnortConfig*)
+void ModuleManager::dump_stats (SnortConfig*, const char* skip)
 {
     for ( auto p : s_modules )
-        p->mod->show_stats();
+    {
+        if ( !skip || !strstr(skip, p->mod->get_name()) )
+            p->mod->show_stats();
+    }
 }
 
 void ModuleManager::accumulate (SnortConfig*)
diff --git a/src/managers/module_manager.h b/src/managers/module_manager.h
index f3e813e0a..5800ea324 100644
--- a/src/managers/module_manager.h
+++ b/src/managers/module_manager.h
@@ -40,13 +40,13 @@ public:
     static void list_modules(const char* = nullptr);
     static void dump_modules();
     static void show_modules();
-
     static void show_module(const char*);
+
     static void show_configs(const char* = nullptr, bool exact = false);
-    static void show_commands(const char* = nullptr);
-    static void show_gids(const char* = nullptr);
-    static void show_pegs(const char* = nullptr);
-    static void show_rules(const char* = nullptr);
+    static void show_commands(const char* = nullptr, bool exact = false);
+    static void show_gids(const char* = nullptr, bool exact = false);
+    static void show_pegs(const char* = nullptr, bool exact = false);
+    static void show_rules(const char* = nullptr, bool exact = false);
 
     static void dump_rules(const char* = nullptr);
     static void dump_defaults(const char* = nullptr);
@@ -58,7 +58,7 @@ public:
     static void reset_errors();
     static unsigned get_errors();
 
-    static void dump_stats(SnortConfig*);
+    static void dump_stats(SnortConfig*, const char* skip = nullptr);
     static void accumulate(SnortConfig*);
     static void reset_stats(SnortConfig*);
 };
diff --git a/src/network_inspectors/arp_spoof/arp_module.cc b/src/network_inspectors/arp_spoof/arp_module.cc
index 8948170df..98b08f412 100644
--- a/src/network_inspectors/arp_spoof/arp_module.cc
+++ b/src/network_inspectors/arp_spoof/arp_module.cc
@@ -136,7 +136,7 @@ bool ArpSpoofModule::end(const char*, int idx, SnortConfig*)
     return true;
 }
 
-const char** ArpSpoofModule::get_pegs() const
+const PegInfo* ArpSpoofModule::get_pegs() const
 { return simple_pegs; }
 
 PegCount* ArpSpoofModule::get_counts() const
diff --git a/src/network_inspectors/arp_spoof/arp_module.h b/src/network_inspectors/arp_spoof/arp_module.h
index 014ad07e6..75ff9b2e6 100644
--- a/src/network_inspectors/arp_spoof/arp_module.h
+++ b/src/network_inspectors/arp_spoof/arp_module.h
@@ -67,7 +67,7 @@ public:
 
     ArpSpoofConfig* get_config();
 
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
 
     unsigned get_gid() const override
diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc
index fb8abc6c7..ac649dd7e 100644
--- a/src/network_inspectors/binder/bind_module.cc
+++ b/src/network_inspectors/binder/bind_module.cc
@@ -40,13 +40,13 @@ using namespace std;
 
 THREAD_LOCAL BindStats bstats;
 
-static const char* bind_pegs[] =
+static const PegInfo bind_pegs[] =
 {
-    "packets",
-    "blocks",
-    "allows",
-    "inspects",
-    nullptr
+    { "packets", "initial bindings" },
+    { "blocks", "block bindings" },
+    { "allows", "allow bindings" },
+    { "inspects", "inspect bindings" },
+    { nullptr, nullptr }
 };
 
 //-------------------------------------------------------------------------
@@ -253,7 +253,7 @@ vector<Binding*>& BinderModule::get_data()
     return bindings;  // move semantics
 }
 
-const char** BinderModule::get_pegs() const
+const PegInfo* BinderModule::get_pegs() const
 { return bind_pegs; }
 
 PegCount* BinderModule::get_counts() const
diff --git a/src/network_inspectors/binder/bind_module.h b/src/network_inspectors/binder/bind_module.h
index 582cc0160..83a735d17 100644
--- a/src/network_inspectors/binder/bind_module.h
+++ b/src/network_inspectors/binder/bind_module.h
@@ -53,7 +53,7 @@ public:
     void add(const char* service, const char* type);
     void add(unsigned proto, const char* type);
 
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 
diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc
index 2cb213da0..9b465cc62 100644
--- a/src/network_inspectors/normalize/norm.cc
+++ b/src/network_inspectors/normalize/norm.cc
@@ -61,26 +61,28 @@ typedef enum {
     PC_MAX
 } PegCounts;
 
-static const char* const pegName[PC_MAX] = {
-    "ip4.trim",
-    "ip4.tos",
-    "ip4.df",
-    "ip4.rf",
-    "ip4.ttl",
-    "ip4.opts",
-    "icmp4.echo",
-    "ip6.ttl",
-    "ip6.opts",
-    "icmp6.echo",
-    "tcp.syn_opt",
-    "tcp.ts_ecr",
-    "tcp.opt",
-    "tcp.pad",
-    "tcp.rsv",
-    "tcp.ecn_pkt",
-    "tcp.ns",
-    "tcp.urg",
-    "tcp.urp"
+const PegInfo norm_names[] =
+{
+    { "ip4.trim", "eth packets trimmed to datagram size" },
+    { "ip4.tos", "type of service normalizations" },
+    { "ip4.df", "don't frag bit normalizations" },
+    { "ip4.rf", "reserved flag bit clears" },
+    { "ip4.ttl", "time-to-live normalizations" },
+    { "ip4.opts", "ip4 options cleared" },
+    { "icmp4.echo", "icmp4 ping normalizations" },
+    { "ip6.ttl", "ip6 hop limit normalizations" },
+    { "ip6.opts", "ip6 options cleared" },
+    { "icmp6.echo", "icmp6 echo normalizations" },
+    { "tcp.syn_opt", "SYN only options cleared from non-SYN packets" },
+    { "tcp.ts_ecr", "timestamp cleared on non-ACKs" },
+    { "tcp.opt", "packetw with options cleared" },
+    { "tcp.pad", "packetw with padding cleared" },
+    { "tcp.rsv", "packets with reserved bits cleared" },
+    { "tcp.ecn_pkt", "packets with ECN bits cleared" },
+    { "tcp.ns", "packets with nonce bit cleared" },
+    { "tcp.urg", "packets with urgent flag with urgent pointer cleared" },
+    { "tcp.urp", "packets without data with urgent poniter cleared" },
+    { nullptr, nullptr }
 };
 
 static THREAD_LOCAL PegCount normStats[PC_MAX];
@@ -529,7 +531,7 @@ static int Norm_TCP (
 
 void Norm_SumStats (void)
 {
-    sum_stats((PegCount*)&gnormStats, (PegCount*)&normStats, array_size(pegName));
+    sum_stats((PegCount*)&gnormStats, (PegCount*)&normStats, array_size(norm_names));
     Stream_SumNormalizationStats();
 }
 
@@ -538,7 +540,7 @@ void Norm_SumStats (void)
 // FIXIT-L would prefer to hide this logic in the stats methods somehow
 static bool labeled()
 {
-    unsigned i = 0, max = array_size(pegName);
+    unsigned i = 0, max = array_size(norm_names);
 
     while ( i < max && !gnormStats[i] )
         ++i;
@@ -548,7 +550,7 @@ static bool labeled()
 
 void Norm_PrintStats (const char* name)
 {
-    show_stats((PegCount*)&gnormStats, pegName, array_size(pegName), name);
+    show_stats((PegCount*)&gnormStats, norm_names, array_size(norm_names), name);
 
     if ( labeled() )
         name = nullptr;
diff --git a/src/network_inspectors/normalize/norm.h b/src/network_inspectors/normalize/norm.h
index 2808c6122..ed5ddf28a 100644
--- a/src/network_inspectors/normalize/norm.h
+++ b/src/network_inspectors/normalize/norm.h
@@ -22,9 +22,9 @@
 #ifndef NORM_H
 #define NORM_H
 
-#include "snort.h"
 #include "normalize.h"
 #include "protocols/packet_manager.h"
+#include "utils/stats.h"
 
 struct NormalizerConfig;
 struct Packet;
@@ -34,6 +34,8 @@ struct Packet;
 typedef int (*NormalFunc)(  // FIXIT-L why is this exposed?
     struct NormalizerConfig*, Packet*, uint8_t layer, int changes);
 
+extern const PegInfo norm_names[];
+
 struct NormalizerConfig
 {
     uint32_t normalizer_flags;
diff --git a/src/network_inspectors/normalize/norm_module.h b/src/network_inspectors/normalize/norm_module.h
index 89ec664ba..f12c1f9ba 100644
--- a/src/network_inspectors/normalize/norm_module.h
+++ b/src/network_inspectors/normalize/norm_module.h
@@ -44,6 +44,7 @@ public:
     bool end(const char*, int, SnortConfig*) override;
 
     ProfileStats* get_profile() const override;
+    const PegInfo* get_pegs() const override { return norm_names; };
 
     const NormalizerConfig* get_config()
     { return &config; };
diff --git a/src/network_inspectors/perf_monitor/perf_module.cc b/src/network_inspectors/perf_monitor/perf_module.cc
index 89f2d0c6d..a64bebedb 100644
--- a/src/network_inspectors/perf_monitor/perf_module.cc
+++ b/src/network_inspectors/perf_monitor/perf_module.cc
@@ -178,7 +178,7 @@ void PerfMonModule::get_config(SFPERF& cfg)
     memset(&config, 0, sizeof(config));
 }
 
-const char** PerfMonModule::get_pegs() const
+const PegInfo* PerfMonModule::get_pegs() const
 { return simple_pegs; }
 
 PegCount* PerfMonModule::get_counts() const
diff --git a/src/network_inspectors/perf_monitor/perf_module.h b/src/network_inspectors/perf_monitor/perf_module.h
index 3734f7364..be93cba92 100644
--- a/src/network_inspectors/perf_monitor/perf_module.h
+++ b/src/network_inspectors/perf_monitor/perf_module.h
@@ -39,7 +39,7 @@ public:
     bool set(const char*, Value&, SnortConfig*) override;
     bool begin(const char*, int, SnortConfig*) override;
 
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 
diff --git a/src/network_inspectors/port_scan/ps_module.cc b/src/network_inspectors/port_scan/ps_module.cc
index 65e351f07..708b5deee 100644
--- a/src/network_inspectors/port_scan/ps_module.cc
+++ b/src/network_inspectors/port_scan/ps_module.cc
@@ -252,7 +252,7 @@ PsCommon* PortScanGlobalModule::get_data()
     return tmp;
 }
 
-const char** PortScanGlobalModule::get_pegs() const
+const PegInfo* PortScanGlobalModule::get_pegs() const
 { return simple_pegs; }
 
 PegCount* PortScanGlobalModule::get_counts() const
diff --git a/src/network_inspectors/port_scan/ps_module.h b/src/network_inspectors/port_scan/ps_module.h
index 8ba0fe2f2..95deb792c 100644
--- a/src/network_inspectors/port_scan/ps_module.h
+++ b/src/network_inspectors/port_scan/ps_module.h
@@ -48,7 +48,7 @@ public:
     bool set(const char*, Value&, SnortConfig*) override;
     bool begin(const char*, int, SnortConfig*) override;
 
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
     PsCommon* get_data();
diff --git a/src/service_inspectors/back_orifice/back_orifice.cc b/src/service_inspectors/back_orifice/back_orifice.cc
index 30552e53c..64bc484d3 100644
--- a/src/service_inspectors/back_orifice/back_orifice.cc
+++ b/src/service_inspectors/back_orifice/back_orifice.cc
@@ -201,12 +201,12 @@ public:
     unsigned get_gid() const override
     { return GID_BO; };
 
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 };
 
-const char** BoModule::get_pegs() const
+const PegInfo* BoModule::get_pegs() const
 { return simple_pegs; }
 
 PegCount* BoModule::get_counts() const
diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc
index 3759e6005..95a835e0b 100644
--- a/src/service_inspectors/ftp_telnet/ftp_data.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_data.cc
@@ -217,7 +217,7 @@ class FtpDataModule : public Module
 public:
     FtpDataModule() : Module(s_name, s_help) { };
 
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 
@@ -225,7 +225,7 @@ public:
     { return false; };
 };
 
-const char** FtpDataModule::get_pegs() const
+const PegInfo* FtpDataModule::get_pegs() const
 { return simple_pegs; }
 
 PegCount* FtpDataModule::get_counts() const
diff --git a/src/service_inspectors/ftp_telnet/ftp_module.cc b/src/service_inspectors/ftp_telnet/ftp_module.cc
index e6ef3e228..d77bc0423 100644
--- a/src/service_inspectors/ftp_telnet/ftp_module.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_module.cc
@@ -481,7 +481,7 @@ bool FtpServerModule::end(const char* fqn, int idx, SnortConfig*)
     return true;
 }
 
-const char** FtpServerModule::get_pegs() const
+const PegInfo* FtpServerModule::get_pegs() const
 { return simple_pegs; }
 
 PegCount* FtpServerModule::get_counts() const
diff --git a/src/service_inspectors/ftp_telnet/ftp_module.h b/src/service_inspectors/ftp_telnet/ftp_module.h
index 9f6105a39..f98ce2ef4 100644
--- a/src/service_inspectors/ftp_telnet/ftp_module.h
+++ b/src/service_inspectors/ftp_telnet/ftp_module.h
@@ -118,7 +118,7 @@ public:
     { return GID_FTP; };
 
     const RuleMap* get_rules() const override;
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 
diff --git a/src/service_inspectors/ftp_telnet/telnet_module.cc b/src/service_inspectors/ftp_telnet/telnet_module.cc
index 2ca69173c..2e7916990 100644
--- a/src/service_inspectors/ftp_telnet/telnet_module.cc
+++ b/src/service_inspectors/ftp_telnet/telnet_module.cc
@@ -118,7 +118,7 @@ bool TelnetModule::end(const char*, int, SnortConfig*)
     return true;
 }
 
-const char** TelnetModule::get_pegs() const
+const PegInfo* TelnetModule::get_pegs() const
 { return simple_pegs; }
 
 PegCount* TelnetModule::get_counts() const
diff --git a/src/service_inspectors/ftp_telnet/telnet_module.h b/src/service_inspectors/ftp_telnet/telnet_module.h
index f4e14c5e8..d37304c05 100644
--- a/src/service_inspectors/ftp_telnet/telnet_module.h
+++ b/src/service_inspectors/ftp_telnet/telnet_module.h
@@ -54,7 +54,7 @@ public:
     { return GID_TELNET; };
 
     const RuleMap* get_rules() const override;
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 
diff --git a/src/service_inspectors/http_inspect/hi_include.h b/src/service_inspectors/http_inspect/hi_include.h
index 328f299d8..7421fd0af 100644
--- a/src/service_inspectors/http_inspect/hi_include.h
+++ b/src/service_inspectors/http_inspect/hi_include.h
@@ -56,7 +56,7 @@ struct HIStats {
 };
 
 extern THREAD_LOCAL HIStats hi_stats;
-extern const char* peg_names[];
+extern const PegInfo peg_names[];
 
 #endif
 
diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/src/service_inspectors/http_inspect/hi_module.cc
index 32e2f56d3..5cdad582c 100644
--- a/src/service_inspectors/http_inspect/hi_module.cc
+++ b/src/service_inspectors/http_inspect/hi_module.cc
@@ -158,7 +158,7 @@ const RuleMap* HttpInspectModule::get_rules() const
 ProfileStats* HttpInspectModule::get_profile() const
 { return &hiPerfStats; }
 
-const char** HttpInspectModule::get_pegs() const
+const PegInfo* HttpInspectModule::get_pegs() const
 { return peg_names; }
 
 PegCount* HttpInspectModule::get_counts() const
diff --git a/src/service_inspectors/http_inspect/hi_module.h b/src/service_inspectors/http_inspect/hi_module.h
index 30588a4a2..8b2e3c25e 100644
--- a/src/service_inspectors/http_inspect/hi_module.h
+++ b/src/service_inspectors/http_inspect/hi_module.h
@@ -50,7 +50,7 @@ public:
     { return GID_HTTP_CLIENT; };
 
     const RuleMap* get_rules() const override;
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 
diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc
index c29bab8af..86e31a51a 100644
--- a/src/service_inspectors/http_inspect/http_inspect.cc
+++ b/src/service_inspectors/http_inspect/http_inspect.cc
@@ -83,29 +83,30 @@ int valid_lookup[256];
 THREAD_LOCAL ProfileStats hiPerfStats;
 THREAD_LOCAL ProfileStats hiDetectPerfStats;
 
-const char* peg_names[] =
+const PegInfo peg_names[] =
 {
-    "packets",
-    "gets",
-    "posts",
-
-    "request headers",
-    "response headers",
-    "request cookies",
-    "response cookies",
-    "post params",
-
-    "unicode",
-    "double unicode",
-    "non-ascii",
-    "paths with ../",
-    "paths with //",
-    "paths with ./",
-
-    "gzip packets",
-    "compressed bytes",
-    "decompressed bytes",
-    nullptr,
+    { "packets", "total packets processed" },
+    { "gets", "GET requests" },
+    { "posts", "POST requests" },
+
+    { "request headers", "total requests" },
+    { "response headers", "total responses" },
+    { "request cookies", "requests with Cookie" },
+    { "response cookies", "responses with Set-Cookie" },
+    { "post params", "POST parameters extracted" },
+
+    { "unicode", "unicode normalizations" },
+    { "double unicode", "double unicode normalizations" },
+    { "non-ascii", "non-ascii normalizations" },
+    { "paths with ../", "directory traversal normalizations" },
+    { "paths with //", "double slash normalizations" },
+    { "paths with ./", "relative directory normalizations" },
+
+    { "gzip packets", "packets with gzip compression" },
+    { "compressed bytes", "total comparessed bytes processed" },
+    { "decompressed bytes", "total bytes decompressed" },
+
+    { nullptr, nullptr }
 };
 
 THREAD_LOCAL int hiDetectCalled = 0;
diff --git a/src/service_inspectors/rpc_decode/rpc_module.cc b/src/service_inspectors/rpc_decode/rpc_module.cc
index b86b03843..7851f0016 100644
--- a/src/service_inspectors/rpc_decode/rpc_module.cc
+++ b/src/service_inspectors/rpc_decode/rpc_module.cc
@@ -62,7 +62,7 @@ RpcDecodeModule::RpcDecodeModule() : Module(s_name, s_help, s_params)
 const RuleMap* RpcDecodeModule::get_rules() const
 { return rpc_rules; }
 
-const char** RpcDecodeModule::get_pegs() const
+const PegInfo* RpcDecodeModule::get_pegs() const
 { return simple_pegs; }
 
 PegCount* RpcDecodeModule::get_counts() const
diff --git a/src/service_inspectors/rpc_decode/rpc_module.h b/src/service_inspectors/rpc_decode/rpc_module.h
index 505b4d69f..e373bb79b 100644
--- a/src/service_inspectors/rpc_decode/rpc_module.h
+++ b/src/service_inspectors/rpc_decode/rpc_module.h
@@ -49,7 +49,7 @@ public:
     { return GID_RPC_DECODE; };
 
     const RuleMap* get_rules() const override;
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 };
diff --git a/src/service_inspectors/wizard/wiz_module.cc b/src/service_inspectors/wizard/wiz_module.cc
index 73c4e8ebf..5b4c940c7 100644
--- a/src/service_inspectors/wizard/wiz_module.cc
+++ b/src/service_inspectors/wizard/wiz_module.cc
@@ -239,7 +239,7 @@ MagicBook* WizardModule::get_book(bool c2s, bool hex)
     return b;
 }
 
-const char** WizardModule::get_pegs() const
+const PegInfo* WizardModule::get_pegs() const
 { return wiz_pegs; }
 
 PegCount* WizardModule::get_counts() const
diff --git a/src/service_inspectors/wizard/wiz_module.h b/src/service_inspectors/wizard/wiz_module.h
index b30376b42..6374b39fd 100644
--- a/src/service_inspectors/wizard/wiz_module.h
+++ b/src/service_inspectors/wizard/wiz_module.h
@@ -30,7 +30,7 @@
 #define WIZ_NAME "wizard"
 #define WIZ_HELP "inspector that implements port-independent protocol identification"
 
-extern const char* wiz_pegs[];
+extern const PegInfo wiz_pegs[];
 extern THREAD_LOCAL struct WizStats tstats;
 extern THREAD_LOCAL ProfileStats wizPerfStats;
 
@@ -46,7 +46,7 @@ public:
     bool begin(const char*, int, SnortConfig*) override;
     bool end(const char*, int, SnortConfig*) override;
 
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
 
diff --git a/src/service_inspectors/wizard/wizard.cc b/src/service_inspectors/wizard/wizard.cc
index feec5237c..0a060e3d3 100644
--- a/src/service_inspectors/wizard/wizard.cc
+++ b/src/service_inspectors/wizard/wizard.cc
@@ -46,13 +46,13 @@ struct WizStats
     PegCount udp_hits;
 };
 
-const char* wiz_pegs[] =
+const PegInfo wiz_pegs[] =
 {
-    "tcp scans",
-    "tcp hits",
-    "udp scans",
-    "udp hits",
-    nullptr
+    { "tcp scans", "tcp payload scans" },
+    { "tcp hits", "tcp identifications" },
+    { "udp scans", "udp payload scans" },
+    { "udp hits", "udp identifications" },
+    { nullptr, nullptr }
 };
 
 THREAD_LOCAL WizStats tstats;
diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc
index c51f75911..6bb72dcc9 100644
--- a/src/stream/base/stream_base.cc
+++ b/src/stream/base/stream_base.cc
@@ -45,20 +45,6 @@
 THREAD_LOCAL ProfileStats s5PerfStats;
 THREAD_LOCAL FlowControl* flow_con = nullptr;
 
-const char* session_pegs[] =
-{
-    "sessions",
-    "prunes",
-    "timeouts",
-    "created",
-    "released",
-    "discards",
-    "events",
-    nullptr
-};
-
-const unsigned session_peg_count = array_size(session_pegs);
-
 struct BaseStats
 {
     PegCount tcp_flows;
@@ -77,16 +63,17 @@ struct BaseStats
 static BaseStats g_stats;
 static THREAD_LOCAL BaseStats t_stats;
 
-static const char* const base_pegs[] =
+const PegInfo base_pegs[] =
 {
-    "tcp flows",
-    "tcp prunes",
-    "udp flows",
-    "udp prunes",
-    "icmp flows",
-    "icmp prunes",
-    "ip flows",
-    "ip prunes"
+    { "tcp flows", "total tcp sessions" },
+    { "tcp prunes", "tcp sessions pruned" },
+    { "udp flows", "total udp sessions" },
+    { "udp prunes", "udp sessions pruned" },
+    { "icmp flows", "total icmp sessions" },
+    { "icmp prunes", "icmp sessions pruned" },
+    { "ip flows", "total ip sessions" },
+    { "ip prunes", "ip sessions pruned" },
+    { nullptr, nullptr }
 };
 
 void base_sum()
@@ -107,13 +94,12 @@ void base_sum()
     t_stats.ip_prunes = flow_con->get_prunes(IPPROTO_IP);
 
     sum_stats((PegCount*)&g_stats, (PegCount*)&t_stats,
-        array_size(base_pegs));
+        array_size(base_pegs)-1);
 }   
     
 void base_stats()
 {   
-    show_stats((PegCount*)&g_stats, base_pegs, array_size(base_pegs),
-        MOD_NAME);
+    show_stats((PegCount*)&g_stats, base_pegs, array_size(base_pegs)-1, MOD_NAME);
 }
 
 void base_reset()
diff --git a/src/stream/base/stream_module.cc b/src/stream/base/stream_module.cc
index 9fbddcc67..02810e99e 100644
--- a/src/stream/base/stream_module.cc
+++ b/src/stream/base/stream_module.cc
@@ -82,6 +82,9 @@ StreamModule::StreamModule() :
     proto = &stream_cfg.ip_cfg;
 }
 
+const PegInfo* StreamModule::get_pegs() const
+{ return base_pegs; }
+
 ProfileStats* StreamModule::get_profile() const
 { return &s5PerfStats; }
 
diff --git a/src/stream/base/stream_module.h b/src/stream/base/stream_module.h
index 489832ad1..f3f675f00 100644
--- a/src/stream/base/stream_module.h
+++ b/src/stream/base/stream_module.h
@@ -52,6 +52,7 @@ public:
     bool set(const char*, Value&, SnortConfig*) override;
     bool begin(const char*, int, SnortConfig*) override;
 
+    const PegInfo* get_pegs() const override;
     ProfileStats* get_profile() const override;
     const StreamConfig* get_data();
 
diff --git a/src/stream/icmp/icmp_module.cc b/src/stream/icmp/icmp_module.cc
index 94745c892..5868a10dd 100644
--- a/src/stream/icmp/icmp_module.cc
+++ b/src/stream/icmp/icmp_module.cc
@@ -79,8 +79,8 @@ bool StreamIcmpModule::end(const char*, int, SnortConfig*)
     return true;
 }
 
-const char** StreamIcmpModule::get_pegs() const
-{ return session_pegs; }
+const PegInfo* StreamIcmpModule::get_pegs() const
+{ return icmp_pegs; }
 
 PegCount* StreamIcmpModule::get_counts() const
 { return (PegCount*)&icmpStats; }
diff --git a/src/stream/icmp/icmp_module.h b/src/stream/icmp/icmp_module.h
index 87e7aa6b3..3edf3f407 100644
--- a/src/stream/icmp/icmp_module.h
+++ b/src/stream/icmp/icmp_module.h
@@ -27,7 +27,8 @@
 #include "main/thread.h"
 #include "stream/stream.h"
 
-extern THREAD_LOCAL SessionStats icmpStats;
+extern const PegInfo icmp_pegs[];
+extern THREAD_LOCAL struct IcmpStats icmpStats;
 extern THREAD_LOCAL ProfileStats icmp_perf_stats;
 
 struct SnortConfig;
@@ -50,7 +51,7 @@ public:
     bool end(const char*, int, SnortConfig*) override;
 
     ProfileStats* get_profile() const override;
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
 
     StreamIcmpConfig* get_data();
diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc
index ac7cff823..0b9a2edb6 100644
--- a/src/stream/icmp/icmp_session.cc
+++ b/src/stream/icmp/icmp_session.cc
@@ -48,7 +48,20 @@
 #include "protocols/tcp.h"
 #include "sfip/sf_ip.h"
 
-THREAD_LOCAL SessionStats icmpStats;
+struct IcmpStats
+{
+    PegCount created;
+    PegCount released;
+};
+
+const PegInfo icmp_pegs[] =
+{
+    { "created", "icmp session trackers created" },
+    { "released", "icmp session trackers released" },
+    { nullptr, nullptr }
+};
+
+THREAD_LOCAL IcmpStats icmpStats;
 THREAD_LOCAL ProfileStats icmp_perf_stats;
 
 //------------------------------------------------------------------------
diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index e33abdbeb..0dcf38541 100644
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -154,7 +154,7 @@ struct Fragment
 };
 
 /* statistics tracking struct */
-struct FragStats
+struct IpStats
 {
     PegCount  total;
     PegCount  reassembles;
@@ -169,24 +169,23 @@ struct FragStats
     PegCount  trackers_released;
     PegCount  nodes_created;
     PegCount  nodes_released;
-
 };
 
-static const char* const peg_names[] =
+const PegInfo ip_pegs[] =
 {
-    "fragments",
-    "reassembled",
-    "discards",
-    "memory faults",
-    "frag timeouts",
-    "overlaps",
-    "anomalies",
-    "alerts",
-    "drops",
-    "trackers added",
-    "trackers freed",
-    "nodes inserted",
-    "nodes deleted"
+    { "fragments", "total fragments" },
+    { "reassembled", "reassembled datagrams" },
+    { "discards", "fragments discarded" },
+    { "memory faults", "memory faults" },
+    { "frag timeouts", "datagrams abandoned" },
+    { "overlaps", "overlapping fragments" },
+    { "anomalies", "anomalies detected" },
+    { "alerts", "alerts generated" },
+    { "drops", "fragments dropped" },
+    { "trackers added", "datagram trackers created" },
+    { "trackers freed", "datagram trackers released" },
+    { "nodes inserted", "fragments added to tracker" },
+    { "nodes deleted", "fragments deleted from tracker" },
 };
 
 /*  G L O B A L S  **************************************************/
@@ -194,8 +193,7 @@ static const char* const peg_names[] =
 // FIXIT-M convert to session memcap
 static THREAD_LOCAL unsigned long mem_in_use = 0; /* memory in use, used for self pres */
 
-static THREAD_LOCAL FragStats t_stats;
-static FragStats g_stats;
+THREAD_LOCAL IpStats ip_stats;
 
 static THREAD_LOCAL uint32_t pkt_snaplen = 0;
 static THREAD_LOCAL Packet** defrag_pkts;  // An array of Packet pointers
@@ -268,7 +266,7 @@ static void FragPrintEngineConfig(FragEngine* engine)
 static inline void EventAnomIpOpts(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_IPOPTIONS);
-    t_stats.alerts++;
+    ip_stats.alerts++;
 }
 
 /**
@@ -281,7 +279,7 @@ static inline void EventAnomIpOpts(FragEngine*)
 static inline void EventAttackTeardrop(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_TEARDROP);
-    t_stats.alerts++;
+    ip_stats.alerts++;
 }
 
 /**
@@ -294,7 +292,7 @@ static inline void EventAttackTeardrop(FragEngine*)
 static inline void EventTinyFragments(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_TINY_FRAGMENT);
-    t_stats.alerts++;
+    ip_stats.alerts++;
 }
 
 /**
@@ -307,7 +305,7 @@ static inline void EventTinyFragments(FragEngine*)
 static inline void EventExcessiveOverlap(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_EXCESSIVE_OVERLAP);
-    t_stats.alerts++;
+    ip_stats.alerts++;
 }
 
 /**
@@ -321,8 +319,8 @@ static inline void EventExcessiveOverlap(FragEngine*)
 static inline void EventAnomShortFrag(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_SHORT_FRAG);
-    t_stats.alerts++;
-    t_stats.anomalies++;
+    ip_stats.alerts++;
+    ip_stats.anomalies++;
 }
 
 /**
@@ -336,8 +334,8 @@ static inline void EventAnomShortFrag(FragEngine*)
 static inline void EventAnomOversize(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_OVERSIZE);
-    t_stats.alerts++;
-    t_stats.anomalies++;
+    ip_stats.alerts++;
+    ip_stats.anomalies++;
 }
 
 /**
@@ -351,8 +349,8 @@ static inline void EventAnomOversize(FragEngine*)
 static inline void EventAnomZeroFrag(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_ZERO);
-    t_stats.alerts++;
-    t_stats.anomalies++;
+    ip_stats.alerts++;
+    ip_stats.anomalies++;
 }
 
 /**
@@ -365,8 +363,8 @@ static inline void EventAnomZeroFrag(FragEngine*)
 static inline void EventAnomBadsizeLg(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_BADSIZE_LG);
-    t_stats.alerts++;
-    t_stats.anomalies++;
+    ip_stats.alerts++;
+    ip_stats.anomalies++;
 }
 
 /**
@@ -379,8 +377,8 @@ static inline void EventAnomBadsizeLg(FragEngine*)
 static inline void EventAnomBadsizeSm(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_BADSIZE_SM);
-    t_stats.alerts++;
-    t_stats.anomalies++;
+    ip_stats.alerts++;
+    ip_stats.anomalies++;
 }
 
 /**
@@ -393,8 +391,8 @@ static inline void EventAnomBadsizeSm(FragEngine*)
 static inline void EventAnomOverlap(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_OVLP);
-    t_stats.alerts++;
-    t_stats.anomalies++;
+    ip_stats.alerts++;
+    ip_stats.anomalies++;
 }
 
 /**
@@ -407,7 +405,7 @@ static inline void EventAnomOverlap(FragEngine*)
 static inline void EventAnomScMinTTL(FragEngine*)
 {
     SnortEventqAdd(GID_DEFRAG, DEFRAG_MIN_TTL_EVASION);
-    t_stats.alerts++;
+    ip_stats.alerts++;
 }
 
 #if 0
@@ -982,7 +980,7 @@ static void FragRebuild(FragTracker *ft, Packet *p)
     DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
                 "Processing rebuilt packet:\n"););
 
-    t_stats.reassembles++;
+    ip_stats.reassembles++;
 
     UpdateIPReassStats(&sfBase, dpkt->pkth->caplen);
 
@@ -1068,7 +1066,7 @@ static void delete_frag(Fragment *frag)
         sfBase.frag3_mem_in_use = mem_in_use;
     }
 
-    t_stats.nodes_released++;
+    ip_stats.nodes_released++;
 }
 
 /**
@@ -1147,7 +1145,7 @@ static void release_tracker(FragTracker* ft)
     delete_tracker(ft);
     ft->engine = nullptr;
 
-    t_stats.trackers_released++;
+    ip_stats.trackers_released++;
 }
 
 //-------------------------------------------------------------------------
@@ -1260,11 +1258,11 @@ void Defrag::process(Packet* p, FragTracker* ft)
 #endif
 
         EventAnomScMinTTL(fe);
-        t_stats.discards++;
+        ip_stats.discards++;
         return;
     }
 
-    t_stats.total++;
+    ip_stats.total++;
     UpdateIPFragStats(&sfBase, p->pkth->caplen);
 
     MODULE_PROFILE_START(fragPerfStats);
@@ -1300,7 +1298,7 @@ void Defrag::process(Packet* p, FragTracker* ft)
     {
         DisableDetect(p);
         Active_DropPacket();
-        t_stats.drops++;
+        ip_stats.drops++;
     }
 
     /*
@@ -1336,12 +1334,12 @@ void Defrag::process(Packet* p, FragTracker* ft)
                             p->dsize););
                 }
 #endif
-                t_stats.discards++;
+                ip_stats.discards++;
                 MODULE_PROFILE_END(fragPerfStats);
                 return;
             case FRAG_INSERT_ATTACK:
             case FRAG_INSERT_ANOMALY:
-                t_stats.discards++;
+                ip_stats.discards++;
                 MODULE_PROFILE_END(fragPerfStats);
                 return;
             case FRAG_INSERT_TIMEOUT:
@@ -1358,7 +1356,7 @@ void Defrag::process(Packet* p, FragTracker* ft)
                            (p->ptrs.decode_flags & DECODE_MF),
                            (frag_offset << 3), p->dsize);
 #endif
-                t_stats.discards++;
+                ip_stats.discards++;
                 MODULE_PROFILE_END(fragPerfStats);
                 return;
             default:
@@ -1639,7 +1637,7 @@ int Defrag::insert(Packet *p, FragTracker *ft, FragEngine *fe)
 
         if(overlap > 0)
         {
-            t_stats.overlaps++;
+            ip_stats.overlaps++;
             ft->overlap_count++;
 
             if(frag_end < ft->calculated_size ||
@@ -1849,7 +1847,7 @@ left_overlap_last:
          */
         if(overlap < right->size)
         {
-            t_stats.overlaps++;
+            ip_stats.overlaps++;
             ft->overlap_count++;
 
             DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
@@ -1932,7 +1930,7 @@ left_overlap_last:
                  */
                 EventAnomOverlap(fe);
                 alerted_overlap = 1;
-                t_stats.overlaps++;
+                ip_stats.overlaps++;
                 ft->overlap_count++;
             }
 
@@ -2020,7 +2018,7 @@ left_overlap_last:
                                     "zero size frag (len: %d  overlap: %d)\n",
                                     fragLength, overlap););
 
-                        t_stats.discards++;
+                        ip_stats.discards++;
 
                         MODULE_PROFILE_END(fragInsertPerfStats);
                         return FRAG_INSERT_ANOMALY;
@@ -2239,7 +2237,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
         sfBase.frag3_mem_in_use = mem_in_use;
     }
 
-    t_stats.nodes_created++;
+    ip_stats.nodes_created++;
     sfBase.iFragCreates++;
     sfBase.iCurrentFrags++;
     if (sfBase.iCurrentFrags > sfBase.iMaxFrags)
@@ -2303,7 +2301,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     if ( p->is_ip4() )
         FragHandleIPOptions(ft, p, frag_off);
 
-    t_stats.trackers_created++;
+    ip_stats.trackers_created++;
     return 1;
 }
 
@@ -2351,7 +2349,7 @@ int Defrag::add_frag_node(FragTracker *ft,
             "(len: %d  slide: %d  trunc: %d)\n",
             len, slide, trunc););
 
-        t_stats.discards++;
+        ip_stats.discards++;
 
 #ifdef DEBUG_MSGS
         newfrag = ft->fraglist;
@@ -2395,7 +2393,7 @@ int Defrag::add_frag_node(FragTracker *ft,
         sfBase.frag3_mem_in_use = mem_in_use;
     }
 
-    t_stats.nodes_created++;
+    ip_stats.nodes_created++;
 
     newfrag->flen = fragLength;
     memcpy(newfrag->fptr, fragStart, fragLength);
@@ -2482,7 +2480,7 @@ int Defrag::dup_frag_node(
         sfBase.frag3_mem_in_use = mem_in_use;
     }
 
-    t_stats.nodes_created++;
+    ip_stats.nodes_created++;
 
     newfrag->ord = ft->ordinal++;
     /*
@@ -2550,7 +2548,7 @@ inline int Defrag::expire(Packet*, FragTracker *ft, FragEngine *fe)
          */
         delete_tracker(ft);
 
-        t_stats.timeouts++;
+        ip_stats.timeouts++;
         sfBase.iFragTimeouts++;
 
         return FRAG_TRACKER_TIMEOUT;
@@ -2559,22 +2557,3 @@ inline int Defrag::expire(Packet*, FragTracker *ft, FragEngine *fe)
     return FRAG_OK;
 }
 
-//-------------------------------------------------------------------------
-// static methods
-//-------------------------------------------------------------------------
-
-void Defrag::sum()
-{
-    sum_stats((PegCount*)&g_stats, (PegCount*)&t_stats, array_size(peg_names));
-}
-
-void Defrag::stats()
-{
-    show_stats((PegCount*)&g_stats, peg_names, array_size(peg_names), nullptr);
-}
-
-void Defrag::reset()
-{
-    memset(&g_stats, 0, sizeof(g_stats));
-}
-
diff --git a/src/stream/ip/ip_defrag.h b/src/stream/ip/ip_defrag.h
index d973d2b64..e5a250bda 100644
--- a/src/stream/ip/ip_defrag.h
+++ b/src/stream/ip/ip_defrag.h
@@ -49,9 +49,6 @@ public:
     void tterm();
 
     static void init();
-    static void sum();
-    static void stats();
-    static void reset();
 
 private:
     int insert(Packet*, FragTracker*, FragEngine*);
diff --git a/src/stream/ip/ip_module.cc b/src/stream/ip/ip_module.cc
index 2a0af4fed..dfe302889 100644
--- a/src/stream/ip/ip_module.cc
+++ b/src/stream/ip/ip_module.cc
@@ -217,27 +217,9 @@ bool StreamIpModule::end(const char*, int, SnortConfig*)
     return true;
 }
 
-const char** StreamIpModule::get_pegs() const
-{ return session_pegs; }
+const PegInfo* StreamIpModule::get_pegs() const
+{ return ip_pegs; }
 
 PegCount* StreamIpModule::get_counts() const
-{ return (PegCount*)&ipStats; }
-
-void StreamIpModule::sum_stats()
-{
-    Module::sum_stats();
-    Defrag::sum();
-}
-
-void StreamIpModule::show_stats()
-{
-    Module::show_stats();
-    Defrag::stats();
-}
-
-void StreamIpModule::reset_stats()
-{
-    Module::reset_stats();
-    Defrag::reset();
-}
+{ return (PegCount*)&ip_stats; }
 
diff --git a/src/stream/ip/ip_module.h b/src/stream/ip/ip_module.h
index 385ceed8d..7a035f478 100644
--- a/src/stream/ip/ip_module.h
+++ b/src/stream/ip/ip_module.h
@@ -55,7 +55,8 @@ struct SnortConfig;
 #define DEFRAG_EXCESSIVE_OVERLAP  12
 #define DEFRAG_TINY_FRAGMENT      13
 
-extern THREAD_LOCAL SessionStats ipStats;
+extern const PegInfo ip_pegs[];
+extern THREAD_LOCAL struct IpStats ip_stats;
 extern THREAD_LOCAL ProfileStats ip_perf_stats;
 extern THREAD_LOCAL ProfileStats fragPerfStats;
 extern THREAD_LOCAL ProfileStats fragInsertPerfStats;
@@ -82,17 +83,13 @@ public:
 
     const RuleMap* get_rules() const override;
     ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     StreamIpConfig* get_data();
 
     unsigned get_gid() const override
     { return GID_DEFRAG; };
 
-    void sum_stats() override;
-    void show_stats() override;
-    void reset_stats() override;
-
 private:
     StreamIpConfig* config;
 };
diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc
index 982268c93..d8e91a759 100644
--- a/src/stream/ip/ip_session.cc
+++ b/src/stream/ip/ip_session.cc
@@ -34,7 +34,6 @@
 #include "flow/flow_control.h"
 #include "sfip/sf_ip.h"
 
-THREAD_LOCAL SessionStats ipStats;
 THREAD_LOCAL ProfileStats ip_perf_stats;
 
 //-------------------------------------------------------------------------
@@ -129,7 +128,7 @@ bool IpSession::setup (Packet* p)
         "Stream IP session created!\n"););
 
     memset(&tracker, 0, sizeof(tracker));
-    ipStats.sessions++;
+    // FIXIT count ip session creates here
 
     sfip_copy(flow->client_ip, p->ptrs.ip_api.get_src());
     sfip_copy(flow->server_ip, p->ptrs.ip_api.get_dst());
@@ -152,7 +151,7 @@ int IpSession::process(Packet* p)
     if ( stream.expired_session(flow, p) )
     {
         IpSessionCleanup(flow, &tracker);
-        ipStats.timeouts++;
+        // FIXIT count ip sessiont imeouts here
 
 #ifdef ENABLE_EXPECTED_IP
         if ( flow_con->expected_session(flow, p))
diff --git a/src/stream/stream.h b/src/stream/stream.h
index 4b9b66687..473ee7a73 100644
--- a/src/stream/stream.h
+++ b/src/stream/stream.h
@@ -112,23 +112,10 @@ typedef struct {
 } tPortFilterStats;
 #endif
 
-struct SessionStats
-{
-    PegCount sessions;
-    PegCount prunes;
-    PegCount timeouts;
-    PegCount created;
-    PegCount released;
-    PegCount discards;
-    PegCount events;
-};
-
 // shared stream state
 extern THREAD_LOCAL Memcap* tcp_memcap;
 extern THREAD_LOCAL class FlowControl* flow_con;
-
-extern const char* session_pegs[];
-extern const unsigned session_peg_count;
+extern const PegInfo base_pegs[];
 
 void Stream_SumNormalizationStats(void);
 void Stream_PrintNormalizationStats(const char* name = nullptr);
diff --git a/src/stream/tcp/tcp_module.cc b/src/stream/tcp/tcp_module.cc
index f609987fa..fe2c969e8 100644
--- a/src/stream/tcp/tcp_module.cc
+++ b/src/stream/tcp/tcp_module.cc
@@ -332,7 +332,7 @@ bool StreamTcpModule::end(const char*, int, SnortConfig*)
     return true;
 }
 
-const char** StreamTcpModule::get_pegs() const
+const PegInfo* StreamTcpModule::get_pegs() const
 { return tcp_pegs; }
 
 PegCount* StreamTcpModule::get_counts() const
diff --git a/src/stream/tcp/tcp_module.h b/src/stream/tcp/tcp_module.h
index 3d5019a48..2221eb563 100644
--- a/src/stream/tcp/tcp_module.h
+++ b/src/stream/tcp/tcp_module.h
@@ -53,7 +53,7 @@
 #define STREAM_TCP_WINDOW_SLAM                    19
 #define STREAM_TCP_NO_3WHS                        20
 
-extern const char* tcp_pegs[];
+extern const PegInfo tcp_pegs[];
 extern THREAD_LOCAL struct TcpStats tcpStats;
 extern THREAD_LOCAL ProfileStats s5TcpPerfStats;
 extern THREAD_LOCAL ProfileStats s5TcpNewSessPerfStats;
@@ -94,7 +94,7 @@ public:
     StreamTcpConfig* get_data();
 
     ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
 
 private:
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index ca4d57d8e..e63da7558 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -128,35 +128,35 @@ struct TcpStats
     PegCount s5tcp2;
 };
 
-const char* tcp_pegs[] =
-{
-    "sessions",
-    "timeouts",
-    "resyns",
-    "discards",
-    "events",
-    "ignored",
-    "untracked",
-    "syn trackers",
-    "syn-ack trackers",
-    "3way trackers",
-    "data trackers",
-    "trackers created",
-    "trackers released",
-    "segs queued",
-    "segs released",
-    "segs split",
-    "segs used",
-    "rebuilt packets",
-    "rebuilt buffers",
-    "overlaps",
-    "gaps",
-    "max segs",
-    "max bytes",
-    "internal events",
-    "client cleanups",
-    "server cleanups",
-    nullptr
+const PegInfo tcp_pegs[] =
+{
+    { "sessions", "total sessions" },
+    { "timeouts", "sessions timed out" },
+    { "resyns", "SYN received on established session" },
+    { "discards", "tcp packets discarded" },
+    { "events", "events generated" },
+    { "ignored", "tcp packets ignored" },
+    { "untracked", "tcp packets not tracked" },
+    { "syn trackers", "tcp session tracking started on syn" },
+    { "syn-ack trackers", "tcp session tracking started on syn-ack" },
+    { "3way trackers", "tcp session tracking started on ack" },
+    { "data trackers", "tcp session tracking started on data" },
+    { "trackers created", "tcp session trackers created" },
+    { "trackers released", "tcp session trackers released" },
+    { "segs queued", "total segments queued" },
+    { "segs released", "total segments released" },
+    { "segs split", "tcp segments split when reassembling PDUs" },
+    { "segs used", "queued tcp segments applied to reassembled PDUs" },
+    { "rebuilt packets", "total reassembled PDUs" },
+    { "rebuilt buffers", "rebuilt PDU sections" },
+    { "overlaps", "overlapping segments queued" },
+    { "gaps", "missing data between PDUs" },
+    { "max segs", "number of times the maximum queued segment limit was reached" },
+    { "max bytes", "number of times the maximum queued byte limit was reached" },
+    { "internal events", "135:X events generated" },
+    { "client cleanups", "number of times data from server was flushed when session released" },
+    { "server cleanups", "number of times data from client was flushed when session released" },
+    { nullptr, nullptr }
 };
 
 THREAD_LOCAL TcpStats tcpStats;
@@ -992,12 +992,13 @@ typedef enum {
 static PegCount gnormStats[PC_MAX];
 static THREAD_LOCAL PegCount normStats[PC_MAX];
 
-static const char* const pegName[PC_MAX] = {
-    "tcp.trim",
-    "tcp.ecn_ssn",
-    "tcp.ts_nop",
-    "tcp.ips_data",
-    "tcp.block",
+static const PegInfo pegName[PC_MAX] =
+{
+    { "tcp.trim", "tcp segments trimmed to correct size" },
+    { "tcp.ecn_ssn", "ECN bits cleared" },
+    { "tcp.ts_nop", "timestamp options cleared" },
+    { "tcp.ips_data", "normalized segments" },
+    { "tcp.block", "blocked segments" },
 };
 
 void Stream_SumNormalizationStats()
diff --git a/src/stream/udp/udp_module.cc b/src/stream/udp/udp_module.cc
index ef24e165f..e75d3cbfc 100644
--- a/src/stream/udp/udp_module.cc
+++ b/src/stream/udp/udp_module.cc
@@ -87,8 +87,8 @@ bool StreamUdpModule::end(const char*, int, SnortConfig*)
     return true;
 }
 
-const char** StreamUdpModule::get_pegs() const
-{ return session_pegs; }
+const PegInfo* StreamUdpModule::get_pegs() const
+{ return udp_pegs; }
 
 PegCount* StreamUdpModule::get_counts() const
 { return (PegCount*)&udpStats; }
diff --git a/src/stream/udp/udp_module.h b/src/stream/udp/udp_module.h
index ccd403e3d..e6578b074 100644
--- a/src/stream/udp/udp_module.h
+++ b/src/stream/udp/udp_module.h
@@ -32,7 +32,8 @@
     
 struct SnortConfig;
 
-extern THREAD_LOCAL SessionStats udpStats;
+extern const PegInfo udp_pegs[];
+extern THREAD_LOCAL struct UdpStats udpStats;
 extern THREAD_LOCAL ProfileStats udp_perf_stats;
 
 //-------------------------------------------------------------------------
@@ -53,7 +54,7 @@ public:
     bool end(const char*, int, SnortConfig*) override;
 
     ProfileStats* get_profile() const override;
-    const char** get_pegs() const override;
+    const PegInfo* get_pegs() const override;
     PegCount* get_counts() const override;
     StreamUdpConfig* get_data();
 
diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc
index 12bf761cb..b7cabef9c 100644
--- a/src/stream/udp/udp_session.cc
+++ b/src/stream/udp/udp_session.cc
@@ -49,7 +49,24 @@
 // NOTE:  sender is assumed to be client
 //        responder is assumed to be server
 
-THREAD_LOCAL SessionStats udpStats;
+struct UdpStats
+{
+    PegCount sessions;
+    PegCount created;
+    PegCount released;
+    PegCount timeouts;
+};
+
+const PegInfo udp_pegs[] =
+{
+    { "sessions", "total udp sessions" },
+    { "created", "udp session trackers created" },
+    { "released", "udp session trackers released" },
+    { "timeouts", "udp session timeouts" },
+    { nullptr, nullptr }
+};
+
+THREAD_LOCAL UdpStats udpStats;
 THREAD_LOCAL ProfileStats udp_perf_stats;
 
 //-------------------------------------------------------------------------
diff --git a/src/utils/stats.cc b/src/utils/stats.cc
index 513fea5c7..09b2f0b8b 100644
--- a/src/utils/stats.cc
+++ b/src/utils/stats.cc
@@ -43,7 +43,10 @@
 
 static DAQ_Stats_t g_daq_stats;
 static PacketCount gpc;
+static AuxCount gaux;
+
 THREAD_LOCAL PacketCount pc;
+THREAD_LOCAL AuxCount aux_counts;
 ProcessCount proc_stats;
 
 //-------------------------------------------------------------------------
@@ -152,82 +155,73 @@ static void timing_stats()
 
 struct DAQStats
 {
+    PegCount pcaps;
     PegCount received;
     PegCount analyzed;
     PegCount dropped;
     PegCount filtered;
     PegCount outstanding;
     PegCount injected;
+    PegCount verdicts[MAX_DAQ_VERDICT];
 #ifdef REG_TEST
     PegCount skipped;
 #endif
-};
-
-struct DAQVerdicts
-{
-    PegCount verdicts[MAX_DAQ_VERDICT];
-    PegCount internal_blacklist;
-    PegCount internal_whitelist;
+    PegCount fail_open;
+    PegCount idle;
 };
 
 //-------------------------------------------------------------------------
+// FIXIT-L need better encapsulation of these counts by their modules
 
-static const char* const simple_names[] =
-{
-    "packets"
-};
-
-static const char* const daq_names[] =
+const PegInfo daq_names[] =
 {
-    "received",
-    "analyzed",
-    "dropped",
-    "filtered",
-    "outstanding",
-    "injected"
+    { "pcaps", "total files processed" },
+    { "received", "total packets received from DAQ" },
+    { "analyzed", "total packets analyzed from DAQ" },
+    { "dropped", "packets dropped" },
+    { "filtered", "packets filtered out" },
+    { "outstanding", "packets unprocessed" },
+    { "injected", "active responses or replacements" },
+    { "allow", "total allow verdicts" },
+    { "block", "total block verdicts" },
+    { "replace", "total replace verdicts" },
+    { "whitelist", "total whitelist verdicts" },
+    { "blacklist", "total blacklist verdicts" },
+    { "ignore", "total ignore verdicts" },
 #ifdef REG_TEST
-    , "skipped"
+    { "skipped", "packets skipped at startup" },
 #endif
+    { "fail open", "packets passed during initialization" },
+    { "idle", "attempts to acquire from DAQ without available packets" },
+    { nullptr, nullptr }
 };
 
-const char* const verdict_names[] =
+const PegInfo pc_names[] =
 {
-    "allow",
-    "block",
-    "replace",
-    "whitelist",
-    "blacklist",
-    "ignore",
-    "internal blacklist",
-    "internal whitelist"
+    { "analyzed", "packets sent to detection" },
+    { "alerts", "alerts not including IP reputation" },
+    { "total alerts", "alerts including IP reputation" },
+    { "logged", "logged packets" },
+    { "passed", "passed packets" },
+    { "match limit", "fast pattern matches not processed" },
+    { "queue limit", "events not queued because queue full" },
+    { "log limit", "events queued but not logged" },
+    { "event limit", "events filtered" },
+    { "alert limit", "events previously triggered on same PDU" },
+    { "internal blacklist", "packets blacklisted internally due to lack of DAQ support" },
+    { "internal whitelist", "packets whitelisted internally due to lack of DAQ support" },
+    { nullptr, nullptr }
 };
 
-static const char* const pc_names[] =
+const PegInfo proc_names[] =
 {
-    "analyzed",
-    "fail open",
-    "alerts",
-    "total alerts",
-    "logged",
-    "passed",
-    "match limit",
-    "queue limit",
-    "log limit",
-    "event limit",
-    "alert limit",
-    "internal blacklist",
-    "internal whitelist",
-    "idle"
-};
-
-static const char* const proc_names[] =
-{
-    "local commands",
-    "remote commands",
-    "signals",
-    "conf reloads",
-    "attribute table reloads",
-    "attribute table hosts"
+    { "local commands", "total local commands processed" },
+    { "remote commands", "total remote commands processed" },
+    { "signals", "total signals processed" },
+    { "conf reloads", "number of times configuration was reloaded" },
+    { "attribute table reloads", "number of times hosts table was reloaded" },
+    { "attribute table hosts", "total number of hosts in table" },
+    { nullptr, nullptr }
 };
 
 //-------------------------------------------------------------------------
@@ -248,67 +242,56 @@ void pc_sum()
 
     sum_stats((PegCount*)&gpc, (PegCount*)&pc, array_size(pc_names));
     memset(&pc, 0, sizeof(pc));
+
+    sum_stats((PegCount*)&gaux, (PegCount*)&aux_counts, sizeof(aux_counts)/sizeof(PegCount));
+    memset(&aux_counts, 0, sizeof(aux_counts));
 }
 
 //-------------------------------------------------------------------------
 
-void DropStats()
+static void get_daq_stats(DAQStats& daq_stats)
 {
-    const DAQ_Stats_t* pkt_stats = &g_daq_stats;
+    uint64_t pkts_recv = g_daq_stats.hw_packets_received;
+    uint64_t pkts_drop = g_daq_stats.hw_packets_dropped;
+    uint64_t pkts_inj = g_daq_stats.packets_injected + Active_GetInjects();
 
-    LogLabel("Packet Statistics");
-
-    {
-        uint64_t pkts_out, pkts_inj;
-
-        uint64_t pkts_recv = pkt_stats->hw_packets_received;
-        uint64_t pkts_drop = pkt_stats->hw_packets_dropped;
-
-        if ( pkts_recv > pkt_stats->packets_filtered
-                       + pkt_stats->packets_received )
-            pkts_out = pkts_recv - pkt_stats->packets_filtered
-                     - pkt_stats->packets_received;
-        else
-            pkts_out = 0;
-
-        pkts_inj = pkt_stats->packets_injected;
-        pkts_inj += Active_GetInjects();
-
-        DAQStats daq_stats;
-        daq_stats.received = pkts_recv;
-        daq_stats.analyzed = pkt_stats->packets_received;
-        daq_stats.dropped =  pkts_drop;
-        daq_stats.filtered =  pkt_stats->packets_filtered;
-        daq_stats.outstanding =  pkts_out;
-        daq_stats.injected =  pkts_inj;
-#ifdef REG_TEST
-        daq_stats.skipped = snort_conf->pkt_skip; 
-#endif
+    uint64_t pkts_out = 0;
 
-        if ( pkts_recv )
-            LogLabel("daq");
+    if ( pkts_recv > g_daq_stats.packets_filtered + g_daq_stats.packets_received )
+        pkts_out = pkts_recv - g_daq_stats.packets_filtered - g_daq_stats.packets_received;
 
-        PegCount pcaps = Trough_GetFileCount();
-        if ( pcaps )
-            LogCount("pcaps", pcaps);
-        show_stats((PegCount*)&daq_stats, daq_names, array_size(daq_names));
+    daq_stats.pcaps = Trough_GetFileCount();
+    daq_stats.received = pkts_recv;
+    daq_stats.analyzed = g_daq_stats.packets_received;
+    daq_stats.dropped =  pkts_drop;
+    daq_stats.filtered =  g_daq_stats.packets_filtered;
+    daq_stats.outstanding =  pkts_out;
+    daq_stats.injected =  pkts_inj;
 
-        DAQVerdicts daq_verdicts;
+    for ( unsigned i = 0; i < MAX_DAQ_VERDICT; i++ )
+        daq_stats.verdicts[i] = g_daq_stats.verdicts[i];
 
-        for ( unsigned i = 0; i < MAX_DAQ_VERDICT; i++ )
-            daq_verdicts.verdicts[i] = pkt_stats->verdicts[i];
+#ifdef REG_TEST
+    daq_stats.skipped = snort_conf->pkt_skip; 
+#endif
+    daq_stats.fail_open = gaux.total_fail_open;
+    daq_stats.idle = gaux.idle;
+}
 
-        daq_verdicts.internal_blacklist = pc.internal_blacklist;
-        daq_verdicts.internal_whitelist = pc.internal_whitelist;
+void DropStats()
+{
+    LogLabel("Packet Statistics");
 
-        show_stats((PegCount*)&daq_verdicts, verdict_names, array_size(verdict_names));
-    }
+    DAQStats daq_stats;
+    get_daq_stats(daq_stats);
+    show_stats((PegCount*)&daq_stats, daq_names, array_size(daq_names)-1, "daq");
 
     PacketManager::dump_stats();
     //mpse_print_qinfo();
 
     LogLabel("Module Statistics");
-    ModuleManager::dump_stats(snort_conf);
+    const char* exclude = "daq detection snort";
+    ModuleManager::dump_stats(snort_conf, exclude);
 
     // ensure proper counting of log_limit
     SnortEventqResetCounts();
@@ -318,13 +301,13 @@ void DropStats()
         gpc.total_alert_pkts = 0;
 
     LogLabel("Summary Statistics");
-    show_stats((PegCount*)&gpc, pc_names, array_size(pc_names), "detection");
+    show_stats((PegCount*)&gpc, pc_names, array_size(pc_names)-1, "detection");
 
 #ifdef PPM_MGR
     PPM_PRINT_SUMMARY(&snort_conf->ppm_cfg);
 #endif
     proc_stats.attribute_table_hosts = SFAT_NumberOfHosts();
-    show_stats((PegCount*)&proc_stats, proc_names, array_size(proc_names), "process");
+    show_stats((PegCount*)&proc_stats, proc_names, array_size(proc_names)-1, "process");
 }
 
 //-------------------------------------------------------------------------
@@ -364,14 +347,14 @@ void sum_stats(
 }
 
 void show_stats(
-    PegCount* pegs, const char* const names[], unsigned n, const char* module_name)
+    PegCount* pegs, const PegInfo* info, unsigned n, const char* module_name)
 {
     bool head = false;
 
     for ( unsigned i = 0; i < n; ++i )
     {
         PegCount c = pegs[i];
-        const char* s = names[i];
+        const char* s = info[i].name;
 
         if ( !c )
             continue;
@@ -387,7 +370,7 @@ void show_stats(
 }
 
 void show_percent_stats(
-    PegCount* pegs, const char* const names[], unsigned n, const char* module_name)
+    PegCount* pegs, const char* names[], unsigned n, const char* module_name)
 {
     bool head = false;
 
@@ -410,15 +393,3 @@ void show_percent_stats(
     }
 }
 
-//-------------------------------------------------------------------------
-
-void sum_stats(SimpleStats* sums, SimpleStats* counts)
-{
-    sum_stats((PegCount*)sums, (PegCount*)counts, array_size(simple_names));
-}
-
-void show_stats(SimpleStats* sums, const char* module_name)
-{
-    show_stats((PegCount*)sums, simple_names, array_size(simple_names), module_name);
-}
-
diff --git a/src/utils/stats.h b/src/utils/stats.h
index a04038e7e..09726cbd6 100644
--- a/src/utils/stats.h
+++ b/src/utils/stats.h
@@ -40,7 +40,6 @@
 struct PacketCount
 {
     PegCount total_from_daq;
-    PegCount total_fail_open;
     PegCount alert_pkts;
     PegCount total_alert_pkts;
     PegCount log_pkts;
@@ -52,7 +51,6 @@ struct PacketCount
     PegCount alert_limit;
     PegCount internal_blacklist;
     PegCount internal_whitelist;
-    PegCount idle;
 };
 
 struct ProcessCount
@@ -65,8 +63,19 @@ struct ProcessCount
     PegCount attribute_table_hosts;
 };
 
+struct AuxCount
+{
+    PegCount total_fail_open;
+    PegCount idle;
+};
+
 extern SO_PUBLIC ProcessCount proc_stats;
 extern SO_PUBLIC THREAD_LOCAL PacketCount pc;
+extern SO_PUBLIC THREAD_LOCAL AuxCount aux_counts;
+
+extern const PegInfo daq_names[];
+extern const PegInfo pc_names[];
+extern const PegInfo proc_names[];
 
 void LogLabel(const char*);
 void LogCount(const char*, uint64_t);
@@ -74,9 +83,9 @@ void LogStat(const char*, uint64_t n, uint64_t tot);
 void LogStat(const char*, double);
 
 void sum_stats(PegCount* sums, PegCount* counts, unsigned n);
-void show_stats(PegCount*, const char* const names[], unsigned n,
+void show_stats(PegCount*, const PegInfo*, unsigned n,
     const char* module_name = nullptr);
-void show_percent_stats(PegCount*, const char* const names[], unsigned n,
+void show_percent_stats(PegCount*, const char*[], unsigned n,
     const char* module_name = nullptr);
 
 void sum_stats(SimpleStats* sums, SimpleStats* counts);
diff --git a/src/utils/util.cc b/src/utils/util.cc
index bfea29a76..ef5b4e4e8 100644
--- a/src/utils/util.cc
+++ b/src/utils/util.cc
@@ -42,6 +42,7 @@
 #include <limits.h>
 #include <fcntl.h>
 #include <zlib.h>
+#include <luajit-2.0/luajit.h>
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -98,17 +99,14 @@ void StoreSnortInfoStrings( void )
  ****************************************************************************/
 int DisplayBanner(void)
 {
-    const char * info;
-    const char * pcre_ver;
-    const char * zlib_ver;
-
-    info = getenv("HOSTTYPE");
+    const char* info = getenv("HOSTTYPE");
 
     if( !info )
         info="from 2.9.6-9";  // last sync with head
 
-    pcre_ver = pcre_version();
-    zlib_ver = zlib_version;
+    const char* ljv = LUAJIT_VERSION;
+    while ( *ljv && !isdigit(*ljv) )
+        ++ljv;
 
     LogMessage("\n");
     LogMessage("   ,,_     -*> Snort++ <*-\n");
@@ -121,8 +119,9 @@ int DisplayBanner(void)
 #ifdef HAVE_PCAP_LIB_VERSION
     LogMessage("           Using %s\n", pcap_lib_version());
 #endif
-    LogMessage("           Using PCRE version: %s\n", pcre_ver);
-    LogMessage("           Using ZLIB version: %s\n", zlib_ver);
+    LogMessage("           Using LuaJIT version %s\n", ljv);
+    LogMessage("           Using PCRE version %s\n", pcre_version());
+    LogMessage("           Using ZLIB version %s\n", zlib_version);
     LogMessage("\n");
 
     return 0;