Actions
Bug #1918
openIncorrect packet stats in pcap and pf_ring capture modes
Affected Versions:
Effort:
Difficulty:
Label:
Description
In high networking load i noticed that packet dropped stats went above 100%.
I get stats like this one in example:
pkts : 250833
drop : 749860
drop % : 298,95%
What got me suspicious since i sent exactly 1M packets to Suricata, and the
sum of those 2 numbers is around that 1M.
Both pcap and pf_ring modes are affected.
Looking through source-pcap.c file, in lines 661-663 i found next formula :
SCLogInfo("(%s) Pcap Total:%" PRIu64 " Recv:%" PRIu64 " Drop:%" PRIu64 " (
%02.1f%%).", tv->name,
(uint64_t)pcap_s.ps_recv, (uint64_t)pcap_s.ps_recv - (uint64_t)pcap_s.
ps_drop, (uint64_t)pcap_s.ps_drop,
(((float)(uint64_t)pcap_s.ps_drop)/(float)(uint64_t)pcap_s.ps_recv)*100);
Lurking some more i found this old patch from 2011 that I think solves
those stats issues where the drop% is calculated on the sum of those 2
values,yet here is not implemented.
P.S. AF-Packet correctly reports 1M total received on the NIC and drop% is
correct, at least it looks ok.
Actions