Bug #50: time based stats are not calculated correctly - Suricata - Open Information Security Foundation

Actions

Copy link

#1

Updated by Victor Julien over 14 years ago

Target version set to 0.8.1

Actions

Copy link

#2

Updated by Victor Julien over 14 years ago

Due date set to 01/31/2010

Actions

Copy link

#3

Updated by Anoop Saldanha about 14 years ago

File 0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch 0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch added

Victor Julien wrote:

This is after a runtime of 19 seconds:

decoder.pkts | Decode1 | 1384407
decoder.pkts_per_sec | Decode1 | 7689.232558
decoder.bytes | Decode1 | 1423315351
decoder.bytes_per_sec | Decode1 | 7967362.790698
decoder.mbit_per_sec | Decode1 | 63.738902

1384407 / 19 = 72863 pkt/s
1423315351 / 19 = 74811334 bytes/s
mbit/s value should be in the 550-570 range...

Above was in pcap file reading mode.

The values shown are the instataneous values and not for the entire period. For example before the counters api logs values to the file, it takes the accumulated local values, and the time over which these values were calcualted and calculates the accumu_local_value/time and then resets the global counter value to 0.

Attached is a patch which makes the values given by timebased counters more accurate.

Actions

Copy link

#4