mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 09:08:20 +00:00
7e9d48f532
The broxygen-generated files now live in the git repo, have tests that check that they are up-to-date, and a script to re-generate them on-demand.
94 lines
3.3 KiB
ReStructuredText
94 lines
3.3 KiB
ReStructuredText
:tocdepth: 3
|
|
|
|
policy/misc/capture-loss.bro
|
|
============================
|
|
.. bro:namespace:: CaptureLoss
|
|
|
|
This script logs evidence regarding the degree to which the packet
|
|
capture process suffers from measurement loss.
|
|
The loss could be due to overload on the host or NIC performing
|
|
the packet capture or it could even be beyond the host. If you are
|
|
capturing from a switch with a SPAN port, it's very possible that
|
|
the switch itself could be overloaded and dropping packets.
|
|
Reported loss is computed in terms of the number of "gap events" (ACKs
|
|
for a sequence number that's above a gap).
|
|
|
|
:Namespace: CaptureLoss
|
|
:Imports: :doc:`base/frameworks/notice </scripts/base/frameworks/notice/index>`
|
|
|
|
Summary
|
|
~~~~~~~
|
|
Runtime Options
|
|
###############
|
|
============================================================================== ================================================================
|
|
:bro:id:`CaptureLoss::too_much_loss`: :bro:type:`double` :bro:attr:`&redef` The percentage of missed data that is considered "too much"
|
|
when the :bro:enum:`CaptureLoss::Too_Much_Loss` notice should be
|
|
generated.
|
|
:bro:id:`CaptureLoss::watch_interval`: :bro:type:`interval` :bro:attr:`&redef` The interval at which capture loss reports are created.
|
|
============================================================================== ================================================================
|
|
|
|
Types
|
|
#####
|
|
================================================= =
|
|
:bro:type:`CaptureLoss::Info`: :bro:type:`record`
|
|
================================================= =
|
|
|
|
Redefinitions
|
|
#############
|
|
========================================== =
|
|
:bro:type:`Log::ID`: :bro:type:`enum`
|
|
:bro:type:`Notice::Type`: :bro:type:`enum`
|
|
========================================== =
|
|
|
|
|
|
Detailed Interface
|
|
~~~~~~~~~~~~~~~~~~
|
|
Runtime Options
|
|
###############
|
|
.. bro:id:: CaptureLoss::too_much_loss
|
|
|
|
:Type: :bro:type:`double`
|
|
:Attributes: :bro:attr:`&redef`
|
|
:Default: ``0.1``
|
|
|
|
The percentage of missed data that is considered "too much"
|
|
when the :bro:enum:`CaptureLoss::Too_Much_Loss` notice should be
|
|
generated. The value is expressed as a double between 0 and 1 with 1
|
|
being 100%.
|
|
|
|
.. bro:id:: CaptureLoss::watch_interval
|
|
|
|
:Type: :bro:type:`interval`
|
|
:Attributes: :bro:attr:`&redef`
|
|
:Default: ``15.0 mins``
|
|
|
|
The interval at which capture loss reports are created.
|
|
|
|
Types
|
|
#####
|
|
.. bro:type:: CaptureLoss::Info
|
|
|
|
:Type: :bro:type:`record`
|
|
|
|
ts: :bro:type:`time` :bro:attr:`&log`
|
|
Timestamp for when the measurement occurred.
|
|
|
|
ts_delta: :bro:type:`interval` :bro:attr:`&log`
|
|
The time delay between this measurement and the last.
|
|
|
|
peer: :bro:type:`string` :bro:attr:`&log`
|
|
In the event that there are multiple Bro instances logging
|
|
to the same host, this distinguishes each peer with its
|
|
individual name.
|
|
|
|
gaps: :bro:type:`count` :bro:attr:`&log`
|
|
Number of missed ACKs from the previous measurement interval.
|
|
|
|
acks: :bro:type:`count` :bro:attr:`&log`
|
|
Total number of ACKs seen in the previous measurement interval.
|
|
|
|
percent_lost: :bro:type:`double` :bro:attr:`&log`
|
|
Percentage of ACKs seen where the data being ACKed wasn't seen.
|
|
|
|
|
|
|