{ "gets", "GET requests" },
{ "posts", "POST requests" },
- { "request headers", "total requests" },
- { "response headers", "total responses" },
- { "request cookies", "requests with Cookie" },
- { "response cookies", "responses with Set-Cookie" },
- { "post params", "POST parameters extracted" },
+ { "request_headers", "total requests" },
+ { "response_headers", "total responses" },
+ { "request_cookies", "requests with Cookie" },
+ { "response_cookies", "responses with Set-Cookie" },
+ { "post_params", "POST parameters extracted" },
{ "unicode", "unicode normalizations" },
- { "double unicode", "double unicode normalizations" },
- { "non-ascii", "non-ascii normalizations" },
- { "paths with ../", "directory traversal normalizations" },
- { "paths with //", "double slash normalizations" },
- { "paths with ./", "relative directory normalizations" },
-
- { "gzip packets", "packets with gzip compression" },
- { "compressed bytes", "total comparessed bytes processed" },
- { "decompressed bytes", "total bytes decompressed" },
+ { "double_unicode", "double unicode normalizations" },
+ { "non_ascii", "non-ascii normalizations" },
+ { "paths_with_traversal", "directory traversal (../) normalizations" },
+ { "paths_with_double_slash", "double slash (//) normalizations" },
+ { "paths_with_relative", "relative directory (./) normalizations" },
+
+ { "gzip_packets", "packets with gzip compression" },
+ { "compressed_bytes", "total comparessed bytes processed" },
+ { "decompressed_bytes", "total bytes decompressed" },
{ nullptr, nullptr }
};
{
const PegInfo pegs[]
{
- { "bad checksum", "non-zero icmp checksums" },
+ { "bad_checksum", "non-zero icmp checksums" },
{ nullptr, nullptr }
};
{
const PegInfo pegs[]
{
- { "bad checksum (ip4)", "nonzero ipcm4 checksums" },
- { "bad checksum (ip6)", "nonzero ipcm6 checksums" },
+ { "bad_icmp4_checksum", "nonzero ipcm4 checksums" },
+ { "bad_icmp6_checksum", "nonzero ipcm6 checksums" },
{ nullptr, nullptr }
};
{
const PegInfo pegs[]
{
- { "bad checksum", "nonzero ip checksums" },
+ { "bad_checksum", "nonzero ip checksums" },
{ nullptr, nullptr }
};
{
const PegInfo pegs[]
{
- { "bad checksum (ip4)", "nonzero tcp over ip checksums" },
- { "bad checksum (ip6)", "nonzero tcp over ipv6 checksums" },
+ { "bad_tcp4_checksum", "nonzero tcp over ip checksums" },
+ { "bad_tcp6_checksum", "nonzero tcp over ipv6 checksums" },
{ nullptr, nullptr }
};
{
const PegInfo pegs[]
{
- { "bad checksum (ip4)", "nonzero udp over ipv4 checksums" },
- { "bad checksum (ip6)", "nonzero udp over ipv6 checksums" },
+ { "bad_udp4_checksum", "nonzero udp over ipv4 checksums" },
+ { "bad_udp6_checksum", "nonzero udp over ipv6 checksums" },
{ nullptr, nullptr }
};
static const PegInfo mpls_pegs[] =
{
- { "total packets", "total mpls labeled packets processed" },
- { "total bytes", "total mpls labeled bytes processed" },
+ { "total_packets", "total mpls labeled packets processed" },
+ { "total_bytes", "total mpls labeled bytes processed" },
{ nullptr, nullptr }
};
static const PegInfo fl_pegs[] =
{
- { "total events", "total file events" },
+ { "total_events", "total file events" },
{ nullptr, nullptr }
};
static const PegInfo file_pegs[] =
{
- { "total files", "number of files processed" },
- { "total file data", "number of file data bytes processed" },
- { "cache failures", "number of file cache add failures" },
+ { "total_files", "number of files processed" },
+ { "total_file_data", "number of file data bytes processed" },
+ { "cache_failures", "number of file cache add failures" },
{ nullptr, nullptr }
};
#include "ha.h"
-static const PegInfo ha_pegs[] =
-{
- { nullptr, nullptr }
-};
-
extern THREAD_LOCAL SimpleStats ha_stats;
extern THREAD_LOCAL ProfileStats ha_perf_stats;
return true;
}
-const PegInfo* HighAvailabilityModule::get_pegs() const
-{ return ha_pegs; }
-
PegCount* HighAvailabilityModule::get_counts() const
{ return (PegCount*)&ha_stats; }
bool begin(const char*, int, SnortConfig*) override;
bool end(const char*, int, SnortConfig*) override;
- const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
-
ProfileStats* get_profile() const override;
private:
const PegInfo lru_cache_shared_peg_names[] =
{
- { "lru cache adds", "lru cache added new entry" },
- { "lru cache replaces", "lru cache replaced existing entry" },
- { "lru cache prunes", "lru cache pruned entry to make space for new entry" },
- { "lru cache find hits", "lru cache found entry in cache" },
- { "lru cache find misses", "lru cache did not find entry in cache" },
- { "lru cache removes", "lru cache found entry and removed it" },
- { "lru cache clears", "lru cache clear API calls" },
+ { "lru_cache_adds", "lru cache added new entry" },
+ { "lru_cache_replaces", "lru cache replaced existing entry" },
+ { "lru_cache_prunes", "lru cache pruned entry to make space for new entry" },
+ { "lru_cache_find_hits", "lru cache found entry in cache" },
+ { "lru_cache_find_misses", "lru cache did not find entry in cache" },
+ { "lru_cache_removes", "lru cache found entry and removed it" },
+ { "lru_cache_clears", "lru cache clear API calls" },
{ nullptr, nullptr },
};
// Check statistics names.
const PegInfo* pegs = lru_cache.get_pegs();
- CHECK(!strcmp(pegs[0].name, "lru cache adds"));
- CHECK(!strcmp(pegs[1].name, "lru cache replaces"));
- CHECK(!strcmp(pegs[2].name, "lru cache prunes"));
- CHECK(!strcmp(pegs[3].name, "lru cache find hits"));
- CHECK(!strcmp(pegs[4].name, "lru cache find misses"));
- CHECK(!strcmp(pegs[5].name, "lru cache removes"));
- CHECK(!strcmp(pegs[6].name, "lru cache clears"));
+ CHECK(!strcmp(pegs[0].name, "lru_cache_adds"));
+ CHECK(!strcmp(pegs[1].name, "lru_cache_replaces"));
+ CHECK(!strcmp(pegs[2].name, "lru_cache_prunes"));
+ CHECK(!strcmp(pegs[3].name, "lru_cache_find_hits"));
+ CHECK(!strcmp(pegs[4].name, "lru_cache_find_misses"));
+ CHECK(!strcmp(pegs[5].name, "lru_cache_removes"));
+ CHECK(!strcmp(pegs[6].name, "lru_cache_clears"));
}
int main(int argc, char** argv)
const PegInfo host_tracker_pegs[] =
{
- { "service adds", "host service adds" },
- { "service finds", "host service finds" },
- { "service removes", "host service removes" },
+ { "service_adds", "host service adds" },
+ { "service_finds", "host service finds" },
+ { "service_removes", "host service removes" },
{ nullptr, nullptr },
};
const PegInfo* ht_pegs = module.get_pegs();
const PegCount* ht_stats = module.get_counts();
- CHECK(!strcmp(ht_pegs[0].name, "lru cache adds"));
- CHECK(!strcmp(ht_pegs[1].name, "lru cache replaces"));
- CHECK(!strcmp(ht_pegs[2].name, "lru cache prunes"));
- CHECK(!strcmp(ht_pegs[3].name, "lru cache find hits"));
- CHECK(!strcmp(ht_pegs[4].name, "lru cache find misses"));
- CHECK(!strcmp(ht_pegs[5].name, "lru cache removes"));
- CHECK(!strcmp(ht_pegs[6].name, "lru cache clears"));
+ CHECK(!strcmp(ht_pegs[0].name, "lru_cache_adds"));
+ CHECK(!strcmp(ht_pegs[1].name, "lru_cache_replaces"));
+ CHECK(!strcmp(ht_pegs[2].name, "lru_cache_prunes"));
+ CHECK(!strcmp(ht_pegs[3].name, "lru_cache_find_hits"));
+ CHECK(!strcmp(ht_pegs[4].name, "lru_cache_find_misses"));
+ CHECK(!strcmp(ht_pegs[5].name, "lru_cache_removes"));
+ CHECK(!strcmp(ht_pegs[6].name, "lru_cache_clears"));
CHECK(!ht_pegs[7].name);
CHECK(ht_stats[0] == 0);
const PegInfo* ht_pegs = module.get_pegs();
const PegCount* ht_stats = module.get_counts();
- CHECK(!strcmp(ht_pegs[0].name, "service adds"));
- CHECK(!strcmp(ht_pegs[1].name, "service finds"));
- CHECK(!strcmp(ht_pegs[2].name, "service removes"));
+ CHECK(!strcmp(ht_pegs[0].name, "service_adds"));
+ CHECK(!strcmp(ht_pegs[1].name, "service_finds"));
+ CHECK(!strcmp(ht_pegs[2].name, "service_removes"));
CHECK(!ht_pegs[3].name);
CHECK(ht_stats[0] == 0);
const PegInfo sd_pegs[] =
{
- { "below threshold", "sd_pattern matched but missed threshold" },
- { "pattern not found", "sd_pattern did not not match" },
+ { "below_threshold", "sd_pattern matched but missed threshold" },
+ { "pattern_not_found", "sd_pattern did not not match" },
{ "terminated", "hyperscan terminated" },
{ nullptr, nullptr }
};
static const PegInfo latency_pegs[] =
{
- { "total packets", "total packets monitored" },
- { "total usecs", "total usecs elapsed" },
- { "max usecs", "maximum usecs elapsed" },
- { "packet timeouts", "packets that timed out" },
- { "total rule evals", "total rule evals monitored" },
- { "rule eval timeouts", "rule evals that timed out" },
- { "rule tree enables", "rule tree re-enables" },
+ { "total_packets", "total packets monitored" },
+ { "total_usecs", "total usecs elapsed" },
+ { "max_usecs", "maximum usecs elapsed" },
+ { "packet_timeouts", "packets that timed out" },
+ { "total_rule_evals", "total rule evals monitored" },
+ { "rule_eval_timeouts", "rule evals that timed out" },
+ { "rule_tree_enables", "rule tree re-enables" },
{ nullptr, nullptr }
};
const PegInfo mpse_pegs[] =
{
- { "max queued", "maximum fast pattern matches queued for further evaluation" },
- { "total flushed", "fast pattern matches discarded due to overflow" },
- { "total inserts", "total fast pattern hits" },
- { "total unique", "total unique fast pattern hits" },
- { "non-qualified events", "total non-qualified events" },
- { "qualified events", "total qualified events" },
+ { "max_queued", "maximum fast pattern matches queued for further evaluation" },
+ { "total_flushed", "fast pattern matches discarded due to overflow" },
+ { "total_inserts", "total fast pattern hits" },
+ { "total_unique", "total unique fast pattern hits" },
+ { "non_qualified_events", "total non-qualified events" },
+ { "qualified_events", "total qualified events" },
{ nullptr, nullptr }
};
const PegInfo appid_pegs[] =
{
{ "packets", "count of packets received" },
- { "processed packets", "count of packets processed" },
- { "ignored packets", "count of packets ignored" },
- { "aim clients", "count of aim clients discovered" },
- { "battlefield flows", "count of battle field flows discovered" },
- { "bgp flows", "count of bgp flows discovered" },
- { "bit clients", "count of bittorrent clients discovered" },
- { "bit flows", "count of bittorrent flows discovered" },
- { "bittracker clients", "count of bittorrent tracker clients discovered" },
- { "bootp flows", "count of bootp flows discovered" },
- { "dcerpc tcp flows", "count of dce rpc flows over tcp discovered" },
- { "dcerpc udp flows", "count of dce rpc flows over udp discovered" },
- { "direct connect flows", "count of direct connect flows discovered" },
- { "dns tcp flows", "count of dns flows over tcp discovered" },
- { "dns udp flows", "count of dns flows over udp discovered" },
- { "ftp flows", "count of ftp flows discovered" },
- { "ftps flows", "count of ftps flows discovered" },
- { "http flows", "count of http flows discovered" },
- { "imap flows", "count of imap service flows discovered" },
- { "imaps flows", "count of imap TLS service flows discovered" },
- { "irc flows", "count of irc service flows discovered" },
- { "kerberos clients", "count of kerberos clients discovered" },
- { "kerberos flows", "count of kerberos service flows discovered" },
- { "kerberos users", "count of kerberos users discovered" },
- { "lpr flows", "count of lpr service flows discovered" },
- { "mdns flows", "count of mdns service flows discovered" },
- { "msn clients", "count of msn clients discovered" },
- { "mysql flows", "count of mysql service flows discovered" },
- { "netbios dgm flows", "count of netbios-dgm service flows discovered" },
- { "netbios ns flows", "count of netbios-ns service flows discovered" },
- { "netbios ssn flows", "count of netbios-ssn service flows discovered" },
- { "nntp flows", "count of nntp flows discovered" },
- { "ntp flows", "count of ntp flows discovered" },
- { "pop flows", "count of pop service flows discovered" },
- { "pop3 clients", "count of pop3 clients discovered" },
- { "pop3s clients", "count of pop3s clients discovered" },
- { "radius flows", "count of radius flows discovered" },
- { "rexec flows", "count of rexec flows discovered" },
- { "rfb flows", "count of rfb flows discovered" },
- { "rlogin flows", "count of rlogin flows discovered" },
- { "rpc flows", "count of rpc flows discovered" },
- { "rshell flows", "count of rshell flows discovered" },
- { "rsync flows", "count of rsync service flows discovered" },
- { "rtmp flows", "count of rtmp flows discovered" },
- { "rtp clients", "count of rtp clients discovered" },
- { "sip clients", "count of SIP clients discovered" },
- { "sip flows", "count of SIP flows discovered" },
- { "smtp aol clients", "count of AOL smtp clients discovered" },
- { "smtp applemail clients", "count of Apple Mail smtp clients discovered" },
- { "smtp eudora clients", "count of Eudora smtp clients discovered" },
- { "smtp eudora pro clients", "count of Eudora Pro smtp clients discovered" },
- { "smtp evolution clients", "count of Evolution smtp clients discovered" },
- { "smtp kmail clients", "count of KMail smtp clients discovered" },
- { "smtp lotus notes clients", "count of Lotus Notes smtp clients discovered" },
- { "smtp microsoft outlook clients", "count of Microsoft Outlook smtp clients discovered" },
- { "smtp microsoft outlook express clients",
- "count of Microsoft Outlook Express smtp clients discovered" },
- { "smtp microsoft outlook imo clients",
+ { "processed_packets", "count of packets processed" },
+ { "ignored_packets", "count of packets ignored" },
+ { "aim_clients", "count of aim clients discovered" },
+ { "battlefield_flows", "count of battle field flows discovered" },
+ { "bgp_flows", "count of bgp flows discovered" },
+ { "bit_clients", "count of bittorrent clients discovered" },
+ { "bit_flows", "count of bittorrent flows discovered" },
+ { "bittracker_clients", "count of bittorrent tracker clients discovered" },
+ { "bootp_flows", "count of bootp flows discovered" },
+ { "dcerpc_tcp_flows", "count of dce rpc flows over tcp discovered" },
+ { "dcerpc_udp_flows", "count of dce rpc flows over udp discovered" },
+ { "direct_connect_flows", "count of direct connect flows discovered" },
+ { "dns_tcp_flows", "count of dns flows over tcp discovered" },
+ { "dns_udp_flows", "count of dns flows over udp discovered" },
+ { "ftp_flows", "count of ftp flows discovered" },
+ { "ftps_flows", "count of ftps flows discovered" },
+ { "http_flows", "count of http flows discovered" },
+ { "imap_flows", "count of imap service flows discovered" },
+ { "imaps_flows", "count of imap TLS service flows discovered" },
+ { "irc_flows", "count of irc service flows discovered" },
+ { "kerberos_clients", "count of kerberos clients discovered" },
+ { "kerberos_flows", "count of kerberos service flows discovered" },
+ { "kerberos_users", "count of kerberos users discovered" },
+ { "lpr_flows", "count of lpr service flows discovered" },
+ { "mdns_flows", "count of mdns service flows discovered" },
+ { "msn_clients", "count of msn clients discovered" },
+ { "mysql_flows", "count of mysql service flows discovered" },
+ { "netbios_dgm_flows", "count of netbios-dgm service flows discovered" },
+ { "netbios_ns_flows", "count of netbios-ns service flows discovered" },
+ { "netbios_ssn_flows", "count of netbios-ssn service flows discovered" },
+ { "nntp_flows", "count of nntp flows discovered" },
+ { "ntp_flows", "count of ntp flows discovered" },
+ { "pop_flows", "count of pop service flows discovered" },
+ { "pop3_clients", "count of pop3 clients discovered" },
+ { "pop3s_clients", "count of pop3s clients discovered" },
+ { "radius_flows", "count of radius flows discovered" },
+ { "rexec_flows", "count of rexec flows discovered" },
+ { "rfb_flows", "count of rfb flows discovered" },
+ { "rlogin_flows", "count of rlogin flows discovered" },
+ { "rpc_flows", "count of rpc flows discovered" },
+ { "rshell_flows", "count of rshell flows discovered" },
+ { "rsync_flows", "count of rsync service flows discovered" },
+ { "rtmp_flows", "count of rtmp flows discovered" },
+ { "rtp_clients", "count of rtp clients discovered" },
+ { "sip_clients", "count of SIP clients discovered" },
+ { "sip_flows", "count of SIP flows discovered" },
+ { "smtp_aol_clients", "count of AOL smtp clients discovered" },
+ { "smtp_applemail_clients", "count of Apple Mail smtp clients discovered" },
+ { "smtp_eudora_clients", "count of Eudora smtp clients discovered" },
+ { "smtp_eudora_pro_clients", "count of Eudora Pro smtp clients discovered" },
+ { "smtp_evolution_clients", "count of Evolution smtp clients discovered" },
+ { "smtp_kmail_clients", "count of KMail smtp clients discovered" },
+ { "smtp_lotus_notes_clients", "count of Lotus Notes smtp clients discovered" },
+ { "smtp_microsoft_outlook_clients", "count of Microsoft Outlook smtp clients discovered" },
+ { "smtp_microsoft_outlook_express_clients",
+ "count_of Microsoft Outlook Express smtp clients discovered" },
+ { "smtp_microsoft_outlook_imo_clients",
"count of Microsoft Outlook IMO smtp clients discovered" },
- { "smtp mutt clients", "count of Mutt smtp clients discovered" },
- { "smtp thunderbird clients", "count of Thunderbird smtp clients discovered" },
- { "smtp flows", "count of smtp flows discovered" },
- { "smtps flows", "count of smtps flows discovered" },
- { "snmp flows", "count of snmp flows discovered" },
- { "ssh clients", "count of ssh clients discovered" },
- { "ssh flows", "count of ssh flows discovered" },
- { "ssl flows", "count of ssl flows discovered" },
- { "telnet flows", "count of telnet flows discovered" },
- { "tftp flows", "count of tftp flows discovered" },
- { "timbuktu clients", "count of timbuktu clients discovered" },
- { "timbuktu flows", "count of timbuktu flows discovered" },
- { "tns clients", "count of tns clients discovered" },
- { "tns flows", "count of tns flows discovered" },
- { "vnc clients", "count of vnc clients discovered" },
- { "yahoo messenger clients", "count of Yahoo Messenger clients discovered" },
+ { "smtp_mutt_clients", "count of Mutt smtp clients discovered" },
+ { "smtp_thunderbird_clients", "count of Thunderbird smtp clients discovered" },
+ { "smtp_flows", "count of smtp flows discovered" },
+ { "smtps_flows", "count of smtps flows discovered" },
+ { "snmp_flows", "count of snmp flows discovered" },
+ { "ssh_clients", "count of ssh clients discovered" },
+ { "ssh_flows", "count of ssh flows discovered" },
+ { "ssl_flows", "count of ssl flows discovered" },
+ { "telnet_flows", "count of telnet flows discovered" },
+ { "tftp_flows", "count of tftp flows discovered" },
+ { "timbuktu_clients", "count of timbuktu clients discovered" },
+ { "timbuktu_flows", "count of timbuktu flows discovered" },
+ { "tns_clients", "count of tns clients discovered" },
+ { "tns_flows", "count of tns flows discovered" },
+ { "vnc_clients", "count of vnc clients discovered" },
+ { "yahoo_messenger_clients", "count of Yahoo Messenger clients discovered" },
{ nullptr, nullptr }
};
const PegInfo norm_names[] =
{
- { "ip4 trim", "eth packets trimmed to datagram size" },
- { "ip4 tos", "type of service normalizations" },
- { "ip4 df", "don't frag bit normalizations" },
- { "ip4 rf", "reserved flag bit clears" },
- { "ip4 ttl", "time-to-live normalizations" },
- { "ip4 opts", "ip4 options cleared" },
- { "icmp4 echo", "icmp4 ping normalizations" },
- { "ip6 hops", "ip6 hop limit normalizations" },
- { "ip6 options", "ip6 options cleared" },
- { "icmp6 echo", "icmp6 echo normalizations" },
- { "tcp syn options", "SYN only options cleared from non-SYN packets" },
- { "tcp options", "packets with options cleared" },
- { "tcp paddding", "packets with padding cleared" },
- { "tcp reserved", "packets with reserved bits cleared" },
- { "tcp nonce", "packets with nonce bit cleared" },
- { "tcp urgent ptr", "packets without data with urgent pointer cleared" },
- { "tcp ecn pkt", "packets with ECN bits cleared" },
- { "tcp ts ecr", "timestamp cleared on non-ACKs" },
- { "tcp req urg", "cleared urgent pointer when urgent flag is not set" },
- { "tcp req pay", "cleared urgent pointer and urgent flag when there is no payload" },
- { "tcp req urp", "cleared the urgent flag if the urgent pointer is not set" },
+ { "ip4_trim", "eth packets trimmed to datagram size" },
+ { "ip4_tos", "type of service normalizations" },
+ { "ip4_df", "don't frag bit normalizations" },
+ { "ip4_rf", "reserved flag bit clears" },
+ { "ip4_ttl", "time-to-live normalizations" },
+ { "ip4_opts", "ip4 options cleared" },
+ { "icmp4_echo", "icmp4 ping normalizations" },
+ { "ip6_hops", "ip6 hop limit normalizations" },
+ { "ip6_options", "ip6 options cleared" },
+ { "icmp6_echo", "icmp6 echo normalizations" },
+ { "tcp_syn_options", "SYN only options cleared from non-SYN packets" },
+ { "tcp_options", "packets with options cleared" },
+ { "tcp_paddding", "packets with padding cleared" },
+ { "tcp_reserved", "packets with reserved bits cleared" },
+ { "tcp_nonce", "packets with nonce bit cleared" },
+ { "tcp_urgent_ptr", "packets without data with urgent pointer cleared" },
+ { "tcp_ecn_pkt", "packets with ECN bits cleared" },
+ { "tcp_ts_ecr", "timestamp cleared on non-ACKs" },
+ { "tcp_req_urg", "cleared urgent pointer when urgent flag is not set" },
+ { "tcp_req_pay", "cleared urgent pointer and urgent flag when there is no payload" },
+ { "tcp_req_urp", "cleared the urgent flag if the urgent pointer is not set" },
{ nullptr, nullptr }
};
{
PegInfo test;
- std::string* test_name = new std::string("test ");
+ std::string* test_name = new std::string("test_");
test_name->append(norm.name);
test_text.push_back(test_name);
test.name = test_text.back()->c_str();
private:
PegCount* counts;
- PegInfo pegs[6] = {
- {"zero", ""},
- {"one", ""},
- {"two", ""},
- {"three", ""},
- {"four", ""},
- {nullptr, nullptr}};
+
+ PegInfo pegs[6] =
+ {
+ { "zero", ""},
+ { "one", ""},
+ { "two", ""},
+ { "three", ""},
+ { "four", ""},
+ { nullptr, nullptr }
+ };
};
class MockBaseTracker : public BaseTracker
{ "blacklisted", "number of packets blacklisted" },
{ "whitelisted", "number of packets whitelisted" },
{ "monitored", "number of packets monitored" },
- { "memory allocated", "total memory allocated" },
+ { "memory_allocated", "total memory allocated" },
{ nullptr, nullptr }
};
static const PegInfo dce2_smb_pegs[] =
{
{ "events", "total events" },
- { "PDUs", "total connection-oriented PDUs" },
- { "Binds", "total connection-oriented binds" },
- { "Bind acks", "total connection-oriented binds acks" },
- { "Alter contexts", "total connection-oriented alter contexts" },
- { "Alter context responses",
- "total connection-oriented alter context responses" },
- { "Bind naks", "total connection-oriented bind naks" },
- { "Requests", "total connection-oriented requests" },
- { "Responses", "total connection-oriented responses" },
- { "Cancels", "total connection-oriented cancels" },
- { "Orphaned", "total connection-oriented orphaned" },
- { "Faults", "total connection-oriented faults" },
- { "Auth3s", "total connection-oriented auth3s" },
- { "Shutdowns", "total connection-oriented shutdowns" },
- { "Rejects", "total connection-oriented rejects" },
- { "MS RPC/HTTP PDUs", "total connection-oriented MS requests to send RPC over HTTP" },
- { "Other requests", "total connection-oriented other requests" },
- { "Other responses", "total connection-oriented other responses" },
- { "Request fragments", "total connection-oriented request fragments" },
- { "Response fragments", "total connection-oriented response fragments" },
- { "Client max fragment size",
- "connection-oriented client maximum fragment size" },
- { "Client min fragment size",
- "connection-oriented client minimum fragment size" },
- { "Client segs reassembled",
- "total connection-oriented client segments reassembled" },
- { "Client frags reassembled",
- "total connection-oriented client fragments reassembled" },
- { "Server max fragment size",
- "connection-oriented server maximum fragment size" },
- { "Server min fragment size",
- "connection-oriented server minimum fragment size" },
- { "Server segs reassembled",
- "total connection-oriented server segments reassembled" },
- { "Server frags reassembled",
- "total connection-oriented server fragments reassembled" },
- { "Sessions", "total smb sessions" },
- { "Packets", "total smb packets" },
- { "Ignored bytes", "total ignored bytes" },
- { "Client segs reassembled", "total smb client segments reassembled" },
- { "Server segs reassembled", "total smb server segments reassembled" },
- { "Max outstanding requests", "total smb maximum outstanding requests" },
- { "Files processed", "total smb files processed" },
- { "SMBv2 create", "total number of SMBv2 create packets seen" },
- { "SMBv2 write", "total number of SMBv2 write packets seen" },
- { "SMBv2 read", "total number of SMBv2 read packets seen" },
- { "SMBv2 set info", "total number of SMBv2 set info packets seen" },
- { "SMBv2 tree connect", "total number of SMBv2 tree connect packets seen" },
- { "SMBv2 tree disconnect", "total number of SMBv2 tree disconnect packets seen" },
- { "SMBv2 close", "total number of SMBv2 close packets seen" },
+ { "pdus", "total connection-oriented PDUs" },
+ { "binds", "total connection-oriented binds" },
+ { "bind_acks", "total connection-oriented binds acks" },
+ { "alter_contexts", "total connection-oriented alter contexts" },
+ { "alter_context_responses", "total connection-oriented alter context responses" },
+ { "bind_naks", "total connection-oriented bind naks" },
+ { "requests", "total connection-oriented requests" },
+ { "responses", "total connection-oriented responses" },
+ { "cancels", "total connection-oriented cancels" },
+ { "orphaned", "total connection-oriented orphaned" },
+ { "faults", "total connection-oriented faults" },
+ { "auth3s", "total connection-oriented auth3s" },
+ { "shutdowns", "total connection-oriented shutdowns" },
+ { "rejects", "total connection-oriented rejects" },
+ { "ms_rpc_http_pdus", "total connection-oriented MS requests to send RPC over HTTP" },
+ { "other_requests", "total connection-oriented other requests" },
+ { "other_responses", "total connection-oriented other responses" },
+ { "request_fragments", "total connection-oriented request fragments" },
+ { "response_fragments", "total connection-oriented response fragments" },
+ { "client_max_fragment_size", "connection-oriented client maximum fragment size" },
+ { "client_min_fragment_size", "connection-oriented client minimum fragment size" },
+ { "client_segs_reassembled", "total connection-oriented client segments reassembled" },
+ { "client_frags_reassembled", "total connection-oriented client fragments reassembled" },
+ { "server_max_fragment_size", "connection-oriented server maximum fragment size" },
+ { "server_min_fragment_size", "connection-oriented server minimum fragment size" },
+ { "server_segs_reassembled", "total connection-oriented server segments reassembled" },
+ { "server_frags_reassembled", "total connection-oriented server fragments reassembled" },
+ { "sessions", "total smb sessions" },
+ { "packets", "total smb packets" },
+ { "ignored_bytes", "total ignored bytes" },
+ { "client_segs_reassembled", "total smb client segments reassembled" },
+ { "server_segs_reassembled", "total smb server segments reassembled" },
+ { "max_outstanding_requests", "total smb maximum outstanding requests" },
+ { "files_processed", "total smb files processed" },
+ { "smbv2_create", "total number of SMBv2 create packets seen" },
+ { "smbv2_write", "total number of SMBv2 write packets seen" },
+ { "smbv2_read", "total number of SMBv2 read packets seen" },
+ { "smbv2_set_info", "total number of SMBv2 set info packets seen" },
+ { "smbv2_tree_connect", "total number of SMBv2 tree connect packets seen" },
+ { "smbv2_tree_disconnect", "total number of SMBv2 tree disconnect packets seen" },
+ { "smbv2_close", "total number of SMBv2 close packets seen" },
{ nullptr, nullptr }
};
static const PegInfo dce2_tcp_pegs[] =
{
{ "events", "total events" },
- { "PDUs", "total connection-oriented PDUs" },
- { "Binds", "total connection-oriented binds" },
- { "Bind acks", "total connection-oriented binds acks" },
- { "Alter contexts", "total connection-oriented alter contexts" },
- { "Alter context responses",
- "total connection-oriented alter context responses" },
- { "Bind naks", "total connection-oriented bind naks" },
- { "Requests", "total connection-oriented requests" },
- { "Responses", "total connection-oriented responses" },
- { "Cancels", "total connection-oriented cancels" },
- { "Orphaned", "total connection-oriented orphaned" },
- { "Faults", "total connection-oriented faults" },
- { "Auth3s", "total connection-oriented auth3s" },
- { "Shutdowns", "total connection-oriented shutdowns" },
- { "Rejects", "total connection-oriented rejects" },
- { "MS RPC/HTTP PDUs", "total connection-oriented MS requests to send RPC over HTTP" },
- { "Other requests", "total connection-oriented other requests" },
- { "Other responses", "total connection-oriented other responses" },
- { "Request fragments", "total connection-oriented request fragments" },
- { "Response fragments", "total connection-oriented response fragments" },
- { "Client max fragment size",
- "connection-oriented client maximum fragment size" },
- { "Client min fragment size",
- "connection-oriented client minimum fragment size" },
- { "Client segs reassembled",
- "total connection-oriented client segments reassembled" },
- { "Client frags reassembled",
- "total connection-oriented client fragments reassembled" },
- { "Server max fragment size",
- "connection-oriented server maximum fragment size" },
- { "Server min fragment size",
- "connection-oriented server minimum fragment size" },
- { "Server segs reassembled",
- "total connection-oriented server segments reassembled" },
- { "Server frags reassembled",
- "total connection-oriented server fragments reassembled" },
- { "tcp sessions", "total tcp sessions" },
- { "tcp packets", "total tcp packets" },
+ { "pdus", "total connection-oriented PDUs" },
+ { "binds", "total connection-oriented binds" },
+ { "bind_acks", "total connection-oriented binds acks" },
+ { "alter_contexts", "total connection-oriented alter contexts" },
+ { "alter_context_responses", "total connection-oriented alter context responses" },
+ { "bind_naks", "total connection-oriented bind naks" },
+ { "requests", "total connection-oriented requests" },
+ { "responses", "total connection-oriented responses" },
+ { "cancels", "total connection-oriented cancels" },
+ { "orphaned", "total connection-oriented orphaned" },
+ { "faults", "total connection-oriented faults" },
+ { "auth3s", "total connection-oriented auth3s" },
+ { "shutdowns", "total connection-oriented shutdowns" },
+ { "rejects", "total connection-oriented rejects" },
+ { "ms_rpc_http_pdus", "total connection-oriented MS requests to send RPC over HTTP" },
+ { "other_requests", "total connection-oriented other requests" },
+ { "other_responses", "total connection-oriented other responses" },
+ { "request_fragments", "total connection-oriented request fragments" },
+ { "response_fragments", "total connection-oriented response fragments" },
+ { "client_max_fragment_size", "connection-oriented client maximum fragment size" },
+ { "client_min_fragment_size", "connection-oriented client minimum fragment size" },
+ { "client_segs_reassembled", "total connection-oriented client segments reassembled" },
+ { "client_frags_reassembled", "total connection-oriented client fragments reassembled" },
+ { "server_max_fragment_size", "connection-oriented server maximum fragment size" },
+ { "server_min_fragment_size", "connection-oriented server minimum fragment size" },
+ { "server_segs_reassembled", "total connection-oriented server segments reassembled" },
+ { "server_frags_reassembled", "total connection-oriented server fragments reassembled" },
+ { "tcp_sessions", "total tcp sessions" },
+ { "tcp_packets", "total tcp packets" },
{ nullptr, nullptr }
};
static const PegInfo dce2_udp_pegs[] =
{
{ "events", "total events" },
- { "udp sessions", "total udp sessions" },
- { "udp packets", "total udp packets" },
- { "Requests", "total connection-less requests" },
- { "Acks", "total connection-less acks" },
- { "Cancels", "total connection-less cancels" },
- { "Client facks", "total connection-less client facks" },
- { "Ping", "total connection-less ping" },
- { "Responses", "total connection-less responses" },
- { "Rejects", "total connection-less rejects" },
- { "Cancel acks", "total connection-less cancel acks" },
- { "Server facks", "total connection-less server facks" },
- { "Faults", "total connection-less faults" },
- { "No calls", "total connection-less no calls" },
- { "Working", "total connection-less working" },
- { "Other requests", "total connection-less other requests" },
- { "Other responses", "total connection-less other responses" },
- { "Fragments", "total connection-less fragments" },
- { "Max fragment size",
- "connection-less maximum fragment size" },
- { "Frags reassembled",
- "total connection-less fragments reassembled" },
- { "Max seqnum",
- "max connection-less seqnum" },
+ { "udp_sessions", "total udp sessions" },
+ { "udp_packets", "total udp packets" },
+ { "requests", "total connection-less requests" },
+ { "acks", "total connection-less acks" },
+ { "cancels", "total connection-less cancels" },
+ { "client_facks", "total connection-less client facks" },
+ { "ping", "total connection-less ping" },
+ { "responses", "total connection-less responses" },
+ { "rejects", "total connection-less rejects" },
+ { "cancel_acks", "total connection-less cancel acks" },
+ { "server_facks", "total connection-less server facks" },
+ { "faults", "total connection-less faults" },
+ { "no_calls", "total connection-less no calls" },
+ { "working", "total connection-less working" },
+ { "other_requests", "total connection-less other requests" },
+ { "other_responses", "total connection-less other responses" },
+ { "fragments", "total connection-less fragments" },
+ { "max_fragment_size", "connection-less maximum fragment size" },
+ { "frags_reassembled", "total connection-less fragments reassembled" },
+ { "max_seqnum", "max connection-less seqnum" },
{ nullptr, nullptr }
};
static const PegInfo dnp3_pegs[] =
{
- { "total packets", "total packets" },
- { "udp packets", "total udp packets" },
- { "tcp pdus", "total tcp pdus" },
- { "dnp3 link layer frames", "total dnp3 link layer frames" },
- { "dnp3 application pdus", "total dnp3 application pdus" },
+ { "total_packets", "total packets" },
+ { "udp_packets", "total udp packets" },
+ { "tcp_pdus", "total tcp pdus" },
+ { "dnp3_link_layer_frames", "total dnp3 link layer frames" },
+ { "dnp3_application_pdus", "total dnp3 application pdus" },
{ nullptr, nullptr }
};
{
{ "sessions", "total sessions processed" },
{ "events", "requests" },
- { "unknown types", "unknown message types" },
- { "unknown infos", "unknown information elements" },
+ { "unknown_types", "unknown message types" },
+ { "unknown_infos", "unknown information elements" },
{ nullptr, nullptr }
};
{ "inspections", "total message sections inspected" },
{ "requests", "HTTP request messages inspected" },
{ "responses", "HTTP response messages inspected" },
- { "GET requests", "GET requests inspected" },
- { "HEAD requests", "HEAD requests inspected" },
- { "POST requests", "POST requests inspected" },
- { "PUT requests", "PUT requests inspected" },
- { "DELETE requests", "DELETE requests inspected" },
- { "CONNECT requests", "CONNECT requests inspected" },
- { "OPTIONS requests", "OPTIONS requests inspected" },
- { "TRACE requests", "TRACE requests inspected" },
- { "other requests", "other request methods inspected" },
- { "request bodies", "POST, PUT, and other requests with message bodies" },
+ { "get_requests", "GET requests inspected" },
+ { "head_requests", "HEAD requests inspected" },
+ { "post_requests", "POST requests inspected" },
+ { "put_requests", "PUT requests inspected" },
+ { "delete_requests", "DELETE requests inspected" },
+ { "connect_requests", "CONNECT requests inspected" },
+ { "options_requests", "OPTIONS requests inspected" },
+ { "trace_requests", "TRACE requests inspected" },
+ { "other_requests", "other request methods inspected" },
+ { "request_bodies", "POST, PUT, and other requests with message bodies" },
{ "chunked", "chunked message bodies" },
- { "URI normalizations", "URIs needing to be normalization" },
- { "URI path", "URIs with path problems" },
- { "URI coding", "URIs with character coding problems" },
+ { "uri_normalizations", "URIs needing to be normalization" },
+ { "uri_path", "URIs with path problems" },
+ { "uri_coding", "URIs with character coding problems" },
{ nullptr, nullptr }
};
{
{ "packets", "total packets processed" },
{ "sessions", "total imap sessions" },
- { "b64 attachments", "total base64 attachments decoded" },
- { "b64 decoded bytes", "total base64 decoded bytes" },
- { "qp attachments", "total quoted-printable attachments decoded" },
- { "qp decoded bytes", "total quoted-printable decoded bytes" },
- { "uu attachments", "total uu attachments decoded" },
- { "uu decoded bytes", "total uu decoded bytes" },
- { "non-encoded attachments", "total non-encoded attachments extracted" },
- { "non-encoded bytes", "total non-encoded extracted bytes" },
+ { "b64_attachments", "total base64 attachments decoded" },
+ { "b64_decoded_bytes", "total base64 decoded bytes" },
+ { "qp_attachments", "total quoted-printable attachments decoded" },
+ { "qp_decoded_bytes", "total quoted-printable decoded bytes" },
+ { "uu_attachments", "total uu attachments decoded" },
+ { "uu_decoded_bytes", "total uu decoded bytes" },
+ { "non_encoded_attachments", "total non-encoded attachments extracted" },
+ { "non_encoded_bytes", "total non-encoded extracted bytes" },
{ nullptr, nullptr }
};
{
{ "packets", "total packets processed" },
{ "sessions", "total pop sessions" },
- { "b64 attachments", "total base64 attachments decoded" },
- { "b64 decoded bytes", "total base64 decoded bytes" },
- { "qp attachments", "total quoted-printable attachments decoded" },
- { "qp decoded bytes", "total quoted-printable decoded bytes" },
- { "uu attachments", "total uu attachments decoded" },
- { "uu decoded bytes", "total uu decoded bytes" },
- { "non-encoded attachments", "total non-encoded attachments extracted" },
- { "non-encoded bytes", "total non-encoded extracted bytes" },
+ { "b64_attachments", "total base64 attachments decoded" },
+ { "b64_decoded_bytes", "total base64 decoded bytes" },
+ { "qp_attachments", "total quoted-printable attachments decoded" },
+ { "qp_decoded_bytes", "total quoted-printable decoded bytes" },
+ { "uu_attachments", "total uu attachments decoded" },
+ { "uu_decoded_bytes", "total uu decoded bytes" },
+ { "non_encoded_attachments", "total non-encoded attachments extracted" },
+ { "non_encoded_bytes", "total non-encoded extracted bytes" },
{ nullptr, nullptr }
};
{ "sessions", "total sessions" },
{ "events", "events generated" },
{ "dialogs", "total dialogs" },
- { "ignored channels", "total channels ignored" },
- { "ignored sessions", "total sessions ignored" },
- { "total requests", "total requests" },
+ { "ignored_channels", "total channels ignored" },
+ { "ignored_sessions", "total sessions ignored" },
+ { "total_requests", "total requests" },
{ "invite", "invite" },
{ "cancel", "cancel" },
{ "ack", "ack" },
{ "message", "message" },
{ "notify", "notify" },
{ "prack", "prack" },
- { "total responses", "total responses" },
+ { "total_responses", "total responses" },
{ "1xx", "1xx" },
{ "2xx", "2xx" },
{ "3xx", "3xx" },
{
{ "packets", "total packets processed" },
{ "sessions", "total smtp sessions" },
- { "concurrent sessions", "total concurrent smtp sessions" },
- { "max concurrent sessions", "maximum concurrent smtp sessions" },
- { "b64 attachments", "total base64 attachments decoded" },
- { "b64 decoded bytes", "total base64 decoded bytes" },
- { "qp attachments", "total quoted-printable attachments decoded" },
- { "qp decoded bytes", "total quoted-printable decoded bytes" },
- { "uu attachments", "total uu attachments decoded" },
- { "uu decoded bytes", "total uu decoded bytes" },
- { "non-encoded attachments", "total non-encoded attachments extracted" },
- { "non-encoded bytes", "total non-encoded extracted bytes" },
+ { "concurrent_sessions", "total concurrent smtp sessions" },
+ { "max_concurrent_sessions", "maximum concurrent smtp sessions" },
+ { "b64_attachments", "total base64 attachments decoded" },
+ { "b64_decoded_bytes", "total base64 decoded bytes" },
+ { "qp_attachments", "total quoted-printable attachments decoded" },
+ { "qp_decoded_bytes", "total quoted-printable decoded bytes" },
+ { "uu_attachments", "total uu attachments decoded" },
+ { "uu_decoded_bytes", "total uu decoded bytes" },
+ { "non_encoded_attachments", "total non-encoded attachments extracted" },
+ { "non_encoded_bytes", "total non-encoded extracted bytes" },
{ nullptr, nullptr }
};
{
{ "packets", "total packets processed" },
{ "decoded", "ssl packets decoded" },
- { "client hello", "total client hellos" },
- { "server hello", "total server hellos" },
+ { "client_hello", "total client hellos" },
+ { "server_hello", "total server hellos" },
{ "certificate", "total ssl certificates" },
- { "server done", "total server done" },
- { "client key exchange", "total client key exchanges" },
- { "server key exchange", "total server key exchanges" },
- { "change cipher", "total change cipher records" },
+ { "server_done", "total server done" },
+ { "client_key_exchange", "total client key exchanges" },
+ { "server_key_exchange", "total server key exchanges" },
+ { "change_cipher", "total change cipher records" },
{ "finished", "total handshakes finished" },
- { "client application", "total client application records" },
- { "server application", "total server application records" },
+ { "client_application", "total client application records" },
+ { "server_application", "total server application records" },
{ "alert", "total ssl alert records" },
- { "unrecognized records", "total unrecognized records" },
- { "handshakes completed", "total completed ssl handshakes" },
- { "bad handshakes", "total bad handshakes" },
- { "sessions ignored", "total sessions ignore" },
- { "detection disabled", "total detection disabled" },
+ { "unrecognized_records", "total unrecognized records" },
+ { "handshakes_completed", "total completed ssl handshakes" },
+ { "bad_handshakes", "total bad handshakes" },
+ { "sessions_ignored", "total sessions ignore" },
+ { "detection_disabled", "total detection disabled" },
{ nullptr, nullptr }
};
const PegInfo wiz_pegs[] =
{
- { "tcp scans", "tcp payload scans" },
- { "tcp hits", "tcp identifications" },
- { "udp scans", "udp payload scans" },
- { "udp hits", "udp identifications" },
- { "user scans", "user payload scans" },
- { "user hits", "user identifications" },
+ { "tcp_scans", "tcp payload scans" },
+ { "tcp_hits", "tcp identifications" },
+ { "udp_scans", "udp payload scans" },
+ { "udp_hits", "udp identifications" },
+ { "user_scans", "user payload scans" },
+ { "user_hits", "user identifications" },
{ nullptr, nullptr }
};
#include "side_channel.h"
-static const PegInfo sc_pegs[] =
-{
- { nullptr, nullptr }
-};
-
extern THREAD_LOCAL SimpleStats sc_stats;
extern THREAD_LOCAL ProfileStats sc_perf_stats;
return true;
}
-const PegInfo* SideChannelModule::get_pegs() const
-{ return sc_pegs; }
-
PegCount* SideChannelModule::get_counts() const
{ return (PegCount*)&sc_stats; }
bool begin(const char*, int, SnortConfig*) override;
bool end(const char*, int, SnortConfig*) override;
- const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
-
ProfileStats* get_profile() const override;
private:
THREAD_LOCAL BaseStats stream_base_stats;
#define PROTO_PEGS(proto_str) \
- { proto_str " flows", "total " proto_str " sessions" }, \
- { proto_str " total prunes", "total " proto_str " sessions pruned" }, \
- { proto_str " idle prunes", proto_str " sessions pruned due to timeout" }, \
- { proto_str " excess prunes", proto_str " sessions pruned due to excess" }, \
- { proto_str " uni prunes", proto_str " uni sessions pruned" }, \
- { proto_str " preemptive prunes", proto_str " sessions pruned during preemptive pruning" }, \
- { proto_str " memcap prunes", proto_str " sessions pruned due to memcap" }, \
- { proto_str " ha prunes", proto_str " sessions pruned by high availability sync" }
+ { proto_str "_flows", "total " proto_str " sessions" }, \
+ { proto_str "_total_prunes", "total " proto_str " sessions pruned" }, \
+ { proto_str "_idle_prunes", proto_str " sessions pruned due to timeout" }, \
+ { proto_str "_excess_prunes", proto_str " sessions pruned due to excess" }, \
+ { proto_str "_uni_prunes", proto_str " uni sessions pruned" }, \
+ { proto_str "_preemptive_prunes", proto_str " sessions pruned during preemptive pruning" }, \
+ { proto_str "_memcap_prunes", proto_str " sessions pruned due to memcap" }, \
+ { proto_str "_ha_prunes", proto_str " sessions pruned by high availability sync" }
#define SET_PROTO_COUNTS(proto, pkttype) \
stream_base_stats.proto ## _flows = flow_con->get_flows(PktType::pkttype); \
const PegInfo icmp_pegs[] =
{
- SESSION_PEGS("icmp"),
+ SESSION_PEGS("icmp_"),
{ nullptr, nullptr }
};
const PegInfo ip_pegs[] =
{
- SESSION_PEGS("ip"),
- { "total frags", "total fragments" },
- { "current frags", "current fragments" },
- { "max frags", "max fragments" },
+ SESSION_PEGS("ip_"),
+ { "total_frags", "total fragments" },
+ { "current_frags", "current fragments" },
+ { "max_frags", "max fragments" },
{ "reassembled", "reassembled datagrams" },
{ "discards", "fragments discarded" },
- { "frag timeouts", "datagrams abandoned" },
+ { "frag_timeouts", "datagrams abandoned" },
{ "overlaps", "overlapping fragments" },
{ "anomalies", "anomalies detected" },
{ "alerts", "alerts generated" },
{ "drops", "fragments dropped" },
- { "trackers added", "datagram trackers created" },
- { "trackers freed", "datagram trackers released" },
- { "trackers cleared", "datagram trackers cleared" },
- { "trackers completed", "datagram trackers completed" },
- { "nodes inserted", "fragments added to tracker" },
- { "nodes deleted", "fragments deleted from tracker" },
- { "memory used", "current memory usage in bytes" },
- { "reassembled bytes", "total reassembled bytes" },
- { "fragmented bytes", "total fragmented bytes" },
+ { "trackers_added", "datagram trackers created" },
+ { "trackers_freed", "datagram trackers released" },
+ { "trackers_cleared", "datagram trackers cleared" },
+ { "trackers_completed", "datagram trackers completed" },
+ { "nodes_inserted", "fragments added to tracker" },
+ { "nodes_deleted", "fragments deleted from tracker" },
+ { "memory_used", "current memory usage in bytes" },
+ { "reassembled_bytes", "total reassembled bytes" },
+ { "fragmented_bytes", "total fragmented bytes" },
{ nullptr, nullptr }
};
const PegInfo tcp_pegs[] =
{
- SESSION_PEGS("tcp"),
+ SESSION_PEGS("tcp_"),
{ "resyns", "SYN received on established session" },
{ "discards", "tcp packets discarded" },
{ "events", "events generated" },
{ "ignored", "tcp packets ignored" },
{ "untracked", "tcp packets not tracked" },
- { "syn trackers", "tcp session tracking started on syn" },
- { "syn-ack trackers", "tcp session tracking started on syn-ack" },
- { "3way trackers", "tcp session tracking started on ack" },
- { "data trackers", "tcp session tracking started on data" },
- { "segs queued", "total segments queued" },
- { "segs released", "total segments released" },
- { "segs split", "tcp segments split when reassembling PDUs" },
- { "segs used", "queued tcp segments applied to reassembled PDUs" },
- { "rebuilt packets", "total reassembled PDUs" },
- { "rebuilt buffers", "rebuilt PDU sections" },
- { "rebuilt bytes", "total rebuilt bytes" },
+ { "syn_trackers", "tcp session tracking started on syn" },
+ { "syn_ack_trackers", "tcp session tracking started on syn-ack" },
+ { "3way_trackers", "tcp session tracking started on ack" },
+ { "data_trackers", "tcp session tracking started on data" },
+ { "segs_queued", "total segments queued" },
+ { "segs_released", "total segments released" },
+ { "segs_split", "tcp segments split when reassembling PDUs" },
+ { "segs_used", "queued tcp segments applied to reassembled PDUs" },
+ { "rebuilt_packets", "total reassembled PDUs" },
+ { "rebuilt_buffers", "rebuilt PDU sections" },
+ { "rebuilt_bytes", "total rebuilt bytes" },
{ "overlaps", "overlapping segments queued" },
{ "gaps", "missing data between PDUs" },
- { "max segs", "number of times the maximum queued segment limit was reached" },
- { "max bytes", "number of times the maximum queued byte limit was reached" },
- { "internal events", "135:X events generated" },
- { "client cleanups", "number of times data from server was flushed when session released" },
- { "server cleanups", "number of times data from client was flushed when session released" },
+ { "max_segs", "number of times the maximum queued segment limit was reached" },
+ { "max_bytes", "number of times the maximum queued byte limit was reached" },
+ { "internal_events", "135:X events generated" },
+ { "client_cleanups", "number of times data from server was flushed when session released" },
+ { "server_cleanups", "number of times data from client was flushed when session released" },
{ "memory", "current memory in use" },
{ "initializing", "number of sessions currently initializing" },
{ "established", "number of sessions currently established" },
static const PegInfo pegName[] =
{
- { "tcp trim syn", "tcp segments trimmed on SYN" },
- { "tcp trim rst", "RST packets with data trimmed" },
- { "tcp trim win", "data trimed to window" },
- { "tcp trim mss", "data trimmed to MSS" },
- { "tcp ecn session", "ECN bits cleared" },
- { "tcp ts nop", "timestamp options cleared" },
- { "tcp ips data", "normalized segments" },
- { "tcp block", "blocked segments" },
+ { "tcp_trim_syn", "tcp segments trimmed on SYN" },
+ { "tcp_trim_rst", "RST packets with data trimmed" },
+ { "tcp_trim_win", "data trimed to window" },
+ { "tcp_trim_mss", "data trimmed to MSS" },
+ { "tcp_ecn_session", "ECN bits cleared" },
+ { "tcp_ts_nop", "timestamp options cleared" },
+ { "tcp_ips_data", "normalized segments" },
+ { "tcp_block", "blocked segments" },
{ nullptr, nullptr }
};
const PegInfo udp_pegs[] =
{
- SESSION_PEGS("udp"),
+ SESSION_PEGS("udp_"),
{ nullptr, nullptr }
};
{ "ignore", "total ignore verdicts" },
// FIXIT-L these are not exactly DAQ counts - but they are related
- { "internal blacklist", "packets blacklisted internally due to lack of DAQ support" },
- { "internal whitelist", "packets whitelisted internally due to lack of DAQ support" },
+ { "internal_blacklist", "packets blacklisted internally due to lack of DAQ support" },
+ { "internal_whitelist", "packets whitelisted internally due to lack of DAQ support" },
{ "skipped", "packets skipped at startup" },
{ "idle", "attempts to acquire from DAQ without available packets" },
{ nullptr, nullptr }
const PegInfo pc_names[] =
{
{ "analyzed", "packets sent to detection" },
- { "hard evals", "non-fast pattern rule evaluations" },
- { "raw searches", "fast pattern searches in raw packet data" },
- { "cooked searches", "fast pattern searches in cooked packet data" },
- { "pkt searches", "fast pattern searches in packet data" },
- { "alt searches", "alt fast pattern searches in packet data" },
- { "key searches", "fast pattern searches in key buffer" },
- { "header searches", "fast pattern searches in header buffer" },
- { "body searches", "fast pattern searches in body buffer" },
- { "file searches", "fast pattern searches in file buffer" },
+ { "hard_evals", "non-fast pattern rule evaluations" },
+ { "raw_searches", "fast pattern searches in raw packet data" },
+ { "cooked_searches", "fast pattern searches in cooked packet data" },
+ { "pkt_searches", "fast pattern searches in packet data" },
+ { "alt_searches", "alt fast pattern searches in packet data" },
+ { "key_searches", "fast pattern searches in key buffer" },
+ { "header_searches", "fast pattern searches in header buffer" },
+ { "body_searches", "fast pattern searches in body buffer" },
+ { "file_searches", "fast pattern searches in file buffer" },
{ "alerts", "alerts not including IP reputation" },
- { "total alerts", "alerts including IP reputation" },
+ { "total_alerts", "alerts including IP reputation" },
{ "logged", "logged packets" },
{ "passed", "passed packets" },
- { "match limit", "fast pattern matches not processed" },
- { "queue limit", "events not queued because queue full" },
- { "log limit", "events queued but not logged" },
- { "event limit", "events filtered" },
- { "alert limit", "events previously triggered on same PDU" },
+ { "match_limit", "fast pattern matches not processed" },
+ { "queue_limit", "events not queued because queue full" },
+ { "log_limit", "events queued but not logged" },
+ { "event_limit", "events filtered" },
+ { "alert_limit", "events previously triggered on same PDU" },
{ nullptr, nullptr }
};
const PegInfo proc_names[] =
{
- { "local commands", "total local commands processed" },
- { "remote commands", "total remote commands processed" },
+ { "local_commands", "total local commands processed" },
+ { "remote_commands", "total remote commands processed" },
{ "signals", "total signals processed" },
- { "conf reloads", "number of times configuration was reloaded" },
- { "attribute table reloads", "number of times hosts table was reloaded" },
- { "attribute table hosts", "total number of hosts in table" },
+ { "conf_reloads", "number of times configuration was reloaded" },
+ { "attribute_table_reloads", "number of times hosts table was reloaded" },
+ { "attribute_table_hosts", "total number of hosts in table" },
{ nullptr, nullptr }
};
projects / thirdparty / snort3.git / commitdiff
