[Snort-devel] Snort 2.6 USR1 Stats
twease at ...402...
Tue Apr 24 20:37:43 EDT 2007
Mark McDonagh wrote:
> Hi All,
> I was looking at the statistics that Snort gives on receipt of the USR1
> signal. I thought some of the figures looked a bit strange, especially the
> "Outstanding Packets" (much higher than expected).
> I was looking at the code, in particular this commit
> I'm puzzled by the fact that we keep on adding the number of
> packets received to ps_total
> ps_total += ps.ps_recv;
> Am I missing something here ?
No, you're not missing anything. The code should read 'ps_total =
ps.ps_recv'. The += was causing ps_total to wrap too quickly and out of
sync with the other stats. The fix will be in the next 2.7.0 release.
Thanks for bringing this to our attention.
More information about the Snort-devel