[Snort-devel] Snort 2.6 USR1 Stats

Todd Wease twease at ...402...
Tue Apr 24 20:37:43 EDT 2007


Mark McDonagh wrote:
> Hi All,
> 
> I was looking at the statistics that Snort gives on receipt of the USR1
> signal. I thought some of the figures looked a bit strange, especially the
> "Outstanding Packets" (much higher than expected).
> 
> I was looking at the code, in particular this commit
> 
> http://cvs.snort.org/viewcvs.cgi/snort/src/util.c.diff?r1=1.75&r2=1.76
> 
> I'm puzzled by the fact that we keep on adding the number of
> packets received to ps_total
> 
> ps_total += ps.ps_recv;
> 
> Am I missing something here ?
> 
> Mark
> 

No, you're not missing anything.  The code should read 'ps_total =
ps.ps_recv'.  The += was causing ps_total to wrap too quickly and out of
sync with the other stats.  The fix will be in the next 2.7.0 release.
Thanks for bringing this to our attention.

Todd





More information about the Snort-devel mailing list