builtin.txt \
commands.txt \
config.txt \
+counts.txt \
gids.txt \
help.txt \
modules.txt \
config.txt: $(snort)
$(snort) $(plugin_path) --markup --help-config | sort -k 3 > $@
+counts.txt: $(snort)
+ $(snort) $(plugin_path) --markup --help-counts | sort -k 2 > $@
+
gids.txt: $(snort)
$(snort) $(plugin_path) --markup --list-gids | sort -n -k 1.4 > $@
include::config.txt[]
+=== Counts
+
+include::counts.txt[]
+
=== Generators
include::gids.txt[]
namespace{
-const char* pegs[]
+const PegInfo pegs[]
{
- "bad checksum",
- nullptr
+ { "bad checksum", "non-zero icmp checksums" },
+ { nullptr, nullptr }
};
struct Stats
const RuleMap* get_rules() const override
{ return icmp4_rules; }
- const char** get_pegs() const override
+ const PegInfo* get_pegs() const override
{ return pegs; }
PegCount* get_counts() const override
namespace
{
-const char* pegs[]
+const PegInfo pegs[]
{
- "bad checksum (ip4)",
- "bad checksum (ip6)",
- nullptr
+ { "bad checksum (ip4)", "nonzero ipcm4 checksums" },
+ { "bad checksum (ip6)", "nonzero ipcm6 checksums" },
+ { nullptr, nullptr }
};
struct Stats
const RuleMap* get_rules() const override
{ return icmp6_rules; }
- const char** get_pegs() const override
+ const PegInfo* get_pegs() const override
{ return pegs; }
PegCount* get_counts() const override
namespace{
-const char* pegs[]
+const PegInfo pegs[]
{
- "bad checksum",
- nullptr
+ { "bad checksum", "nonzero ip checksums" },
+ { nullptr, nullptr }
};
struct Stats
const RuleMap* get_rules() const override
{ return ipv4_rules; }
- const char** get_pegs() const override
+ const PegInfo* get_pegs() const override
{ return pegs; }
PegCount* get_counts() const override
namespace
{
-const char* pegs[]
+const PegInfo pegs[]
{
- "bad checksum (ip4)",
- "bad checksum (ip6)",
- nullptr
+ { "bad checksum (ip4)", "nonzero tcp over ip checksums" },
+ { "bad checksum (ip6)", "nonzero tcp over ipv6 checksums" },
+ { nullptr, nullptr }
};
struct Stats
const RuleMap* get_rules() const override
{ return tcp_rules; }
- const char** get_pegs() const override
+ const PegInfo* get_pegs() const override
{ return pegs; }
PegCount* get_counts() const override
namespace
{
-const char* pegs[]
+const PegInfo pegs[]
{
- "bad checksum (ip4)",
- "bad checksum (ip6)",
- nullptr
+ { "bad checksum (ip4)", "nonzero udp over ipv4 checksums" },
+ { "bad checksum (ip6)", "nonzero udp over ipv6 checksums" },
+ { nullptr, nullptr }
};
struct Stats
const RuleMap* get_rules() const override
{ return udp_rules; }
- const char** get_pegs() const override
+ const PegInfo* get_pegs() const override
{ return pegs; }
PegCount* get_counts() const override
PegCount total_packets;
};
-SO_PUBLIC extern const char* simple_pegs[];
+struct PegInfo
+{
+ const char* name;
+ const char* help;
+};
+
+SO_PUBLIC extern const struct PegInfo simple_pegs[];
#define array_size(a) (sizeof(a)/sizeof(a[0]))
void Module::reset_stats()
{
num_counts = 0;
- const char** pegs = get_pegs();
+ const PegInfo* pegs = get_pegs();
if ( !pegs )
return;
- while ( pegs[num_counts] )
+ while ( pegs[num_counts].name )
++num_counts;
counts.resize(num_counts);
counts[i] = 0;
}
-const char* simple_pegs[] =
+const PegInfo simple_pegs[] =
{
- "packets",
- nullptr
+ { "packets", "total packets" },
+ { nullptr, nullptr }
};
virtual const RuleMap* get_rules() const
{ return nullptr; };
- virtual const char** get_pegs() const
+ virtual const PegInfo* get_pegs() const
{ return nullptr; };
// counts and profile are thread local
"--help this overview of help\n" \
"--help-commands [<module prefix>] output matching commands\n" \
"--help-config [<module prefix>] output matching config options\n" \
+"--help-counts [<module prefix>] output matching peg counts\n" \
"--help-module <module> output description of given module\n" \
"--help-modules list all available modules with brief help\n" \
"--help-plugins list all available plugins with brief help\n" \
enum HelpType {
HT_CFG, HT_CMD, HT_GID, HT_IPS, HT_MOD,
HT_BUF, HT_LST, HT_PLG, HT_DDR, HT_DBR,
- HT_HMO, HT_HPL, HT_DFL
+ HT_HMO, HT_HPL, HT_DFL, HT_PEG
};
static void show_help(SnortConfig* sc, const char* val, HelpType ht)
case HT_DFL:
ModuleManager::dump_defaults(val);
break;
+ case HT_PEG:
+ ModuleManager::show_pegs(val);
+ break;
}
ModuleManager::term();
PluginManager::release_plugins();
show_help(sc, val, HT_DDR);
}
+void help_counts(SnortConfig* sc, const char* val)
+{
+ show_help(sc, val, HT_PEG);
+}
+
void dump_rule_hex(SnortConfig*, const char* val)
{
SoManager::rule_to_hex(val);
void help_modules(SnortConfig* sc, const char*);
void help_plugins(SnortConfig* sc, const char*);
void help_version(SnortConfig*, const char*);
+void help_counts(SnortConfig* sc, const char*);
void list_modules(SnortConfig* sc, const char*);
void list_plugins(SnortConfig* sc, const char*);
#include "filters/sfthreshold.h"
#include "sfip/sf_ip.h"
#include "main/thread.h"
+#include "utils/stats.h"
#if defined(DEBUG_MSGS) || defined (REG_TEST)
#include "file_api/file_api.h"
public:
DetectionModule() : Module("detection", detection_help, detection_params) { };
bool set(const char*, Value&, SnortConfig*) override;
+ const PegInfo* get_pegs() const override { return pc_names; };
};
bool DetectionModule::set(const char*, Value& v, SnortConfig* sc)
public:
DaqModule() : Module("daq", daq_help, daq_params) { };
bool set(const char*, Value&, SnortConfig*) override;
+ const PegInfo* get_pegs() const override { return daq_names; };
};
bool DaqModule::set(const char*, Value& v, SnortConfig* sc)
DAQ_Verdict fail_open(
void*, const DAQ_PktHdr_t*, const uint8_t*)
{
- pc.total_fail_open++;
+ aux_counts.total_fail_open++;
return DAQ_VERDICT_PASS;
}
{
if ( flow_con )
flow_con->timeout_flows(16384, time(NULL));
- pc.idle++;
+ aux_counts.idle++;
}
void snort_thread_rotate()
#include "parser/parser.h"
#include "parser/vars.h"
#include "packet_io/trough.h"
+#include "utils/stats.h"
#ifdef UNIT_TEST
#include "test/unit_test.h"
{ "--help-config", Parameter::PT_STRING, "(optional)", nullptr,
"[<module prefix>] output matching config options" },
+ { "--help-counts", Parameter::PT_STRING, "(optional)", nullptr,
+ "[<module prefix>] output matching peg counts" },
+
{ "--help-module", Parameter::PT_STRING, nullptr, nullptr,
"<module> output description of given module" },
#endif
bool set(const char*, Value&, SnortConfig*) override;
+ const PegInfo* get_pegs() const override { return proc_names; };
};
bool SnortModule::set(const char*, Value& v, SnortConfig* sc)
else if ( v.is("--help-config") )
help_config(sc, v.get_string());
+ else if ( v.is("--help-counts") )
+ help_counts(sc, v.get_string());
+
else if ( v.is("--help-module") )
help_module(sc, v.get_string());
if ( m->get_commands() )
{
cout << endl << "Commands: " << endl << endl;
- show_commands(name);
+ show_commands(name, true);
}
if ( m->get_rules() )
{
cout << endl << "Rules: " << endl << endl;
- show_rules(name);
+ show_rules(name, true);
}
if ( m->get_pegs() )
{
cout << endl << "Peg counts: " << endl << endl;
- show_pegs(name);
+ show_pegs(name, true);
}
c++;
}
cout << "no match" << endl;
}
+static bool selected(const Module* m, const char* pfx, bool exact)
+{
+ if ( !pfx )
+ return true;
+
+ if ( exact && strcmp(m->get_name(), pfx) )
+ return false;
+
+ else if ( !exact && strncmp(m->get_name(), pfx, strlen(pfx)) )
+ return false;
+
+ return true;
+}
+
void ModuleManager::show_configs(const char* pfx, bool exact)
{
s_modules.sort(comp_mods);
Module* m = p->mod;
string s;
- if ( pfx )
- {
- if ( exact && strcmp(m->get_name(), pfx) )
- continue;
- else if ( !exact && strncmp(m->get_name(), pfx, strlen(pfx)) )
- continue;
- }
+ if ( !selected(m, pfx, exact) )
+ continue;
if ( m->is_list() )
{
show_configs(pfx);
}
-void ModuleManager::show_commands(const char* pfx)
+void ModuleManager::show_commands(const char* pfx, bool exact)
{
s_modules.sort(comp_mods);
- unsigned len = pfx ? strlen(pfx) : 0;
unsigned n = 0;
for ( auto p : s_modules )
{
const Module* m = p->mod;
- if ( pfx && strncmp(m->get_name(), pfx, len) )
+ if ( !selected(m, pfx, exact) )
continue;
const Command* c = m->get_commands();
cout << "no match" << endl;
}
-void ModuleManager::show_gids(const char* pfx)
+void ModuleManager::show_gids(const char* pfx, bool exact)
{
s_modules.sort(comp_gids);
- unsigned len = pfx ? strlen(pfx) : 0;
unsigned c = 0;
for ( auto p : s_modules )
const Module* m = p->mod;
assert(m);
- if ( pfx && strncmp(m->get_name(), pfx, len) )
+ if ( !selected(m, pfx, exact) )
continue;
unsigned gid = m->get_gid();
cout << "no match" << endl;
}
-void ModuleManager::show_pegs(const char* pfx)
+void ModuleManager::show_pegs(const char* pfx, bool exact)
{
s_modules.sort(comp_gids);
- unsigned len = pfx ? strlen(pfx) : 0;
unsigned c = 0;
for ( auto p : s_modules )
const Module* m = p->mod;
assert(m);
- if ( pfx && strncmp(m->get_name(), pfx, len) )
+ if ( !selected(m, pfx, exact) )
continue;
- const char** pegs = m->get_pegs();
+ const PegInfo* pegs = m->get_pegs();
if ( !pegs )
continue;
- while ( *pegs )
+ while ( pegs->name )
{
cout << Markup::item();
cout << Markup::emphasis_on();
- cout << Markup::escape(*pegs);
+ cout << Markup::escape(p->mod->get_name());
+ cout << "." << Markup::escape(pegs->name);
cout << Markup::emphasis_off();
+ cout << ": " << Markup::escape(pegs->help);
cout << endl;
++pegs;
}
cout << "no match" << endl;
}
-void ModuleManager::show_rules(const char* pfx)
+void ModuleManager::show_rules(const char* pfx, bool exact)
{
s_modules.sort(comp_gids);
- unsigned len = pfx ? strlen(pfx) : 0;
unsigned c = 0;
for ( auto p : s_modules )
{
const Module* m = p->mod;
- if ( pfx && strncmp(m->get_name(), pfx, len) )
+ if ( !selected(m, pfx, exact) )
continue;
const RuleMap* r = m->get_rules();
cout << "no match" << endl;
}
-void ModuleManager::dump_stats (SnortConfig*)
+void ModuleManager::dump_stats (SnortConfig*, const char* skip)
{
for ( auto p : s_modules )
- p->mod->show_stats();
+ {
+ if ( !skip || !strstr(skip, p->mod->get_name()) )
+ p->mod->show_stats();
+ }
}
void ModuleManager::accumulate (SnortConfig*)
static void list_modules(const char* = nullptr);
static void dump_modules();
static void show_modules();
-
static void show_module(const char*);
+
static void show_configs(const char* = nullptr, bool exact = false);
- static void show_commands(const char* = nullptr);
- static void show_gids(const char* = nullptr);
- static void show_pegs(const char* = nullptr);
- static void show_rules(const char* = nullptr);
+ static void show_commands(const char* = nullptr, bool exact = false);
+ static void show_gids(const char* = nullptr, bool exact = false);
+ static void show_pegs(const char* = nullptr, bool exact = false);
+ static void show_rules(const char* = nullptr, bool exact = false);
static void dump_rules(const char* = nullptr);
static void dump_defaults(const char* = nullptr);
static void reset_errors();
static unsigned get_errors();
- static void dump_stats(SnortConfig*);
+ static void dump_stats(SnortConfig*, const char* skip = nullptr);
static void accumulate(SnortConfig*);
static void reset_stats(SnortConfig*);
};
return true;
}
-const char** ArpSpoofModule::get_pegs() const
+const PegInfo* ArpSpoofModule::get_pegs() const
{ return simple_pegs; }
PegCount* ArpSpoofModule::get_counts() const
ArpSpoofConfig* get_config();
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
unsigned get_gid() const override
THREAD_LOCAL BindStats bstats;
-static const char* bind_pegs[] =
+static const PegInfo bind_pegs[] =
{
- "packets",
- "blocks",
- "allows",
- "inspects",
- nullptr
+ { "packets", "initial bindings" },
+ { "blocks", "block bindings" },
+ { "allows", "allow bindings" },
+ { "inspects", "inspect bindings" },
+ { nullptr, nullptr }
};
//-------------------------------------------------------------------------
return bindings; // move semantics
}
-const char** BinderModule::get_pegs() const
+const PegInfo* BinderModule::get_pegs() const
{ return bind_pegs; }
PegCount* BinderModule::get_counts() const
void add(const char* service, const char* type);
void add(unsigned proto, const char* type);
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
PC_MAX
} PegCounts;
-static const char* const pegName[PC_MAX] = {
- "ip4.trim",
- "ip4.tos",
- "ip4.df",
- "ip4.rf",
- "ip4.ttl",
- "ip4.opts",
- "icmp4.echo",
- "ip6.ttl",
- "ip6.opts",
- "icmp6.echo",
- "tcp.syn_opt",
- "tcp.ts_ecr",
- "tcp.opt",
- "tcp.pad",
- "tcp.rsv",
- "tcp.ecn_pkt",
- "tcp.ns",
- "tcp.urg",
- "tcp.urp"
+const PegInfo norm_names[] =
+{
+ { "ip4.trim", "eth packets trimmed to datagram size" },
+ { "ip4.tos", "type of service normalizations" },
+ { "ip4.df", "don't frag bit normalizations" },
+ { "ip4.rf", "reserved flag bit clears" },
+ { "ip4.ttl", "time-to-live normalizations" },
+ { "ip4.opts", "ip4 options cleared" },
+ { "icmp4.echo", "icmp4 ping normalizations" },
+ { "ip6.ttl", "ip6 hop limit normalizations" },
+ { "ip6.opts", "ip6 options cleared" },
+ { "icmp6.echo", "icmp6 echo normalizations" },
+ { "tcp.syn_opt", "SYN only options cleared from non-SYN packets" },
+ { "tcp.ts_ecr", "timestamp cleared on non-ACKs" },
+ { "tcp.opt", "packetw with options cleared" },
+ { "tcp.pad", "packetw with padding cleared" },
+ { "tcp.rsv", "packets with reserved bits cleared" },
+ { "tcp.ecn_pkt", "packets with ECN bits cleared" },
+ { "tcp.ns", "packets with nonce bit cleared" },
+ { "tcp.urg", "packets with urgent flag with urgent pointer cleared" },
+ { "tcp.urp", "packets without data with urgent poniter cleared" },
+ { nullptr, nullptr }
};
static THREAD_LOCAL PegCount normStats[PC_MAX];
void Norm_SumStats (void)
{
- sum_stats((PegCount*)&gnormStats, (PegCount*)&normStats, array_size(pegName));
+ sum_stats((PegCount*)&gnormStats, (PegCount*)&normStats, array_size(norm_names));
Stream_SumNormalizationStats();
}
// FIXIT-L would prefer to hide this logic in the stats methods somehow
static bool labeled()
{
- unsigned i = 0, max = array_size(pegName);
+ unsigned i = 0, max = array_size(norm_names);
while ( i < max && !gnormStats[i] )
++i;
void Norm_PrintStats (const char* name)
{
- show_stats((PegCount*)&gnormStats, pegName, array_size(pegName), name);
+ show_stats((PegCount*)&gnormStats, norm_names, array_size(norm_names), name);
if ( labeled() )
name = nullptr;
#ifndef NORM_H
#define NORM_H
-#include "snort.h"
#include "normalize.h"
#include "protocols/packet_manager.h"
+#include "utils/stats.h"
struct NormalizerConfig;
struct Packet;
typedef int (*NormalFunc)( // FIXIT-L why is this exposed?
struct NormalizerConfig*, Packet*, uint8_t layer, int changes);
+extern const PegInfo norm_names[];
+
struct NormalizerConfig
{
uint32_t normalizer_flags;
bool end(const char*, int, SnortConfig*) override;
ProfileStats* get_profile() const override;
+ const PegInfo* get_pegs() const override { return norm_names; };
const NormalizerConfig* get_config()
{ return &config; };
memset(&config, 0, sizeof(config));
}
-const char** PerfMonModule::get_pegs() const
+const PegInfo* PerfMonModule::get_pegs() const
{ return simple_pegs; }
PegCount* PerfMonModule::get_counts() const
bool set(const char*, Value&, SnortConfig*) override;
bool begin(const char*, int, SnortConfig*) override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
return tmp;
}
-const char** PortScanGlobalModule::get_pegs() const
+const PegInfo* PortScanGlobalModule::get_pegs() const
{ return simple_pegs; }
PegCount* PortScanGlobalModule::get_counts() const
bool set(const char*, Value&, SnortConfig*) override;
bool begin(const char*, int, SnortConfig*) override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
PsCommon* get_data();
unsigned get_gid() const override
{ return GID_BO; };
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
};
-const char** BoModule::get_pegs() const
+const PegInfo* BoModule::get_pegs() const
{ return simple_pegs; }
PegCount* BoModule::get_counts() const
public:
FtpDataModule() : Module(s_name, s_help) { };
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
{ return false; };
};
-const char** FtpDataModule::get_pegs() const
+const PegInfo* FtpDataModule::get_pegs() const
{ return simple_pegs; }
PegCount* FtpDataModule::get_counts() const
return true;
}
-const char** FtpServerModule::get_pegs() const
+const PegInfo* FtpServerModule::get_pegs() const
{ return simple_pegs; }
PegCount* FtpServerModule::get_counts() const
{ return GID_FTP; };
const RuleMap* get_rules() const override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
return true;
}
-const char** TelnetModule::get_pegs() const
+const PegInfo* TelnetModule::get_pegs() const
{ return simple_pegs; }
PegCount* TelnetModule::get_counts() const
{ return GID_TELNET; };
const RuleMap* get_rules() const override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
};
extern THREAD_LOCAL HIStats hi_stats;
-extern const char* peg_names[];
+extern const PegInfo peg_names[];
#endif
ProfileStats* HttpInspectModule::get_profile() const
{ return &hiPerfStats; }
-const char** HttpInspectModule::get_pegs() const
+const PegInfo* HttpInspectModule::get_pegs() const
{ return peg_names; }
PegCount* HttpInspectModule::get_counts() const
{ return GID_HTTP_CLIENT; };
const RuleMap* get_rules() const override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
THREAD_LOCAL ProfileStats hiPerfStats;
THREAD_LOCAL ProfileStats hiDetectPerfStats;
-const char* peg_names[] =
+const PegInfo peg_names[] =
{
- "packets",
- "gets",
- "posts",
-
- "request headers",
- "response headers",
- "request cookies",
- "response cookies",
- "post params",
-
- "unicode",
- "double unicode",
- "non-ascii",
- "paths with ../",
- "paths with //",
- "paths with ./",
-
- "gzip packets",
- "compressed bytes",
- "decompressed bytes",
- nullptr,
+ { "packets", "total packets processed" },
+ { "gets", "GET requests" },
+ { "posts", "POST requests" },
+
+ { "request headers", "total requests" },
+ { "response headers", "total responses" },
+ { "request cookies", "requests with Cookie" },
+ { "response cookies", "responses with Set-Cookie" },
+ { "post params", "POST parameters extracted" },
+
+ { "unicode", "unicode normalizations" },
+ { "double unicode", "double unicode normalizations" },
+ { "non-ascii", "non-ascii normalizations" },
+ { "paths with ../", "directory traversal normalizations" },
+ { "paths with //", "double slash normalizations" },
+ { "paths with ./", "relative directory normalizations" },
+
+ { "gzip packets", "packets with gzip compression" },
+ { "compressed bytes", "total comparessed bytes processed" },
+ { "decompressed bytes", "total bytes decompressed" },
+
+ { nullptr, nullptr }
};
THREAD_LOCAL int hiDetectCalled = 0;
const RuleMap* RpcDecodeModule::get_rules() const
{ return rpc_rules; }
-const char** RpcDecodeModule::get_pegs() const
+const PegInfo* RpcDecodeModule::get_pegs() const
{ return simple_pegs; }
PegCount* RpcDecodeModule::get_counts() const
{ return GID_RPC_DECODE; };
const RuleMap* get_rules() const override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
};
return b;
}
-const char** WizardModule::get_pegs() const
+const PegInfo* WizardModule::get_pegs() const
{ return wiz_pegs; }
PegCount* WizardModule::get_counts() const
#define WIZ_NAME "wizard"
#define WIZ_HELP "inspector that implements port-independent protocol identification"
-extern const char* wiz_pegs[];
+extern const PegInfo wiz_pegs[];
extern THREAD_LOCAL struct WizStats tstats;
extern THREAD_LOCAL ProfileStats wizPerfStats;
bool begin(const char*, int, SnortConfig*) override;
bool end(const char*, int, SnortConfig*) override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
ProfileStats* get_profile() const override;
PegCount udp_hits;
};
-const char* wiz_pegs[] =
+const PegInfo wiz_pegs[] =
{
- "tcp scans",
- "tcp hits",
- "udp scans",
- "udp hits",
- nullptr
+ { "tcp scans", "tcp payload scans" },
+ { "tcp hits", "tcp identifications" },
+ { "udp scans", "udp payload scans" },
+ { "udp hits", "udp identifications" },
+ { nullptr, nullptr }
};
THREAD_LOCAL WizStats tstats;
THREAD_LOCAL ProfileStats s5PerfStats;
THREAD_LOCAL FlowControl* flow_con = nullptr;
-const char* session_pegs[] =
-{
- "sessions",
- "prunes",
- "timeouts",
- "created",
- "released",
- "discards",
- "events",
- nullptr
-};
-
-const unsigned session_peg_count = array_size(session_pegs);
-
struct BaseStats
{
PegCount tcp_flows;
static BaseStats g_stats;
static THREAD_LOCAL BaseStats t_stats;
-static const char* const base_pegs[] =
+const PegInfo base_pegs[] =
{
- "tcp flows",
- "tcp prunes",
- "udp flows",
- "udp prunes",
- "icmp flows",
- "icmp prunes",
- "ip flows",
- "ip prunes"
+ { "tcp flows", "total tcp sessions" },
+ { "tcp prunes", "tcp sessions pruned" },
+ { "udp flows", "total udp sessions" },
+ { "udp prunes", "udp sessions pruned" },
+ { "icmp flows", "total icmp sessions" },
+ { "icmp prunes", "icmp sessions pruned" },
+ { "ip flows", "total ip sessions" },
+ { "ip prunes", "ip sessions pruned" },
+ { nullptr, nullptr }
};
void base_sum()
t_stats.ip_prunes = flow_con->get_prunes(IPPROTO_IP);
sum_stats((PegCount*)&g_stats, (PegCount*)&t_stats,
- array_size(base_pegs));
+ array_size(base_pegs)-1);
}
void base_stats()
{
- show_stats((PegCount*)&g_stats, base_pegs, array_size(base_pegs),
- MOD_NAME);
+ show_stats((PegCount*)&g_stats, base_pegs, array_size(base_pegs)-1, MOD_NAME);
}
void base_reset()
proto = &stream_cfg.ip_cfg;
}
+const PegInfo* StreamModule::get_pegs() const
+{ return base_pegs; }
+
ProfileStats* StreamModule::get_profile() const
{ return &s5PerfStats; }
bool set(const char*, Value&, SnortConfig*) override;
bool begin(const char*, int, SnortConfig*) override;
+ const PegInfo* get_pegs() const override;
ProfileStats* get_profile() const override;
const StreamConfig* get_data();
return true;
}
-const char** StreamIcmpModule::get_pegs() const
-{ return session_pegs; }
+const PegInfo* StreamIcmpModule::get_pegs() const
+{ return icmp_pegs; }
PegCount* StreamIcmpModule::get_counts() const
{ return (PegCount*)&icmpStats; }
#include "main/thread.h"
#include "stream/stream.h"
-extern THREAD_LOCAL SessionStats icmpStats;
+extern const PegInfo icmp_pegs[];
+extern THREAD_LOCAL struct IcmpStats icmpStats;
extern THREAD_LOCAL ProfileStats icmp_perf_stats;
struct SnortConfig;
bool end(const char*, int, SnortConfig*) override;
ProfileStats* get_profile() const override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
StreamIcmpConfig* get_data();
#include "protocols/tcp.h"
#include "sfip/sf_ip.h"
-THREAD_LOCAL SessionStats icmpStats;
+struct IcmpStats
+{
+ PegCount created;
+ PegCount released;
+};
+
+const PegInfo icmp_pegs[] =
+{
+ { "created", "icmp session trackers created" },
+ { "released", "icmp session trackers released" },
+ { nullptr, nullptr }
+};
+
+THREAD_LOCAL IcmpStats icmpStats;
THREAD_LOCAL ProfileStats icmp_perf_stats;
//------------------------------------------------------------------------
};
/* statistics tracking struct */
-struct FragStats
+struct IpStats
{
PegCount total;
PegCount reassembles;
PegCount trackers_released;
PegCount nodes_created;
PegCount nodes_released;
-
};
-static const char* const peg_names[] =
+const PegInfo ip_pegs[] =
{
- "fragments",
- "reassembled",
- "discards",
- "memory faults",
- "frag timeouts",
- "overlaps",
- "anomalies",
- "alerts",
- "drops",
- "trackers added",
- "trackers freed",
- "nodes inserted",
- "nodes deleted"
+ { "fragments", "total fragments" },
+ { "reassembled", "reassembled datagrams" },
+ { "discards", "fragments discarded" },
+ { "memory faults", "memory faults" },
+ { "frag timeouts", "datagrams abandoned" },
+ { "overlaps", "overlapping fragments" },
+ { "anomalies", "anomalies detected" },
+ { "alerts", "alerts generated" },
+ { "drops", "fragments dropped" },
+ { "trackers added", "datagram trackers created" },
+ { "trackers freed", "datagram trackers released" },
+ { "nodes inserted", "fragments added to tracker" },
+ { "nodes deleted", "fragments deleted from tracker" },
};
/* G L O B A L S **************************************************/
// FIXIT-M convert to session memcap
static THREAD_LOCAL unsigned long mem_in_use = 0; /* memory in use, used for self pres */
-static THREAD_LOCAL FragStats t_stats;
-static FragStats g_stats;
+THREAD_LOCAL IpStats ip_stats;
static THREAD_LOCAL uint32_t pkt_snaplen = 0;
static THREAD_LOCAL Packet** defrag_pkts; // An array of Packet pointers
static inline void EventAnomIpOpts(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_IPOPTIONS);
- t_stats.alerts++;
+ ip_stats.alerts++;
}
/**
static inline void EventAttackTeardrop(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_TEARDROP);
- t_stats.alerts++;
+ ip_stats.alerts++;
}
/**
static inline void EventTinyFragments(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_TINY_FRAGMENT);
- t_stats.alerts++;
+ ip_stats.alerts++;
}
/**
static inline void EventExcessiveOverlap(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_EXCESSIVE_OVERLAP);
- t_stats.alerts++;
+ ip_stats.alerts++;
}
/**
static inline void EventAnomShortFrag(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_SHORT_FRAG);
- t_stats.alerts++;
- t_stats.anomalies++;
+ ip_stats.alerts++;
+ ip_stats.anomalies++;
}
/**
static inline void EventAnomOversize(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_OVERSIZE);
- t_stats.alerts++;
- t_stats.anomalies++;
+ ip_stats.alerts++;
+ ip_stats.anomalies++;
}
/**
static inline void EventAnomZeroFrag(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_ZERO);
- t_stats.alerts++;
- t_stats.anomalies++;
+ ip_stats.alerts++;
+ ip_stats.anomalies++;
}
/**
static inline void EventAnomBadsizeLg(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_BADSIZE_LG);
- t_stats.alerts++;
- t_stats.anomalies++;
+ ip_stats.alerts++;
+ ip_stats.anomalies++;
}
/**
static inline void EventAnomBadsizeSm(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_BADSIZE_SM);
- t_stats.alerts++;
- t_stats.anomalies++;
+ ip_stats.alerts++;
+ ip_stats.anomalies++;
}
/**
static inline void EventAnomOverlap(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_ANOMALY_OVLP);
- t_stats.alerts++;
- t_stats.anomalies++;
+ ip_stats.alerts++;
+ ip_stats.anomalies++;
}
/**
static inline void EventAnomScMinTTL(FragEngine*)
{
SnortEventqAdd(GID_DEFRAG, DEFRAG_MIN_TTL_EVASION);
- t_stats.alerts++;
+ ip_stats.alerts++;
}
#if 0
DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
"Processing rebuilt packet:\n"););
- t_stats.reassembles++;
+ ip_stats.reassembles++;
UpdateIPReassStats(&sfBase, dpkt->pkth->caplen);
sfBase.frag3_mem_in_use = mem_in_use;
}
- t_stats.nodes_released++;
+ ip_stats.nodes_released++;
}
/**
delete_tracker(ft);
ft->engine = nullptr;
- t_stats.trackers_released++;
+ ip_stats.trackers_released++;
}
//-------------------------------------------------------------------------
#endif
EventAnomScMinTTL(fe);
- t_stats.discards++;
+ ip_stats.discards++;
return;
}
- t_stats.total++;
+ ip_stats.total++;
UpdateIPFragStats(&sfBase, p->pkth->caplen);
MODULE_PROFILE_START(fragPerfStats);
{
DisableDetect(p);
Active_DropPacket();
- t_stats.drops++;
+ ip_stats.drops++;
}
/*
p->dsize););
}
#endif
- t_stats.discards++;
+ ip_stats.discards++;
MODULE_PROFILE_END(fragPerfStats);
return;
case FRAG_INSERT_ATTACK:
case FRAG_INSERT_ANOMALY:
- t_stats.discards++;
+ ip_stats.discards++;
MODULE_PROFILE_END(fragPerfStats);
return;
case FRAG_INSERT_TIMEOUT:
(p->ptrs.decode_flags & DECODE_MF),
(frag_offset << 3), p->dsize);
#endif
- t_stats.discards++;
+ ip_stats.discards++;
MODULE_PROFILE_END(fragPerfStats);
return;
default:
if(overlap > 0)
{
- t_stats.overlaps++;
+ ip_stats.overlaps++;
ft->overlap_count++;
if(frag_end < ft->calculated_size ||
*/
if(overlap < right->size)
{
- t_stats.overlaps++;
+ ip_stats.overlaps++;
ft->overlap_count++;
DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
*/
EventAnomOverlap(fe);
alerted_overlap = 1;
- t_stats.overlaps++;
+ ip_stats.overlaps++;
ft->overlap_count++;
}
"zero size frag (len: %d overlap: %d)\n",
fragLength, overlap););
- t_stats.discards++;
+ ip_stats.discards++;
MODULE_PROFILE_END(fragInsertPerfStats);
return FRAG_INSERT_ANOMALY;
sfBase.frag3_mem_in_use = mem_in_use;
}
- t_stats.nodes_created++;
+ ip_stats.nodes_created++;
sfBase.iFragCreates++;
sfBase.iCurrentFrags++;
if (sfBase.iCurrentFrags > sfBase.iMaxFrags)
if ( p->is_ip4() )
FragHandleIPOptions(ft, p, frag_off);
- t_stats.trackers_created++;
+ ip_stats.trackers_created++;
return 1;
}
"(len: %d slide: %d trunc: %d)\n",
len, slide, trunc););
- t_stats.discards++;
+ ip_stats.discards++;
#ifdef DEBUG_MSGS
newfrag = ft->fraglist;
sfBase.frag3_mem_in_use = mem_in_use;
}
- t_stats.nodes_created++;
+ ip_stats.nodes_created++;
newfrag->flen = fragLength;
memcpy(newfrag->fptr, fragStart, fragLength);
sfBase.frag3_mem_in_use = mem_in_use;
}
- t_stats.nodes_created++;
+ ip_stats.nodes_created++;
newfrag->ord = ft->ordinal++;
/*
*/
delete_tracker(ft);
- t_stats.timeouts++;
+ ip_stats.timeouts++;
sfBase.iFragTimeouts++;
return FRAG_TRACKER_TIMEOUT;
return FRAG_OK;
}
-//-------------------------------------------------------------------------
-// static methods
-//-------------------------------------------------------------------------
-
-void Defrag::sum()
-{
- sum_stats((PegCount*)&g_stats, (PegCount*)&t_stats, array_size(peg_names));
-}
-
-void Defrag::stats()
-{
- show_stats((PegCount*)&g_stats, peg_names, array_size(peg_names), nullptr);
-}
-
-void Defrag::reset()
-{
- memset(&g_stats, 0, sizeof(g_stats));
-}
-
void tterm();
static void init();
- static void sum();
- static void stats();
- static void reset();
private:
int insert(Packet*, FragTracker*, FragEngine*);
return true;
}
-const char** StreamIpModule::get_pegs() const
-{ return session_pegs; }
+const PegInfo* StreamIpModule::get_pegs() const
+{ return ip_pegs; }
PegCount* StreamIpModule::get_counts() const
-{ return (PegCount*)&ipStats; }
-
-void StreamIpModule::sum_stats()
-{
- Module::sum_stats();
- Defrag::sum();
-}
-
-void StreamIpModule::show_stats()
-{
- Module::show_stats();
- Defrag::stats();
-}
-
-void StreamIpModule::reset_stats()
-{
- Module::reset_stats();
- Defrag::reset();
-}
+{ return (PegCount*)&ip_stats; }
#define DEFRAG_EXCESSIVE_OVERLAP 12
#define DEFRAG_TINY_FRAGMENT 13
-extern THREAD_LOCAL SessionStats ipStats;
+extern const PegInfo ip_pegs[];
+extern THREAD_LOCAL struct IpStats ip_stats;
extern THREAD_LOCAL ProfileStats ip_perf_stats;
extern THREAD_LOCAL ProfileStats fragPerfStats;
extern THREAD_LOCAL ProfileStats fragInsertPerfStats;
const RuleMap* get_rules() const override;
ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
StreamIpConfig* get_data();
unsigned get_gid() const override
{ return GID_DEFRAG; };
- void sum_stats() override;
- void show_stats() override;
- void reset_stats() override;
-
private:
StreamIpConfig* config;
};
#include "flow/flow_control.h"
#include "sfip/sf_ip.h"
-THREAD_LOCAL SessionStats ipStats;
THREAD_LOCAL ProfileStats ip_perf_stats;
//-------------------------------------------------------------------------
"Stream IP session created!\n"););
memset(&tracker, 0, sizeof(tracker));
- ipStats.sessions++;
+ // FIXIT count ip session creates here
sfip_copy(flow->client_ip, p->ptrs.ip_api.get_src());
sfip_copy(flow->server_ip, p->ptrs.ip_api.get_dst());
if ( stream.expired_session(flow, p) )
{
IpSessionCleanup(flow, &tracker);
- ipStats.timeouts++;
+ // FIXIT count ip sessiont imeouts here
#ifdef ENABLE_EXPECTED_IP
if ( flow_con->expected_session(flow, p))
} tPortFilterStats;
#endif
-struct SessionStats
-{
- PegCount sessions;
- PegCount prunes;
- PegCount timeouts;
- PegCount created;
- PegCount released;
- PegCount discards;
- PegCount events;
-};
-
// shared stream state
extern THREAD_LOCAL Memcap* tcp_memcap;
extern THREAD_LOCAL class FlowControl* flow_con;
-
-extern const char* session_pegs[];
-extern const unsigned session_peg_count;
+extern const PegInfo base_pegs[];
void Stream_SumNormalizationStats(void);
void Stream_PrintNormalizationStats(const char* name = nullptr);
return true;
}
-const char** StreamTcpModule::get_pegs() const
+const PegInfo* StreamTcpModule::get_pegs() const
{ return tcp_pegs; }
PegCount* StreamTcpModule::get_counts() const
#define STREAM_TCP_WINDOW_SLAM 19
#define STREAM_TCP_NO_3WHS 20
-extern const char* tcp_pegs[];
+extern const PegInfo tcp_pegs[];
extern THREAD_LOCAL struct TcpStats tcpStats;
extern THREAD_LOCAL ProfileStats s5TcpPerfStats;
extern THREAD_LOCAL ProfileStats s5TcpNewSessPerfStats;
StreamTcpConfig* get_data();
ProfileStats* get_profile(unsigned, const char*&, const char*&) const override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
private:
PegCount s5tcp2;
};
-const char* tcp_pegs[] =
-{
- "sessions",
- "timeouts",
- "resyns",
- "discards",
- "events",
- "ignored",
- "untracked",
- "syn trackers",
- "syn-ack trackers",
- "3way trackers",
- "data trackers",
- "trackers created",
- "trackers released",
- "segs queued",
- "segs released",
- "segs split",
- "segs used",
- "rebuilt packets",
- "rebuilt buffers",
- "overlaps",
- "gaps",
- "max segs",
- "max bytes",
- "internal events",
- "client cleanups",
- "server cleanups",
- nullptr
+const PegInfo tcp_pegs[] =
+{
+ { "sessions", "total sessions" },
+ { "timeouts", "sessions timed out" },
+ { "resyns", "SYN received on established session" },
+ { "discards", "tcp packets discarded" },
+ { "events", "events generated" },
+ { "ignored", "tcp packets ignored" },
+ { "untracked", "tcp packets not tracked" },
+ { "syn trackers", "tcp session tracking started on syn" },
+ { "syn-ack trackers", "tcp session tracking started on syn-ack" },
+ { "3way trackers", "tcp session tracking started on ack" },
+ { "data trackers", "tcp session tracking started on data" },
+ { "trackers created", "tcp session trackers created" },
+ { "trackers released", "tcp session trackers released" },
+ { "segs queued", "total segments queued" },
+ { "segs released", "total segments released" },
+ { "segs split", "tcp segments split when reassembling PDUs" },
+ { "segs used", "queued tcp segments applied to reassembled PDUs" },
+ { "rebuilt packets", "total reassembled PDUs" },
+ { "rebuilt buffers", "rebuilt PDU sections" },
+ { "overlaps", "overlapping segments queued" },
+ { "gaps", "missing data between PDUs" },
+ { "max segs", "number of times the maximum queued segment limit was reached" },
+ { "max bytes", "number of times the maximum queued byte limit was reached" },
+ { "internal events", "135:X events generated" },
+ { "client cleanups", "number of times data from server was flushed when session released" },
+ { "server cleanups", "number of times data from client was flushed when session released" },
+ { nullptr, nullptr }
};
THREAD_LOCAL TcpStats tcpStats;
static PegCount gnormStats[PC_MAX];
static THREAD_LOCAL PegCount normStats[PC_MAX];
-static const char* const pegName[PC_MAX] = {
- "tcp.trim",
- "tcp.ecn_ssn",
- "tcp.ts_nop",
- "tcp.ips_data",
- "tcp.block",
+static const PegInfo pegName[PC_MAX] =
+{
+ { "tcp.trim", "tcp segments trimmed to correct size" },
+ { "tcp.ecn_ssn", "ECN bits cleared" },
+ { "tcp.ts_nop", "timestamp options cleared" },
+ { "tcp.ips_data", "normalized segments" },
+ { "tcp.block", "blocked segments" },
};
void Stream_SumNormalizationStats()
return true;
}
-const char** StreamUdpModule::get_pegs() const
-{ return session_pegs; }
+const PegInfo* StreamUdpModule::get_pegs() const
+{ return udp_pegs; }
PegCount* StreamUdpModule::get_counts() const
{ return (PegCount*)&udpStats; }
struct SnortConfig;
-extern THREAD_LOCAL SessionStats udpStats;
+extern const PegInfo udp_pegs[];
+extern THREAD_LOCAL struct UdpStats udpStats;
extern THREAD_LOCAL ProfileStats udp_perf_stats;
//-------------------------------------------------------------------------
bool end(const char*, int, SnortConfig*) override;
ProfileStats* get_profile() const override;
- const char** get_pegs() const override;
+ const PegInfo* get_pegs() const override;
PegCount* get_counts() const override;
StreamUdpConfig* get_data();
// NOTE: sender is assumed to be client
// responder is assumed to be server
-THREAD_LOCAL SessionStats udpStats;
+struct UdpStats
+{
+ PegCount sessions;
+ PegCount created;
+ PegCount released;
+ PegCount timeouts;
+};
+
+const PegInfo udp_pegs[] =
+{
+ { "sessions", "total udp sessions" },
+ { "created", "udp session trackers created" },
+ { "released", "udp session trackers released" },
+ { "timeouts", "udp session timeouts" },
+ { nullptr, nullptr }
+};
+
+THREAD_LOCAL UdpStats udpStats;
THREAD_LOCAL ProfileStats udp_perf_stats;
//-------------------------------------------------------------------------
static DAQ_Stats_t g_daq_stats;
static PacketCount gpc;
+static AuxCount gaux;
+
THREAD_LOCAL PacketCount pc;
+THREAD_LOCAL AuxCount aux_counts;
ProcessCount proc_stats;
//-------------------------------------------------------------------------
struct DAQStats
{
+ PegCount pcaps;
PegCount received;
PegCount analyzed;
PegCount dropped;
PegCount filtered;
PegCount outstanding;
PegCount injected;
+ PegCount verdicts[MAX_DAQ_VERDICT];
#ifdef REG_TEST
PegCount skipped;
#endif
-};
-
-struct DAQVerdicts
-{
- PegCount verdicts[MAX_DAQ_VERDICT];
- PegCount internal_blacklist;
- PegCount internal_whitelist;
+ PegCount fail_open;
+ PegCount idle;
};
//-------------------------------------------------------------------------
+// FIXIT-L need better encapsulation of these counts by their modules
-static const char* const simple_names[] =
-{
- "packets"
-};
-
-static const char* const daq_names[] =
+const PegInfo daq_names[] =
{
- "received",
- "analyzed",
- "dropped",
- "filtered",
- "outstanding",
- "injected"
+ { "pcaps", "total files processed" },
+ { "received", "total packets received from DAQ" },
+ { "analyzed", "total packets analyzed from DAQ" },
+ { "dropped", "packets dropped" },
+ { "filtered", "packets filtered out" },
+ { "outstanding", "packets unprocessed" },
+ { "injected", "active responses or replacements" },
+ { "allow", "total allow verdicts" },
+ { "block", "total block verdicts" },
+ { "replace", "total replace verdicts" },
+ { "whitelist", "total whitelist verdicts" },
+ { "blacklist", "total blacklist verdicts" },
+ { "ignore", "total ignore verdicts" },
#ifdef REG_TEST
- , "skipped"
+ { "skipped", "packets skipped at startup" },
#endif
+ { "fail open", "packets passed during initialization" },
+ { "idle", "attempts to acquire from DAQ without available packets" },
+ { nullptr, nullptr }
};
-const char* const verdict_names[] =
+const PegInfo pc_names[] =
{
- "allow",
- "block",
- "replace",
- "whitelist",
- "blacklist",
- "ignore",
- "internal blacklist",
- "internal whitelist"
+ { "analyzed", "packets sent to detection" },
+ { "alerts", "alerts not including IP reputation" },
+ { "total alerts", "alerts including IP reputation" },
+ { "logged", "logged packets" },
+ { "passed", "passed packets" },
+ { "match limit", "fast pattern matches not processed" },
+ { "queue limit", "events not queued because queue full" },
+ { "log limit", "events queued but not logged" },
+ { "event limit", "events filtered" },
+ { "alert limit", "events previously triggered on same PDU" },
+ { "internal blacklist", "packets blacklisted internally due to lack of DAQ support" },
+ { "internal whitelist", "packets whitelisted internally due to lack of DAQ support" },
+ { nullptr, nullptr }
};
-static const char* const pc_names[] =
+const PegInfo proc_names[] =
{
- "analyzed",
- "fail open",
- "alerts",
- "total alerts",
- "logged",
- "passed",
- "match limit",
- "queue limit",
- "log limit",
- "event limit",
- "alert limit",
- "internal blacklist",
- "internal whitelist",
- "idle"
-};
-
-static const char* const proc_names[] =
-{
- "local commands",
- "remote commands",
- "signals",
- "conf reloads",
- "attribute table reloads",
- "attribute table hosts"
+ { "local commands", "total local commands processed" },
+ { "remote commands", "total remote commands processed" },
+ { "signals", "total signals processed" },
+ { "conf reloads", "number of times configuration was reloaded" },
+ { "attribute table reloads", "number of times hosts table was reloaded" },
+ { "attribute table hosts", "total number of hosts in table" },
+ { nullptr, nullptr }
};
//-------------------------------------------------------------------------
sum_stats((PegCount*)&gpc, (PegCount*)&pc, array_size(pc_names));
memset(&pc, 0, sizeof(pc));
+
+ sum_stats((PegCount*)&gaux, (PegCount*)&aux_counts, sizeof(aux_counts)/sizeof(PegCount));
+ memset(&aux_counts, 0, sizeof(aux_counts));
}
//-------------------------------------------------------------------------
-void DropStats()
+static void get_daq_stats(DAQStats& daq_stats)
{
- const DAQ_Stats_t* pkt_stats = &g_daq_stats;
+ uint64_t pkts_recv = g_daq_stats.hw_packets_received;
+ uint64_t pkts_drop = g_daq_stats.hw_packets_dropped;
+ uint64_t pkts_inj = g_daq_stats.packets_injected + Active_GetInjects();
- LogLabel("Packet Statistics");
-
- {
- uint64_t pkts_out, pkts_inj;
-
- uint64_t pkts_recv = pkt_stats->hw_packets_received;
- uint64_t pkts_drop = pkt_stats->hw_packets_dropped;
-
- if ( pkts_recv > pkt_stats->packets_filtered
- + pkt_stats->packets_received )
- pkts_out = pkts_recv - pkt_stats->packets_filtered
- - pkt_stats->packets_received;
- else
- pkts_out = 0;
-
- pkts_inj = pkt_stats->packets_injected;
- pkts_inj += Active_GetInjects();
-
- DAQStats daq_stats;
- daq_stats.received = pkts_recv;
- daq_stats.analyzed = pkt_stats->packets_received;
- daq_stats.dropped = pkts_drop;
- daq_stats.filtered = pkt_stats->packets_filtered;
- daq_stats.outstanding = pkts_out;
- daq_stats.injected = pkts_inj;
-#ifdef REG_TEST
- daq_stats.skipped = snort_conf->pkt_skip;
-#endif
+ uint64_t pkts_out = 0;
- if ( pkts_recv )
- LogLabel("daq");
+ if ( pkts_recv > g_daq_stats.packets_filtered + g_daq_stats.packets_received )
+ pkts_out = pkts_recv - g_daq_stats.packets_filtered - g_daq_stats.packets_received;
- PegCount pcaps = Trough_GetFileCount();
- if ( pcaps )
- LogCount("pcaps", pcaps);
- show_stats((PegCount*)&daq_stats, daq_names, array_size(daq_names));
+ daq_stats.pcaps = Trough_GetFileCount();
+ daq_stats.received = pkts_recv;
+ daq_stats.analyzed = g_daq_stats.packets_received;
+ daq_stats.dropped = pkts_drop;
+ daq_stats.filtered = g_daq_stats.packets_filtered;
+ daq_stats.outstanding = pkts_out;
+ daq_stats.injected = pkts_inj;
- DAQVerdicts daq_verdicts;
+ for ( unsigned i = 0; i < MAX_DAQ_VERDICT; i++ )
+ daq_stats.verdicts[i] = g_daq_stats.verdicts[i];
- for ( unsigned i = 0; i < MAX_DAQ_VERDICT; i++ )
- daq_verdicts.verdicts[i] = pkt_stats->verdicts[i];
+#ifdef REG_TEST
+ daq_stats.skipped = snort_conf->pkt_skip;
+#endif
+ daq_stats.fail_open = gaux.total_fail_open;
+ daq_stats.idle = gaux.idle;
+}
- daq_verdicts.internal_blacklist = pc.internal_blacklist;
- daq_verdicts.internal_whitelist = pc.internal_whitelist;
+void DropStats()
+{
+ LogLabel("Packet Statistics");
- show_stats((PegCount*)&daq_verdicts, verdict_names, array_size(verdict_names));
- }
+ DAQStats daq_stats;
+ get_daq_stats(daq_stats);
+ show_stats((PegCount*)&daq_stats, daq_names, array_size(daq_names)-1, "daq");
PacketManager::dump_stats();
//mpse_print_qinfo();
LogLabel("Module Statistics");
- ModuleManager::dump_stats(snort_conf);
+ const char* exclude = "daq detection snort";
+ ModuleManager::dump_stats(snort_conf, exclude);
// ensure proper counting of log_limit
SnortEventqResetCounts();
gpc.total_alert_pkts = 0;
LogLabel("Summary Statistics");
- show_stats((PegCount*)&gpc, pc_names, array_size(pc_names), "detection");
+ show_stats((PegCount*)&gpc, pc_names, array_size(pc_names)-1, "detection");
#ifdef PPM_MGR
PPM_PRINT_SUMMARY(&snort_conf->ppm_cfg);
#endif
proc_stats.attribute_table_hosts = SFAT_NumberOfHosts();
- show_stats((PegCount*)&proc_stats, proc_names, array_size(proc_names), "process");
+ show_stats((PegCount*)&proc_stats, proc_names, array_size(proc_names)-1, "process");
}
//-------------------------------------------------------------------------
}
void show_stats(
- PegCount* pegs, const char* const names[], unsigned n, const char* module_name)
+ PegCount* pegs, const PegInfo* info, unsigned n, const char* module_name)
{
bool head = false;
for ( unsigned i = 0; i < n; ++i )
{
PegCount c = pegs[i];
- const char* s = names[i];
+ const char* s = info[i].name;
if ( !c )
continue;
}
void show_percent_stats(
- PegCount* pegs, const char* const names[], unsigned n, const char* module_name)
+ PegCount* pegs, const char* names[], unsigned n, const char* module_name)
{
bool head = false;
}
}
-//-------------------------------------------------------------------------
-
-void sum_stats(SimpleStats* sums, SimpleStats* counts)
-{
- sum_stats((PegCount*)sums, (PegCount*)counts, array_size(simple_names));
-}
-
-void show_stats(SimpleStats* sums, const char* module_name)
-{
- show_stats((PegCount*)sums, simple_names, array_size(simple_names), module_name);
-}
-
struct PacketCount
{
PegCount total_from_daq;
- PegCount total_fail_open;
PegCount alert_pkts;
PegCount total_alert_pkts;
PegCount log_pkts;
PegCount alert_limit;
PegCount internal_blacklist;
PegCount internal_whitelist;
- PegCount idle;
};
struct ProcessCount
PegCount attribute_table_hosts;
};
+struct AuxCount
+{
+ PegCount total_fail_open;
+ PegCount idle;
+};
+
extern SO_PUBLIC ProcessCount proc_stats;
extern SO_PUBLIC THREAD_LOCAL PacketCount pc;
+extern SO_PUBLIC THREAD_LOCAL AuxCount aux_counts;
+
+extern const PegInfo daq_names[];
+extern const PegInfo pc_names[];
+extern const PegInfo proc_names[];
void LogLabel(const char*);
void LogCount(const char*, uint64_t);
void LogStat(const char*, double);
void sum_stats(PegCount* sums, PegCount* counts, unsigned n);
-void show_stats(PegCount*, const char* const names[], unsigned n,
+void show_stats(PegCount*, const PegInfo*, unsigned n,
const char* module_name = nullptr);
-void show_percent_stats(PegCount*, const char* const names[], unsigned n,
+void show_percent_stats(PegCount*, const char*[], unsigned n,
const char* module_name = nullptr);
void sum_stats(SimpleStats* sums, SimpleStats* counts);
#include <limits.h>
#include <fcntl.h>
#include <zlib.h>
+#include <luajit-2.0/luajit.h>
#include <sys/types.h>
#include <sys/stat.h>
****************************************************************************/
int DisplayBanner(void)
{
- const char * info;
- const char * pcre_ver;
- const char * zlib_ver;
-
- info = getenv("HOSTTYPE");
+ const char* info = getenv("HOSTTYPE");
if( !info )
info="from 2.9.6-9"; // last sync with head
- pcre_ver = pcre_version();
- zlib_ver = zlib_version;
+ const char* ljv = LUAJIT_VERSION;
+ while ( *ljv && !isdigit(*ljv) )
+ ++ljv;
LogMessage("\n");
LogMessage(" ,,_ -*> Snort++ <*-\n");
#ifdef HAVE_PCAP_LIB_VERSION
LogMessage(" Using %s\n", pcap_lib_version());
#endif
- LogMessage(" Using PCRE version: %s\n", pcre_ver);
- LogMessage(" Using ZLIB version: %s\n", zlib_ver);
+ LogMessage(" Using LuaJIT version %s\n", ljv);
+ LogMessage(" Using PCRE version %s\n", pcre_version());
+ LogMessage(" Using ZLIB version %s\n", zlib_version);
LogMessage("\n");
return 0;
projects / thirdparty / snort3.git / commitdiff
