diff --git a/CHANGES b/CHANGES index 6715aa4db6..111c557b49 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,9 @@ +2.3-518 | 2015-03-04 13:13:50 -0800 + + * Add bytes_recvd to stats.log recording the number of bytes + received, according to packet headers. (Mike Smiley) + 2.3-516 | 2015-03-04 12:30:06 -0800 * Extract most specific Common Name from SSL certificates (Johanna diff --git a/VERSION b/VERSION index c10d32a9e1..5a9ae5afca 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.3-516 +2.3-518 diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro index d35ecc3f02..5dc3345b09 100644 --- a/scripts/base/init-bare.bro +++ b/scripts/base/init-bare.bro @@ -440,6 +440,7 @@ type NetStats: record { ## packet capture system, this value may not be available and will then ## be always set to zero. pkts_link: count &default=0; + bytes_recvd: count &default=0; ##< Bytes received by Bro. }; ## Statistics about Bro's resource consumption. diff --git a/scripts/policy/misc/stats.bro b/scripts/policy/misc/stats.bro index eb1ddb0202..a8a08bdcc1 100644 --- a/scripts/policy/misc/stats.bro +++ b/scripts/policy/misc/stats.bro @@ -39,6 +39,9 @@ export { ## Number of packets seen on the link since the last stats ## interval if reading live traffic. pkts_link: count &log &optional; + ## Number of bytes received since the last stats interval if + ## reading live traffic. + bytes_recv: count &log &optional; }; ## Event to catch stats as they are written to the logging stream. @@ -74,6 +77,7 @@ event check_stats(last_ts: time, last_ns: NetStats, last_res: bro_resources) info$pkts_recv = ns$pkts_recvd - last_ns$pkts_recvd; info$pkts_dropped = ns$pkts_dropped - last_ns$pkts_dropped; info$pkts_link = ns$pkts_link - last_ns$pkts_link; + info$bytes_recv = ns$bytes_recvd - last_ns$bytes_recvd; } Log::write(Stats::LOG, info); diff --git a/src/bro.bif b/src/bro.bif index 4e685eb84a..e7be72410c 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -1675,6 +1675,7 @@ function net_stats%(%): NetStats unsigned int recv = 0; unsigned int drop = 0; unsigned int link = 0; + unsigned int bytes_recv = 0; const iosource::Manager::PktSrcList& pkt_srcs(iosource_mgr->GetPktSrcs()); @@ -1688,12 +1689,14 @@ function net_stats%(%): NetStats recv += stat.received; drop += stat.dropped; link += stat.link; + bytes_recv += stat.bytes_received; } RecordVal* ns = new RecordVal(net_stats); ns->Assign(0, new Val(recv, TYPE_COUNT)); ns->Assign(1, new Val(drop, TYPE_COUNT)); ns->Assign(2, new Val(link, TYPE_COUNT)); + ns->Assign(3, new Val(bytes_recv, TYPE_COUNT)); return ns; %} diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h index 378ac3f5ee..2400219fd0 100644 --- a/src/iosource/PktSrc.h +++ b/src/iosource/PktSrc.h @@ -38,7 +38,12 @@ public: */ unsigned int link; - Stats() { received = dropped = link = 0; } + /** + * Bytes received by source after filtering (w/o drops). + */ + uint64 bytes_received; + + Stats() { received = dropped = link = bytes_received = 0; } }; /** diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc index a68f0ca322..7645903c2a 100644 --- a/src/iosource/pcap/Source.cc +++ b/src/iosource/pcap/Source.cc @@ -180,6 +180,8 @@ bool PcapSource::ExtractNextPacket(Packet* pkt) last_hdr = current_hdr; last_data = data; ++stats.received; + stats.bytes_received += current_hdr.len; + return true; } @@ -219,7 +221,7 @@ bool PcapSource::SetFilter(int index) #ifndef HAVE_LINUX // Linux doesn't clear counters when resetting filter. - stats.received = stats.dropped = stats.link = 0; + stats.received = stats.dropped = stats.link = stats.bytes_received = 0; #endif return true; @@ -230,7 +232,7 @@ void PcapSource::Statistics(Stats* s) char errbuf[PCAP_ERRBUF_SIZE]; if ( ! (props.is_live && pd) ) - s->received = s->dropped = s->link = 0; + s->received = s->dropped = s->link = s->bytes_received = 0; else { @@ -238,7 +240,7 @@ void PcapSource::Statistics(Stats* s) if ( pcap_stats(pd, &pstat) < 0 ) { PcapError(); - s->received = s->dropped = s->link = 0; + s->received = s->dropped = s->link = s->bytes_received = 0; } else @@ -249,6 +251,7 @@ void PcapSource::Statistics(Stats* s) } s->received = stats.received; + s->bytes_received = stats.bytes_received; if ( ! props.is_live ) s->dropped = 0; diff --git a/testing/btest/Baseline/bifs.net_stats_trace/output b/testing/btest/Baseline/bifs.net_stats_trace/output index 55d6693db5..ed924affa6 100644 --- a/testing/btest/Baseline/bifs.net_stats_trace/output +++ b/testing/btest/Baseline/bifs.net_stats_trace/output @@ -1 +1 @@ -[pkts_recvd=136, pkts_dropped=0, pkts_link=0] +[pkts_recvd=136, pkts_dropped=0, pkts_link=0, bytes_recvd=25260]