zeek/policy.old/summaries/app-summary.bro
2011-03-01 10:51:44 -05:00

57 lines
1.8 KiB
Text

@load conn-util
@load conn-app-reduced
global conn_size_table: table[conn_id] of count;
global conn_size_log = open_log_file("conn-size") &redef;
function add_to_conn_size(id: conn_id, size: count)
{
if ( id !in conn_size_table )
conn_size_table[id] = 0;
local previous_size = conn_size_table[id];
conn_size_table[id] = conn_size_table[id] + size;
if ( conn_size_table[id] < previous_size )
{
print conn_size_log, fmt("ERROR: %.6f size wrapping around: %s, prev_size = %d, add = %d",
network_time(), conn_id_string(id), previous_size, size);
}
}
event after_connections_state_remove(c: connection)
{
local id = c$id;
local app_size: count;
local transport_size: count;
if ( id !in conn_size_table )
conn_size_table[id] = 0;
app_size = conn_size_table[id];
transport_size = c$orig$size + c$resp$size;
local size_delta: int = transport_size - app_size;
local annotation: string = "none";
if ( app_size > transport_size )
annotation = "negative_transport_overhead";
else if ( size_delta > 1000 && 1.0 * size_delta / transport_size > 0.3 )
annotation = "suspicious_transport_overhead";
print conn_size_log, fmt("conn %s app_size %d conn_size %d annotation %s", conn_id_string(id), app_size, transport_size, annotation);
delete conn_size_table[id];
}
event connection_state_remove(c: connection)
{
event after_connections_state_remove(c);
}
function print_app_summary(log: file,
id: conn_id, conn_start: time, func: string, start: time,
num_req: count, req_size: count, num_resp: count, resp_size: count,
extra: string)
{
add_to_conn_size(id, req_size + resp_size);
print log, fmt("conn %s conn_start %.6f app %s app_func %s start %.6f req %d pyld_^ %d reply %d pyld_v %d%s",
conn_id_string(id), conn_start, conn_app[id], func, start,
num_req, req_size,
num_resp, resp_size,
byte_len(extra) > 0 ? cat(" ", extra) : "");
}