Commit graph

8 commits

Author SHA1 Message Date
Robin Sommer
1e010fbb76 Merge remote-tracking branch 'origin/topic/johanna/conn-threshold'
* origin/topic/johanna/conn-threshold:
  Wrap threshold stuff up - fix two small bugs and update baselines.
  update GridFTP analyzer to use connection thresholding instead of polling
  Add high level api for thresholding that holds lists of thresholds and raises an event for each threshold exactly once.
  Allow setting packet and byte thresholds for connections.

BIT-1377 #merged
2015-04-17 13:02:31 -07:00
Johanna Amann
b44b725d59 Wrap threshold stuff up - fix two small bugs and update baselines. 2015-04-17 09:59:34 -07:00
Johanna Amann
86c54c3dbd Add high level api for thresholding that holds lists of thresholds
and raises an event for each threshold exactly once.
2015-04-17 06:57:58 -07:00
Johanna Amann
f7edf70882 Allow setting packet and byte thresholds for connections.
This extends the ConnSize analyzer to be able to raise events when each
direction of a connection crosses a certain amount of bytes or packets.

Thresholds are set using
set_conn_bytes_threshold(c$id, [num-bytes], [direction]);
and
set_conn_packets_threshold(c$id, [num-packets], [direction]);
respectively.

They raise the event
event conn_bytes_threshold_crossed(c: connection, threshold: count, is_orig: bool)
and
event conn_packets_threshold_crossed(c: connection, threshold: count, is_orig: bool)
respectively.

Current thresholds can be examined using
get_conn_bytes_threshold and get_conn_packets_threshold

Currently only one threshold can be set per connection.

This also fixes a bug where child packet analyzers of the TCP analyzer
where not found using FindChild.
2015-04-17 06:57:51 -07:00
Jon Siwek
2b3c2bd394 Fix reassembly of data w/ sizes beyond 32-bit capacities (BIT-348).
The main change is that reassembly code (e.g. for TCP) now uses
int64/uint64 (signedness is situational) data types in place of int
types in order to support delivering data to analyzers that pass 2GB
thresholds.  There's also changes in logic that accompany the change in
data types, e.g. to fix TCP sequence space arithmetic inconsistencies.

Another significant change is in the Analyzer API: the *Packet and
*Undelivered methods now use a uint64 in place of an int for the
relative sequence space offset parameter.
2014-04-09 13:03:24 -05:00
Jon Siwek
775ec6795e Fix uninitialized (or unused) fields. 2013-09-27 10:13:52 -05:00
Jon Siwek
a316878d01 Add checks to avoid improper negative values use. 2013-09-17 16:42:48 -05:00
Robin Sommer
4bc2ba60c9 Rename analyzer/protocols -> analyzer/protocol 2013-04-19 15:50:57 -07:00
Renamed from src/analyzer/protocols/conn-size/ConnSize.cc (Browse further)