[Snort-devel] [ snort-Bugs-740902 ] 2.0.x-bug: Statistics are wrong

SourceForge.net noreply at ...12...
Wed May 21 06:12:03 EDT 2003


Bugs item #740902, was opened at 2003-05-21 07:26
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=103357&aid=740902&group_id=3357

Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Martin Olsson (elof)
Assigned to: Nobody/Anonymous (nobody)
Summary: 2.0.x-bug: Statistics are wrong

Initial Comment:
When exiting snort you get a page of statistics. I got this page when 
running snort v2.0.1beta (Build 82), built with --enable-debug and 
executed like this:
SNORT_DEBUG=2 /usr/sentor/bin/snort -c /usr/sentor/etc/snort.conf -l 
/usr/sentor/log -u snort -g snort net 10.0.0.0/8 and not port 22


==============================================
Snort analyzed 13927 out of 13927 packets, dropping 0(0.000%) 
packets

Breakdown by protocol:                Action Stats:
    TCP: 57         (0.409%)          ALERTS: 2         
    UDP: 26         (0.187%)          LOGGED: 2         
   ICMP: 2          (0.014%)          PASSED: 0         
    ARP: 46         (0.330%)
  EAPOL: 0          (0.000%)
   IPv6: 0          (0.000%)
    IPX: 0          (0.000%)
  OTHER: 0          (0.000%)
DISCARD: 0          (0.000%)
==============================================

Shouldn't the total sum of the protocols be equal to the number of 
analyzed packets?
(57+26+2+46+0+0+0+0+0) != 13927

...also the total sum of the percentage values should be 100%, IMHO.

Martin Olsson
Sentor AB, Sweden

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=103357&aid=740902&group_id=3357




More information about the Snort-devel mailing list