From: Russ Combs <rucombs@cisco.com>
Date: Fri, 7 Nov 2014 19:26:45 +0000 (-0500)
Subject: added stream_tcp.segs_split
X-Git-Tag: 3.0.0-233~1256
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c815e60fa0353014e705b42f9101b6dd26353dc9;p=thirdparty%2Fsnort3.git

added stream_tcp.segs_split
---

diff --git a/ChangeLog b/ChangeLog
index 87a2efe5d..894eac9ed 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -36,6 +36,7 @@
 -- fixed stream_ip defaults
 -- fixed binder[2] = { { when = { }, user = { } } } (extra { })
 -- fixed static flush points
+-- added stream_tcp.segs_split peg
 
 126
 -- pulled latest from tom
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 5ba5c9c2c..12ff0fb4a 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -116,6 +116,7 @@ struct TcpStats
     PegCount trackers_released;
     PegCount segs_queued;
     PegCount segs_released;
+    PegCount segs_split;
     PegCount segs_used;
     PegCount rebuilt_packets;
     PegCount rebuilt_buffers;
@@ -144,6 +145,7 @@ const char* tcp_pegs[] =
     "trackers released",
     "segs queued",
     "segs released",
+    "segs split",
     "segs used",
     "rebuilt packets",
     "rebuilt buffers",
@@ -3200,6 +3202,7 @@ static int DupStreamNode(Packet *p,
     if ( !ss )
         return STREAM_INSERT_FAILED;
 
+    tcpStats.segs_split++;
     ss->data = ss->pkt + (left->data - left->pkt);
     ss->orig_dsize = left->orig_dsize;
 
@@ -5905,6 +5908,13 @@ static inline uint32_t flush_pdu_ips (
         if ( flush_pt > 0 )
         {
             MODULE_PROFILE_END(s5TcpPAFPerfStats);
+#if 0
+            // for non-paf splitters, flush_pt > 0 means we reached
+            // the minimum required, but we flush what is available 
+            // instead of creating more, but smaller, packets
+            if ( !trk->splitter->is_paf() && avail > flush_pt )
+                return avail;
+#endif
             return flush_pt;
         }
         seg = seg->next;
@@ -6061,6 +6071,17 @@ static inline uint32_t flush_pdu_ackd (
         if ( flush_pt > 0 )
         {
             MODULE_PROFILE_END(s5TcpPAFPerfStats);
+#if 0
+            // for non-paf splitters, flush_pt > 0 means we reached
+            // the minimum required, but we flush what is available 
+            // instead of creating more, but smaller, packets
+            if ( !trk->splitter->is_paf() )
+            {
+                uint32_t avail = get_q_footprint(trk);
+                if ( avail > flush_pt )
+                    return avail;
+            }
+#endif
             return flush_pt;
         }
         seg = seg->next;