From: Carter Waxman <cwaxman@cisco.com>
Date: Thu, 21 Apr 2016 17:05:46 +0000 (-0400)
Subject: added peg counts
X-Git-Tag: 3.0.0-233~431^2~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3dc5fa36f428ea5cf3b276c1243b21ce675c516b;p=thirdparty%2Fsnort3.git

added peg counts
---

diff --git a/src/network_inspectors/packet_capture/capture_module.cc b/src/network_inspectors/packet_capture/capture_module.cc
index 66f0d5bc7..0c1eb3a03 100644
--- a/src/network_inspectors/packet_capture/capture_module.cc
+++ b/src/network_inspectors/packet_capture/capture_module.cc
@@ -23,7 +23,14 @@
 #include "profiler/profiler.h"
 #include "utils/util.h"
 
-THREAD_LOCAL SimpleStats cap_count_stats;
+const PegInfo cap_names[] =
+{
+    { "processed", "packets processed against filter" },
+    { "captured", "packets matching dumped after matching filter" },
+    { nullptr, nullptr }
+};
+
+THREAD_LOCAL CaptureStats cap_count_stats;
 THREAD_LOCAL ProfileStats cap_prof_stats;
 
 static const Parameter s_params[] =
@@ -49,7 +56,7 @@ void CaptureModule::get_config(CaptureConfig& cfg)
 }
 
 const PegInfo* CaptureModule::get_pegs() const
-{ return simple_pegs; }
+{ return cap_names; }
 
 PegCount* CaptureModule::get_counts() const
 { return (PegCount*)&cap_count_stats; }
diff --git a/src/network_inspectors/packet_capture/capture_module.h b/src/network_inspectors/packet_capture/capture_module.h
index 845c2c5b2..7f77b92e2 100644
--- a/src/network_inspectors/packet_capture/capture_module.h
+++ b/src/network_inspectors/packet_capture/capture_module.h
@@ -49,7 +49,13 @@ private:
     CaptureConfig config;
 };
 
-extern THREAD_LOCAL SimpleStats cap_count_stats;
+struct CaptureStats
+{
+    PegCount checked;
+    PegCount matched;
+};
+
+extern THREAD_LOCAL CaptureStats cap_count_stats;
 extern THREAD_LOCAL ProfileStats cap_prof_stats;
 
 #endif
diff --git a/src/network_inspectors/packet_capture/packet_capture.cc b/src/network_inspectors/packet_capture/packet_capture.cc
index 34368bed2..ae1ab393e 100644
--- a/src/network_inspectors/packet_capture/packet_capture.cc
+++ b/src/network_inspectors/packet_capture/packet_capture.cc
@@ -106,9 +106,15 @@ void PacketCapture::eval(Packet* p)
     {
         if ( !capture_initialized() )
             capture_init();
+        
         if ( !bpf.bf_insns || sfbpf_filter(bpf.bf_insns, p->pkt,
                 p->pkth->caplen, p->pkth->pktlen) )
+        {
             write_packet(p);
+            cap_count_stats.matched++;
+        }
+
+        cap_count_stats.checked++;
     }
     else if ( capture_initialized() )
         capture_term();
@@ -439,6 +445,8 @@ TEST_CASE("bpf filter", "[PacketCapture]")
 
     CaptureModule mod;
     MockPacketCapture cap(&mod);
+
+    mod.sum_stats();
     
     packet_capture_enable("ip host 10.82.240.82");
     packet_capture_enable(""); //Test double-enable guard
@@ -458,6 +466,9 @@ TEST_CASE("bpf filter", "[PacketCapture]")
     cap.eval(&p);
     CHECK ( cap.write_packet_called );
 
+    CHECK ( cap_count_stats.checked == 3 );
+    CHECK ( cap_count_stats.matched == 2 );
+
     fseek(cap.fh, 0, SEEK_SET);
     auto pcap = pcap_fopen_offline(cap.fh, nullptr);