Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add CaptureLoss::Too_Little_Traffic

Browse source
This commit is contained in:
Vlad Grigorescu 2020-10-08 11:26:46 -05:00
parent cb9d419fa4
commit 59620ed75d
1 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/policy/misc/capture-loss.zeek
View file

@ -19,7 +19,10 @@ export {
redef enum Notice::Type += { redef enum Notice::Type += {
## Report if the detected capture loss exceeds the percentage ## Report if the detected capture loss exceeds the percentage
## threshold defined in :zeek:id:`CaptureLoss::too_much_loss`. ## threshold defined in :zeek:id:`CaptureLoss::too_much_loss`.
Too_Much_Loss Too_Much_Loss,
## Report if the traffic seen by a peer within a given watch
## interval is less than :zeek:id:`CaptureLoss::minimum_acks`.
Too_Little_Traffic,
}; };
type Info: record { type Info: record {
@ -52,6 +55,11 @@ export {
## generated. The value is expressed as a double between 0 and 1 with 1 ## generated. The value is expressed as a double between 0 and 1 with 1
## being 100%. ## being 100%.
option too_much_loss: double = 0.1; option too_much_loss: double = 0.1;
## The minimum number of ACKs expected for a single peer in a
## watch interval. If the number seen is less than this,
## :zeek:enum:`CaptureLoss::Too_Little_Traffic` is raised.
option minimum_acks: count = 1;
} }
event CaptureLoss::take_measurement(last_ts: time, last_acks: count, last_gaps: count) event CaptureLoss::take_measurement(last_ts: time, last_acks: count, last_gaps: count)
@ -77,6 +85,10 @@ event CaptureLoss::take_measurement(last_ts: time, last_acks: count, last_gaps:
NOTICE([$note=Too_Much_Loss, NOTICE([$note=Too_Much_Loss,
$msg=fmt("The capture loss script detected an estimated loss rate above %.3f%%", pct_lost)]); $msg=fmt("The capture loss script detected an estimated loss rate above %.3f%%", pct_lost)]);
if ( acks < minimum_acks )
NOTICE([$note=Too_Little_Traffic,
$msg=fmt("The worker only observed %d ACKs and was expecting at least %d.", acks, minimum_acks)]);
Log::write(LOG, info); Log::write(LOG, info);
schedule watch_interval { CaptureLoss::take_measurement(now, g$ack_events, g$gap_events) }; schedule watch_interval { CaptureLoss::take_measurement(now, g$ack_events, g$gap_events) };
} }