Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add optional packet filtered statistics for packet sources

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-03-31 13:35:10 -07:00
parent 8a23671b21
commit ae3d6a4df0
6 changed files with 46 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/init-bare.zeek
View file

@ -678,6 +678,7 @@ type NetStats: record {
## be always set to zero.
pkts_link: count &default=0;
bytes_recvd: count &default=0; ##< Bytes received by Zeek.
filtered: count &optional; ##< Packets filtered by the packet source.
};
type ConnStats: record {

8
scripts/policy/misc/stats.zeek
View file

@ -34,6 +34,9 @@ export {
## Lag between the wall clock and packet timestamps if reading
## live traffic.
pkt_lag: interval &log &optional;
## Number of packets filtered from the link since the last
## stats interval if reading live traffic.
pkts_filtered: count &log &optional;
## Number of events processed since the last stats interval.
events_proc: count &log;
@ -140,6 +143,11 @@ event check_stats(then: time, last_ns: NetStats, last_cs: ConnStats, last_ps: Pr
info$pkt_lag = current_time() - nettime;
info$pkts_dropped = ns$pkts_dropped - last_ns$pkts_dropped;
info$pkts_link = ns$pkts_link - last_ns$pkts_link;
# This makes the assumption that if pkts_filtered is valid, it's been valid in
# all of the previous calls.
if ( ns?$pkts_filtered )
info$pkts_filtered = ns$pkts_filtered - last_ns$pkts_filtered;
}
Log::write(Stats::LOG, info);