[Snort-devel] Fwd: Snort blocking connection but not logging the drop

Cody Brugh cbrugh at ...2499...
Mon May 12 11:52:03 EDT 2014


Attached is the shutdown stats.  Let me know what you find/suggest.

Thanks,
Cody


On Mon, May 12, 2014 at 11:41 AM, Russ Combs (rucombs) <rucombs at ...3461...>wrote:

>
>  ------------------------------
> *From:* Cody Brugh [cbrugh at ...2499...]
> *Sent:* Monday, May 12, 2014 11:18 AM
>
> *To:* Russ Combs (rucombs)
> *Cc:* Joel Esler (jesler); snort-devel at lists.sourceforge.net
> *Subject:* Re: [Snort-devel] Fwd: Snort blocking connection but not
> logging the drop
>
>   How do I gather those stats?  Are you looking for this?
> http://manual.snort.org/node20.html
>
> * Not those.  Do a clean start, run your traffic, and then stop Snort or
> give it a usr1 signal and check the output.  Check console or syslog
> depending on how you run.
>
>  Thanks,
> Cody
>
>
> On Mon, May 12, 2014 at 11:05 AM, Russ Combs (rucombs) <rucombs at ...3461...>wrote:
>
>>  What are your shutdown / usr1 stats?  Do they show normalizer blocks?
>>
>>  ------------------------------
>> *From:* Cody Brugh [cbrugh at ...2499...]
>> *Sent:* Monday, May 12, 2014 10:29 AM
>> *To:* Russ Combs (rucombs)
>> *Cc:* Joel Esler (jesler); snort-devel at lists.sourceforge.net
>>
>> *Subject:* Re: [Snort-devel] Fwd: Snort blocking connection but not
>> logging the drop
>>
>>    Can you confirm you received my PCAP file?  I would really like to
>> get this issue resolved so I can work with their API.
>>
>> Let me know the status please.
>>
>>
>> On Fri, May 9, 2014 at 9:02 AM, Cody Brugh <cbrugh at ...2499...> wrote:
>>
>>>  Attached is the pcap of the stamps.com packet capture... can someone
>>> check and see what I should do?
>>>
>>>  Thanks,
>>> Cody
>>>
>>>
>>> On Fri, May 9, 2014 at 8:19 AM, Russ Combs (rucombs) <rucombs at ...3461...>wrote:
>>>
>>>>
>>>>  ------------------------------
>>>> *From:* Joel Esler (jesler)
>>>> *Sent:* Thursday, May 08, 2014 8:51 PM
>>>> *To:* Cody Brugh
>>>> *Cc:* snort-devel at lists.sourceforge.net
>>>> *Subject:* Re: [Snort-devel] Fwd: Snort blocking connection but not
>>>> logging the drop
>>>>
>>>>   Can you send your configuration file, and a packet capture of the
>>>> session?
>>>>
>>>>  * Can you also send your usr1 / shutdown stats?
>>>>
>>>>
>>>> --
>>>> Joel Esler
>>>> Sent from my iPhone
>>>>
>>>> On May 8, 2014, at 20:49, "Cody Brugh" <cbrugh at ...2499...> wrote:
>>>>
>>>>   Hi,
>>>>
>>>>  Our dev team is trying to work with stamps.com API however our
>>>> in-line snort box is blocking the return connection for unknown reasons.
>>>> When I turn off snort the connection flows perfectly.  Looking at snorby I
>>>> see no event of the connection being dropped.  I've included the command we
>>>> are running from a internal server that is behind the snort.  I also
>>>> included the tcpdump from this same server for the connection.
>>>>
>>>> wget https://216.52.211.91/label/health.aspx
>>>> --2014-05-08 20:37:33--  https://216.52.211.91/label/health.aspx
>>>> Connecting to 216.52.211.91:443... connected.
>>>>
>>>>
>>>> 20:37:33.443962 IP 10.2.2.1.52661 > 216.52.211.91.443: Flags [F.], seq
>>>> 3298140140, ack 2463587275, win 8208, options [nop,nop,TS val 2824990869
>>>> ecr 3731400338], length 0
>>>> 20:37:33.444478 IP 216.52.211.91.443 > 10.2.2.1.52661: Flags [R.], seq
>>>> 1, ack 1, win 8208, length 0
>>>> 20:37:33.989510 IP 10.2.2.1.59800 > 216.52.211.91.443: Flags [S], seq
>>>> 3306929108, win 65535, options [mss 1460,nop,wscale 3,sackOK,TS val
>>>> 2824990923 ecr 0], length 0
>>>> 20:37:34.071548 IP 216.52.211.91.443 > 10.2.2.1.59800: Flags [S.], seq
>>>> 361712399, ack 3306929109, win 4140, options [mss 1380,nop,wscale
>>>> 3,nop,nop,TS val 3731482846 ecr 2824990923,sackOK,eol], length 0
>>>> 20:37:34.071610 IP 10.2.2.1.59800 > 216.52.211.91.443: Flags [.], ack
>>>> 1, win 8208, options [nop,nop,TS val 2824990932 ecr 3731482846], length 0
>>>> 20:37:34.071750 IP 10.2.2.1.59800 > 216.52.211.91.443: Flags [P.], ack
>>>> 1, win 8208, options [nop,nop,TS val 2824990932 ecr 3731482846], length 139
>>>> 20:37:34.154367 IP 216.52.211.91.443 > 10.2.2.1.59800: Flags [.], ack
>>>> 140, win 517, options [nop,nop,TS val 3731482928 ecr 2824990932], length
>>>> 1368
>>>> 20:37:34.154462 IP 216.52.211.91.443 > 10.2.2.1.59800: Flags [.], ack
>>>> 140, win 517, options [nop,nop,TS val 3731482928 ecr 2824990932], length
>>>> 1368
>>>> 20:37:34.154490 IP 10.2.2.1.59800 > 216.52.211.91.443: Flags [.], ack
>>>> 2737, win 7877, options [nop,nop,TS val 2824990940 ecr 3731482928], length 0
>>>>
>>>> 20:37:44.153373 IP 216.52.211.91.443 > 10.2.2.1.59800: Flags [R.], seq
>>>> 4233:4288, ack 140, win 534, length 55
>>>>
>>>>  any help or suggestions would be great, I would like to disable the
>>>> rule that is blocking this connection but like I said I cannot see which
>>>> rule blocked it.
>>>>
>>>>  Thanks.
>>>>
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Is your legacy SCM system holding you back? Join Perforce May 7 to find
>>>> out:
>>>> • 3 signs your SCM is hindering your productivity
>>>> • Requirements for releasing software faster
>>>> • Expert tips and advice for migrating your SCM now
>>>> http://p.sf.net/sfu/perforce
>>>>
>>>>  _______________________________________________
>>>> Snort-devel mailing list
>>>> Snort-devel at lists.sourceforge.net
>>>> https://lists.sourceforge.net/lists/listinfo/snort-devel
>>>> Archive:
>>>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>>>>
>>>> Please visit http://blog.snort.org for the latest news about Snort!
>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20140512/42460cac/attachment.html>
-------------- next part --------------
^C*** Caught Int-Signal
===============================================================================
Run time for packet processing was 159.74723 seconds
Snort processed 247313 packets.
Snort ran for 0 days 0 hours 2 minutes 39 seconds
   Pkts/min:       123656
   Pkts/sec:         1555
Preprocessor Profile Statistics (all)
==========================================================
 Num            Preprocessor Layer     Checks      Exits           Microsecs  Avg/Check Pct of Caller Pct of Total
 ===            ============ =====     ======      =====           =========  ========= ============= ============
  1                   detect     0     227070     227070             8472608      37.31         69.99        69.99
   1                    mpse     1     448346     448346             7712237      17.20         91.03        63.71
   2               rule eval     1     398948     398948             1478724       3.71         17.45        12.22
    1         rule tree eval     2     600409     600409             1450080       2.42         98.06        11.98
     1                  pcre     3      27457      27457              590731      21.51         40.74         4.88
     2         base64_decode     3          5          5                  13       2.75          0.00         0.00
     3               content     3     155150     155150              404824       2.61         27.92         3.34
     4  preproc_rule_options     3         24         24                  12       0.50          0.00         0.00
     5             byte_jump     3         30         30                  14       0.49          0.00         0.00
     6            uricontent     3      69286      69286               22015       0.32          1.52         0.18
     7          byte_extract     3        882        882                 205       0.23          0.01         0.00
     8           base64_data     3          5          5                   0       0.17          0.00         0.00
     9              dsize_eq     3       3435       3435                 375       0.11          0.03         0.00
    10              flowbits     3     385062     385062               34223       0.09          2.36         0.28
    11             byte_test     3      16304      16304                1211       0.07          0.08         0.01
    12          urilen_check     3       4603       4603                 293       0.06          0.02         0.00
    13              isdataat     3      15195      15195                 811       0.05          0.06         0.01
    14              pkt_data     3          5          5                   0       0.04          0.00         0.00
    15                  flow     3     584589     584589               22400       0.04          1.54         0.19
    16             file_data     3      43537      43537                1539       0.04          0.11         0.01
    2               rtn eval     2       5247       5247                3339       0.64          0.23         0.03
  2                       s5     0     210737     210737             6225128      29.54         51.43        51.43
   1                   s5tcp     1     207180     207180             6075043      29.32         97.59        50.19
    1             s5TcpState     2     206980     206980             5963276      28.81         98.16        49.26
     1            s5TcpFlush     3      12472      12472              102186       8.19          1.71         0.84
      1  s5TcpProcessRebuilt     4      12472      12472             5185001     415.73       5074.05        42.83
      2     s5TcpBuildPacket     4      12472      12472               83612       6.70         81.82         0.69
     2             s5TcpData     3     132604     132604              318460       2.40          5.34         2.63
      1       s5TcpPktInsert     4      94738      94738              283601       2.99         89.05         2.34
     3              s5TcpPAF     3     100111     100111              155313       1.55          2.60         1.28
    2           s5TcpNewSess     2       1703       1703                5719       3.36          0.09         0.05
   2                   s5udp     1       3557       3557               10947       3.08          0.18         0.09
  3              httpinspect     0     106881     106881              761460       7.12          6.29         6.29
  4                      ssl     0       2369       2369               13457       5.68          0.11         0.11
  5            ftptelnet_ftp     0         57         57                 251       4.42          0.00         0.00
  6                      pop     0      91901      91901              313970       3.42          2.59         2.59
  7                   decode     0     247479     247479              370020       1.50          3.06         3.06
  8                     smtp     0      96747      96747              139766       1.44          1.15         1.15
  9                     imap     0      93653      93653              119235       1.27          0.99         0.99
 10               DceRpcMain     0      94900      94900               40414       0.43          0.33         0.33
   1           DceRpcSession     1      94900      94900               31771       0.33         78.61         0.26
    1       DceRpcNewSession     2      94900      94900               16632       0.18         52.35         0.14
 11                     dnp3     0       3569       3569                 975       0.27          0.01         0.01
 12                      sip     0       7192       7192                1890       0.26          0.02         0.02
 13               reputation     0     246186     246186               60533       0.25          0.50         0.50
 14              backorifice     0       3557       3557                 765       0.22          0.01         0.01
 15                normalize     0     223855     223855               34676       0.15          0.29         0.29
 16                      ssh     0      93653      93653               13105       0.14          0.11         0.11
 17                   eventq     0     507098     507098               57172       0.11          0.47         0.47
 18                   modbus     0      90182      90182                8771       0.10          0.07         0.07
 19                      dns     0       3551       3551                 274       0.08          0.00         0.00
 total                 total     0     247313     247313            12105086      48.95          0.00         0.00
Rule Profile Statistics (all rules)
==========================================================
   Num      SID GID Rev     Checks   Matches    Alerts           Microsecs  Avg/Check  Avg/Match Avg/Nonmatch   Disabled
   ===      === === ===     ======   =======    ======           =========  =========  ========= ============   ========
     1    27259   1   1         51         0         0              248548     4873.5        0.0       4873.5          0
     2    19177   1   7          1         0         0                 509      509.3        0.0        509.3          0
     3    24093   1   3          2         0         0                 203      101.6        0.0        101.6          0
     4    23619   1   6        192         0         0               16961       88.3        0.0         79.8          0
     5    26616   1   3        160         0         0               11532       72.1        0.0         72.1          0
     6    19884   1   5         65         0         0                3958       60.9        0.0         60.9          0
     7    26595   1   4         65         0         0                3915       60.2        0.0         60.2          0
     8    26596   1   5         65         0         0                3479       53.5        0.0         53.5          0
     9    17058   1   7        189         0         0                9114       48.2        0.0         48.2          0
    10    27258   1   1         63         0         0                2587       41.1        0.0         41.1          0
    11    19150   1   7         57         0         0                2208       38.7        0.0         38.7          0
    12     3679   1  12        129         0         0                4919       38.1        0.0         38.1          0
    13    26615   1   2         28         0         0                1064       38.0        0.0         38.0          0
    14    16343   3  11          2         0         0                  70       35.3        0.0         35.3          0
    15    21631   1   4          1         0         0                  35       35.1        0.0         35.1          0
    16    19149   1   7        262         0         0                9005       34.4        0.0         34.4          0
    17    19867   1   4       2805         0         0               95210       33.9        0.0         33.9          0
    18    24037   1   5         38         0         0                1192       31.4        0.0         31.4          0
    19    19099   1   6         36         0         0                1037       28.8        0.0         28.8          0
    20    18217   1  10        337         0         0                9101       27.0        0.0         26.2          0
    21    16668   1   5          9         0         0                 221       24.6        0.0         24.6          0
    22    20997   1   8        106         0         0                2574       24.3        0.0         24.3          0
    23    29509   1   3         65         0         0                1560       24.0        0.0         24.0          0
    24    21189   1   2        137         0         0                3083       22.5        0.0         20.8          0
    25    21778   1   5          2         0         0                  41       20.8        0.0         20.8          0
    26    25538   1   1         55         0         0                1119       20.3        0.0         20.3          0
    27    21037   1   5       2805         0         0               54786       19.5        0.0         19.5          0
    28    17165   1   5         54         0         0                1022       18.9        0.0         18.9          0
    29    23134   1   3         46         0         0                 845       18.4        0.0         18.4          0
    30    27568   1   2         94         0         0                1705       18.1        0.0         18.1          0
    31    19084   1   5         80         0         0                1423       17.8        0.0         17.8          0
    32    11273   1   8       3059         0         0               53222       17.4        0.0         17.4          0
    33    20875   1   5         46         0         0                 797       17.3        0.0         17.3          0
    34    21038   1   4         65         0         0                1106       17.0        0.0         17.0          0
    35    21040   1   4         64         0         0                1075       16.8        0.0         16.8          0
    36     8701   1   6       6184         0         0              103550       16.7        0.0         16.7          0
    37    24698   1   2       2443         0         0               39098       16.0        0.0         16.0          0
    38    26000   1   2          4         0         0                  62       15.7        0.0         15.7          0
    39     2580   1  11       4142         0         0               64891       15.7        0.0         15.7          0
    40    23853   1   4        958         0         0               14700       15.3        0.0         15.3          0
    41    19888   1   4         64         0         0                 976       15.3        0.0         15.3          0
    42    16501   1   4          2         0         0                  28       14.5        0.0         14.5          0
    43    19004   1   4        123         0         0                1691       13.8        0.0         13.7          0
    44    18973   1   4        137         0         0                1821       13.3        0.0         13.3          0
    45    24252   1   1          4         0         0                  52       13.1        0.0         13.1          0
    46    25773   1   5         82         0         0                1018       12.4        0.0         12.4          0
    47    23180   3   4          3         0         0                  35       11.7        0.0         11.7          0
    48    24206   1   6         53         0         0                 615       11.6        0.0         11.6          0
    49    19887   1   3         64         0         0                 742       11.6        0.0         11.6          0
    50    26893   1   2        212         0         0                2262       10.7        0.0          9.9          0
    51    29813   1   1         21         0         0                 222       10.6        0.0         10.6          0
    52    28213   1   1         25         0         0                 257       10.3        0.0         10.3          0
    53    30001   1   2          6         0         0                  56        9.4        0.0          9.4          0
    54    25515   1   2       2380         0         0               21997        9.2        0.0          9.2          0
    55    15874   1  12          2         0         0                  18        9.2        0.0          9.2          0
    56    25044   1   2        354         0         0                3177        9.0        0.0          9.0          0
    57    24839   1   3        354         0         0                3177        9.0        0.0          9.0          0
    58    19321   1   6         14         0         0                 124        8.9        0.0          7.2          0
    59    15363   1   6         71         0         0                 627        8.8        0.0          8.8          0
    60    19003   1   4        123         0         0                1070        8.7        0.0          8.7          0
    61    25324   1   4        103         0         0                 893        8.7        0.0          8.7          0
    62    20991   1   7          6         0         0                  51        8.5        0.0          7.6          0
    63    17154   1   8       3498         0         0               28131        8.0        0.0          8.0          0
    64    30325   1   1        495         0         0                3946        8.0        0.0          8.0          0
    65    18957   1   5        158         0         0                1247        7.9        0.0          7.9          0
    66    17153   1   8       4793         0         0               37025        7.7        0.0          7.7          0
    67    21036   1   6          2         2         0                  15        7.5        7.5          0.0          0
    68    19873   1   9       1804         0         0               12564        7.0        0.0          7.0          0
    69    23481   1   4        483         0         0                3257        6.7        0.0          6.7          0
    70    26451   1   5         32         0         0                 213        6.7        0.0          6.7          0
    71    24119   1   2          1         0         0                   6        6.3        0.0          6.3          0
    72    23482   1   4        204         0         0                1280        6.3        0.0          6.3          0
    73    28237   1   1          1         0         0                   6        6.3        0.0          6.3          0
    74    28614   1   1         12         0         0                  73        6.1        0.0          6.1          0
    75    28422   1   1          3         0         0                  17        5.8        0.0          5.8          0
    76     3548   1   7         40         0         0                 221        5.5        0.0          5.5          0
    77    25041   1   4         63         0         0                 347        5.5        0.0          5.5          0
    78    21039   1   4        320         0         0                1717        5.4        0.0          5.4          0
    79    24808   1   3        918         0         0                4621        5.0        0.0          5.0          0
    80    26207   1   3          1         0         0                   4        5.0        0.0          5.0          0
    81    28487   3   1        411         0         0                1950        4.7        0.0          4.7          0
    82     6339   1   5         85         0         0                 398        4.7        0.0          3.1          0
    83    12591   1   7        546         0         0                2544        4.7        0.0          4.7          0
    84    21736   1   1          1         0         0                   4        4.6        0.0          4.6          0
    85    26343   1   3        111         0         0                 509        4.6        0.0          4.6          0
    86    15483   1  13          9         0         0                  41        4.6        0.0          4.6          0
    87    18988   1   8         48         0         0                 215        4.5        0.0          4.5          0
    88    18803   1   8       1621         0         0                7250        4.5        0.0          4.5          0
    89    19075   1   6        128         0         0                 567        4.4        0.0          4.4          0
    90    24038   1   4         16         0         0                  68        4.3        0.0          4.3          0
    91    26297   1   2        140         0         0                 601        4.3        0.0          4.3          0
    92    19889   1   7         36         0         0                 154        4.3        0.0          4.3          0
    93    11687   1  16       3090         0         0               12978        4.2        0.0          4.2          0
    94    15362   1  10         93         0         0                 385        4.1        0.0          4.1          0
    95    19438   1   8         70         0         0                 288        4.1        0.0          4.1          0
    96    15013   1  12          1         0         0                   4        4.1        0.0          4.1          0
    97    28488   3   1        749         0         0                3025        4.0        0.0          4.0          0
    98    25060   1   3         69         0         0                 265        3.9        0.0          3.9          0
    99    11272   1   5       3120         0         0               11972        3.8        0.0          3.8          0
   100    10440   1   7         96         0         0                 355        3.7        0.0          3.5          0
   101    26298   1   1          1         0         0                   3        3.6        0.0          3.6          0
   102    17111   1   7         63         0         0                 229        3.6        0.0          3.6          0
   103     3694   1  10         22         0         0                  79        3.6        0.0          3.6          0
   104    27865   1   6        153         0         0                 549        3.6        0.0          3.6          0
   105    17733   1  10          1         0         0                   3        3.5        0.0          3.5          0
   106    19269   1   9         23         0         0                  78        3.4        0.0          3.4          0
   107    21499   1   2         96         0         0                 323        3.4        0.0          3.4          0
   108     7572   1  12          2         0         0                   6        3.3        0.0          3.3          0
   109    13514   1  16          5         0         0                  16        3.3        0.0          3.3          0
   110     7505   1   8         41         0         0                 135        3.3        0.0          3.3          0
   111    22097   1   6        420         0         0                1388        3.3        0.0          3.3          0
   112     7596   1   5         25         0         0                  81        3.3        0.0          3.3          0
   113    16406   1  10       1333         0         0                4298        3.2        0.0          3.2          0
   114    21865   1   7          2         0         0                   6        3.2        0.0          3.2          0
   115    17394   1  10        492         0         0                1578        3.2        0.0          3.2          0
   116    16205   1  13          5         0         0                  15        3.2        0.0          3.2          0
   117    21738   1   2          2         0         0                   6        3.2        0.0          3.2          0
   118    17380   1  13        242         0         0                 752        3.1        0.0          3.1          0
   119    17291   1   5         36         0         0                 107        3.0        0.0          3.0          0
   120    20800   1  11         52         0         0                 155        3.0        0.0          3.0          0
   121     6037   1   5        264         0         0                 783        3.0        0.0          2.6          0
   122     7539   1   7         96         0         0                 283        3.0        0.0          2.8          0
   123    10436   1   5         96         0         0                 282        2.9        0.0          2.6          0
   124     7551   1   7         96         0         0                 282        2.9        0.0          2.8          0
   125    28369   1   1          2         0         0                   5        2.9        0.0          2.9          0
   126    21892   1   1         47         0         0                 137        2.9        0.0          2.9          0
   127    28630   1   1        102         0         0                 296        2.9        0.0          2.9          0
   128    23520   1   4          3         0         0                   8        2.8        0.0          2.8          0
   129     7186   1   5         10         0         0                  27        2.7        0.0          2.7          0
   130    20792   1   7          8         0         0                  21        2.7        0.0          2.7          0
   131    23377   1   6         46         0         0                 122        2.7        0.0          2.7          0
   132    21908   1   1        181         0         0                 477        2.6        0.0          2.6          0
   133     6398   1   5          1         0         0                   2        2.6        0.0          2.6          0
   134    23039   3   1        397         0         0                1019        2.6        0.0          2.6          0
   135     8544   1   7         96         0         0                 245        2.6        0.0          2.4          0
   136    20500   1  11          6         0         0                  15        2.5        0.0          2.5          0
   137    23678   1   3          3         3         0                   7        2.5        2.3          0.0          0
   138    23521   1   4          3         0         0                   7        2.5        0.0          2.5          0
   139    27525   1   6       4989         0         0               12322        2.5        0.0          2.5          0
   140    20795   1   6        235         0         0                 568        2.4        0.0          2.4          0
   141    25269   1   3        252         0         0                 578        2.3        0.0          2.3          0
   142     1828   1  14         23         0         0                  52        2.3        0.0          2.3          0
   143    25452   1   4        594         0         0                1355        2.3        0.0          2.3          0
   144    27526   1   6       4986         0         0               11371        2.3        0.0          2.3          0
   145    22995   1   6         17         0         0                  38        2.3        0.0          2.3          0
   146    12360   1   9        153         0         0                 340        2.2        0.0          2.2          0
   147     9830   1   7         96         0         0                 213        2.2        0.0          2.1          0
   148    27737   1   1        200         0         0                 439        2.2        0.0          2.2          0
   149    21288   1   6         11         3         0                  23        2.2        3.0          1.9          0
   150    25799   1   6          1         0         0                   2        2.2        0.0          2.2          0
   151    29539   1   1         32         0         0                  68        2.2        0.0          2.2          0
   152    27527   1   5       4986         0         0               10692        2.1        0.0          2.1          0
   153     7156   1   5         96         0         0                 203        2.1        0.0          2.0          0
   154    29540   1   1         32         0         0                  67        2.1        0.0          2.1          0
   155    29542   1   1         32         0         0                  67        2.1        0.0          2.1          0
   156    29541   1   1         32         0         0                  67        2.1        0.0          2.1          0
   157    26270   1   5          2         0         0                   4        2.1        0.0          2.1          0
   158    11307   1   7         96         0         0                 201        2.1        0.0          2.0          0
   159    21035   1   5         49         0         0                 102        2.1        0.0          2.1          0
   160    10091   1   7         96         0         0                 198        2.1        0.0          2.0          0
   161    26269   1   5        586         0         0                1205        2.1        0.0          2.1          0
   162    21613   1   5        428         0         0                 873        2.0        0.0          2.0          0
   163    20640   1   6          2         0         0                   4        2.0        0.0          2.0          0
   164    20641   1   6          2         0         0                   4        2.0        0.0          2.0          0
   165    26557   1   3          2         0         0                   4        2.0        0.0          2.0          0
   166     7146   1   4         26         0         0                  51        2.0        0.0          2.0          0
   167     3547   1   7       5014         0         0                9998        2.0        0.0          2.0          0
   168    26267   1   5        574         0         0                1128        2.0        0.0          2.0          0
   169    23040   3   1          4         0         0                   7        2.0        0.0          2.0          0
   170    14772   3   6        375         0         0                 734        2.0        0.0          2.0          0
   171    25453   1   3        355         0         0                 684        1.9        0.0          1.9          0
   172    23098   1   6          6         0         0                  11        1.9        0.0          1.9          0
   173    18239   1   5          3         0         0                   5        1.9        0.0          1.9          0
   174    20819   1   4          2         0         0                   3        1.9        0.0          1.9          0
   175    21872   1   1        610         0         0                1148        1.9        0.0          1.9          0
   176     2278   1  26         40         0         0                  74        1.9        0.0          1.9          0
   177    22953   1   2          2         0         0                   3        1.9        0.0          1.9          0
   178    21728   1   1        826         0         0                1527        1.8        0.0          1.8          0
   179    29443   1   1          4         0         0                   7        1.8        0.0          1.8          0
   180     3546   1   7       6200         0         0               11444        1.8        0.0          1.8          0
   181    17050   1   7          2         0         0                   3        1.8        0.0          1.8          0
   182    21734   1   1          4         0         0                   7        1.8        0.0          1.8          0
   183    21295   1   7          3         0         0                   5        1.8        0.0          1.8          0
   184    27815   1   1          1         0         0                   1        1.8        0.0          1.8          0
   185    23667   1   4          1         1         0                   1        1.8        1.8          0.0          0
   186    21856   1   1         13         0         0                  22        1.8        0.0          1.8          0
   187    30146   1   1        100         0         0                 168        1.7        0.0          1.7          0
   188    15975   3   4        588         0         0                 981        1.7        0.0          1.7          0
   189    21730   1   1          4         0         0                   6        1.7        0.0          1.7          0
   190     2442   1  17       6200         0         0               10239        1.7        0.0          1.7          0
   191    20459   1   9        653         0         0                1074        1.6        0.0          1.6          0
   192    15976   3   4        837         0         0                1370        1.6        0.0          1.6          0
   193    30148   1   1        100         0         0                 162        1.6        0.0          1.6          0
   194    21627   1   5          4         0         0                   6        1.6        0.0          1.6          0
   195    28897   1   1          4         0         0                   6        1.6        0.0          1.6          0
   196    23637   1   1        203         0         0                 299        1.5        0.0          1.5          0
   197    28894   1   1          1         0         0                   1        1.5        0.0          1.5          0
   198    21651   1   3          1         0         0                   1        1.5        0.0          1.5          0
   199    13990   1  16          2         0         0                   2        1.4        0.0          1.4          0
   200     2657   1  19         12         0         0                  17        1.4        0.0          1.4          0
   201    18293   1   4          2         0         0                   2        1.4        0.0          1.4          0
   202    21729   1   2         86         0         0                 119        1.4        0.0          1.4          0
   203    28895   1   1          4         0         0                   5        1.4        0.0          1.4          0
   204    21625   1   5          4         0         0                   5        1.4        0.0          1.4          0
   205    16407   1  10          1         0         0                   1        1.4        0.0          1.4          0
   206    20965   1   4          1         0         0                   1        1.4        0.0          1.4          0
   207    27598   1   1          1         0         0                   1        1.3        0.0          1.3          0
   208    28040   1   1         18         0         0                  23        1.3        0.0          1.3          0
   209    23114   1   7        647         0         0                 846        1.3        0.0          1.3          0
   210    26562   1   1         65         0         0                  84        1.3        0.0          1.3          0
   211    21894   1   4          3         0         0                   3        1.3        0.0          1.3          0
   212    24455   1   2         71         0         0                  90        1.3        0.0          1.3          0
   213    20798   1   7         17         0         0                  21        1.3        0.0          1.3          0
   214    29189   1   1          4         0         0                   5        1.3        0.0          1.3          0
   215    25457   1   3          1         0         0                   1        1.3        0.0          1.3          0
   216    29186   1   1        197         0         0                 246        1.3        0.0          1.3          0
   217    25968   1   6          1         0         0                   1        1.2        0.0          1.2          0
   218    25857   1   8          1         0         0                   1        1.2        0.0          1.2          0
   219    13897   3   7        141         0         0                 174        1.2        0.0          1.2          0
   220    17700   3   5        847         0         0                1040        1.2        0.0          1.2          0
   221    21873   1   2         61         0         0                  74        1.2        0.0          1.2          0
   222    26662   1   2        394         0         0                 478        1.2        0.0          1.2          0
   223    21614   1   6         34         0         0                  41        1.2        0.0          1.2          0
   224    27741   1   2         63         0         0                  75        1.2        0.0          1.2          0
   225    22993   1   1          3         0         0                   3        1.2        0.0          1.2          0
   226    22064   1   7        172         0         0                 198        1.2        0.0          1.2          0
   227    18743   1   6       5732         0         0                6612        1.2        0.0          1.2          0
   228    24123   1   1          6         0         0                   6        1.1        0.0          1.1          0
   229    25455   1   3          3         0         0                   3        1.1        0.0          0.9          0
   230    30768   1   1         63         0         0                  68        1.1        0.0          1.1          0
   231    26342   1   2       9833         0         0               10724        1.1        0.0          1.1          0
   232    23613   1   2          3         0         0                   3        1.1        0.0          1.1          0
   233     8711   1   9       6202         0         0                6692        1.1        0.0          1.1          0
   234    27144   1   2         21         0         0                  22        1.1        0.0          1.1          0
   235     5997   1  11       6168         0         0                6539        1.1        0.0          1.1          0
   236    21860   1   3       1799         0         0                1893        1.1        0.0          1.1          0
   237    25043   1   2        172         0         0                 178        1.0        0.0          1.0          0
   238    29745   1   1       3449         0         0                3569        1.0        0.0          1.0          0
   239    25458   1   3          3         0         0                   3        1.0        0.0          0.8          0
   240    28416   1   7          1         0         0                   1        1.0        0.0          1.0          0
   241    19825   1   8         14         0         0                  14        1.0        0.0          1.0          0
   242    21670   1   4        977         0         0                 966        1.0        0.0          1.0          0
   243    26923   1   2       3928         0         0                3885        1.0        0.0          1.0          0
   244    20483   1  12       3121         0         0                3085        1.0        0.0          1.0          0
   245    29187   1   1          1         0         0                   0        1.0        0.0          1.0          0
   246    17647   3   6       1017         0         0                 987        1.0        0.0          1.0          0
   247     1613   1  16          5         0         0                   4        1.0        0.0          1.0          0
   248    23960   1   5          2         0         0                   1        0.9        0.0          0.9          0
   249    23958   1   5          2         0         0                   1        0.9        0.0          0.9          0
   250    23961   1   5          2         0         0                   1        0.9        0.0          0.9          0
   251    23959   1   5          2         0         0                   1        0.9        0.0          0.9          0
   252    19727   1   8          2         0         0                   1        0.9        0.0          0.9          0
   253    20478   1  12        594         0         0                 548        0.9        0.0          0.9          0
   254     6414   1  10       5016         0         0                4528        0.9        0.0          0.9          0
   255    23758   1   2         13         0         0                  11        0.9        0.0          0.9          0
   256    21240   1   7       1817         0         0                1621        0.9        0.0          0.9          0
   257    23513   1   4          8         0         0                   7        0.9        0.0          0.9          0
   258    20010   1   2         24         0         0                  21        0.9        0.0          0.9          0
   259    10195   1  12         22         0         0                  19        0.9        0.0          0.9          0
   260    27696   1   1          2         0         0                   1        0.9        0.0          0.9          0
   261    25798   1   7         63         0         0                  53        0.9        0.0          0.9          0
   262    20955   1   7         22         0         0                  18        0.8        0.0          0.8          0
   263    29131   1   1          1         0         0                   0        0.8        0.0          0.8          0
   264    29165   1   1         63         0         0                  52        0.8        0.0          0.8          0
   265    25451   1   4          4         0         0                   3        0.8        0.0          0.8          0
   266    23740   1   3         16         0         0                  12        0.8        0.0          0.8          0
   267    21498   1   8         82         3         0                  66        0.8        3.3          0.7          0
   268    20494   1   8          4         0         0                   3        0.8        0.0          0.8          0
   269    21318   1   6        240         0         0                 191        0.8        0.0          0.8          0
   270    26726   1   3          1         0         0                   0        0.8        0.0          0.8          0
   271     7635   1   5          8         0         0                   6        0.8        0.0          0.8          0
   272    21113   1   7         42         0         0                  33        0.8        0.0          0.8          0
   273    12221   1  10         17         0         0                  13        0.8        0.0          0.8          0
   274    25899   1   2         10         0         0                   7        0.8        0.0          0.8          0
   275    21910   1   2        940         0         0                 734        0.8        0.0          0.8          0
   276    20759   1   6       1799         0         0                1403        0.8        0.0          0.8          0
   277    16823   1   8          1         0         0                   0        0.8        0.0          0.8          0
   278     2656   1  21         12         0         0                   9        0.8        0.0          0.8          0
   279    30340   1   1        226         0         0                 169        0.7        0.0          0.7          0
   280    28108   1   3          9         0         0                   6        0.7        0.0          0.7          0
   281    19907   1  10         69         0         0                  49        0.7        0.0          0.7          0
   282    26028   1   3          8         0         0                   5        0.7        0.0          0.7          0
   283    27754   1   2         19         0         0                  13        0.7        0.0          0.7          0
   284    24892   1   4         19         0         0                  13        0.7        0.0          0.7          0
   285    27103   1   2         12         0         0                   8        0.7        0.0          0.7          0
   286    15477   1   9         18         0         0                  12        0.7        0.0          0.7          0
   287    20495   1  15        667         0         0                 463        0.7        0.0          0.7          0
   288    26735   1   3         86         0         0                  59        0.7        0.0          0.7          0
   289    21620   1   8         32         0         0                  21        0.7        0.0          0.7          0
   290    20501   1  11         20         0         0                  13        0.7        0.0          0.7          0
   291    24509   1   4         33         0         0                  22        0.7        0.0          0.7          0
   292    17106   1   9         33         0         0                  22        0.7        0.0          0.7          0
   293    20958   1   7         39         0         0                  26        0.7        0.0          0.7          0
   294    29864   1   1         63         0         0                  42        0.7        0.0          0.7          0
   295    11317   1   7          3         0         0                   2        0.7        0.0          0.7          0
   296    29188   1   1          1         0         0                   0        0.7        0.0          0.7          0
   297    20950   1   7         16         0         0                  10        0.7        0.0          0.7          0
   298    19293   1   8       1416         0         0                 938        0.7        0.0          0.7          0
   299    25682   1   3         20         0         0                  13        0.7        0.0          0.7          0
   300    23685   1   3         67         0         0                  43        0.7        0.0          0.7          0
   301    21621   1   4         32         0         0                  20        0.6        0.0          0.6          0
   302    20507   1  12         36         0         0                  23        0.6        0.0          0.6          0
   303    20953   1   7         33         0         0                  21        0.6        0.0          0.6          0
   304    26961   1   3          5         0         0                   3        0.6        0.0          0.6          0
   305    29130   1   1         63         0         0                  40        0.6        0.0          0.6          0
   306    28615   1   2         61         0         0                  38        0.6        0.0          0.6          0
   307    23405   1   5          3         0         0                   1        0.6        0.0          0.6          0
   308    21562   1   5       1799         0         0                1144        0.6        0.0          0.6          0
   309    21313   1   3       1799         0         0                1143        0.6        0.0          0.6          0
   310    21480   1   8          4         0         0                   2        0.6        0.0          0.6          0
   311    24549   1   3         29         0         0                  18        0.6        0.0          0.6          0
   312    23680   1   3        391         0         0                 246        0.6        0.0          0.6          0
   313    23515   1   4          5         0         0                   3        0.6        0.0          0.6          0
   314    21481   1   9         14         0         0                   8        0.6        0.0          0.6          0
   315    30796   1   1          6         0         0                   3        0.6        0.0          0.6          0
   316     6088   1   4          2         0         0                   1        0.6        0.0          0.6          0
   317    20451   1  13          8         0         0                   4        0.6        0.0          0.6          0
   318    20956   1   7         69         0         0                  42        0.6        0.0          0.6          0
   319    26251   1   2       2996         0         0                1830        0.6        0.0          0.6          0
   320    28238   1   1          4         0         0                   2        0.6        0.0          0.6          0
   321    28800   1   3         48         0         0                  29        0.6        0.0          0.6          0
   322    25507   1   8       2472         0         0                1489        0.6        0.0          0.6          0
   323    29891   1   2          3         0         0                   1        0.6        0.0          0.6          0
   324    29412   1   2         63         0         0                  37        0.6        0.0          0.6          0
   325    23745   1   4         79         0         0                  47        0.6        0.0          0.6          0
   326    17204   1  10         17         0         0                  10        0.6        0.0          0.6          0
   327    21371   1   5         17         0         0                  10        0.6        0.0          0.6          0
   328    20496   1  13       1076         0         0                 639        0.6        0.0          0.6          0
   329     6111   1   6       1246         4         0                 735        0.6        1.2          0.6          0
   330    20606   1   9       2888         0         0                1694        0.6        0.0          0.6          0
   331    20503   1  11        341         0         0                 198        0.6        0.0          0.6          0
   332    20952   1   7         25         0         0                  14        0.6        0.0          0.6          0
   333    24707   1   3       8641         0         0                4957        0.6        0.0          0.6          0
   334    26744   1   3          8         0         0                   4        0.6        0.0          0.6          0
   335    20471   1  12         17         0         0                   9        0.6        0.0          0.6          0
   336    17199   3   2         26         0         0                  14        0.6        0.0          0.6          0
   337    20951   1   7          2         0         0                   1        0.6        0.0          0.6          0
   338    29896   1   1      37457         0         0               21035        0.6        0.0          0.6          0
   339    18776   1   7         36         0         0                  20        0.6        0.0          0.6          0
   340    16673   1   9         36         0         0                  20        0.6        0.0          0.6          0
   341    24456   1   2        608         0         0                 338        0.6        0.0          0.6          0
   342    25054   1   3         18         0         0                  10        0.6        0.0          0.6          0
   343     7717   1   5         12         0         0                   6        0.5        0.0          0.5          0
   344    17179   1   8         22         0         0                  11        0.5        0.0          0.5          0
   345    24472   1   2          2         0         0                   1        0.5        0.0          0.5          0
   346    23742   1   3         24         0         0                  12        0.5        0.0          0.5          0
   347    20502   1  11         29         0         0                  15        0.5        0.0          0.5          0
   348    20954   1   7        112         0         0                  59        0.5        0.0          0.5          0
   349    27528   1   5          6         0         0                   3        0.5        0.0          0.5          0
   350    27529   1   5          6         0         0                   3        0.5        0.0          0.5          0
   351    23647   1   3          6         0         0                   3        0.5        0.0          0.5          0
   352    27530   1   4          6         0         0                   3        0.5        0.0          0.5          0
   353    16320   3   3        594         0         0                 313        0.5        0.0          0.5          0
   354    27102   1   3         12         0         0                   6        0.5        0.0          0.5          0
   355    23744   1   3         15         0         0                   7        0.5        0.0          0.5          0
   356    17230   1  22        837         0         0                 437        0.5        0.0          0.5          0
   357    23224   1   6        197         0         0                 101        0.5        0.0          0.5          0
   358    29449   1   1          7         0         0                   3        0.5        0.0          0.5          0
   359     6095   1   4          2         0         0                   1        0.5        0.0          0.5          0
   360    25454   1   3          4         0         0                   2        0.5        0.0          0.5          0
   361    19012   1   7         22         0         0                  11        0.5        0.0          0.5          0
   362    23679   1   5        399         0         0                 201        0.5        0.0          0.5          0
   363    24672   1   4          4         0         0                   2        0.5        0.0          0.5          0
   364    17229   1  17        588         0         0                 294        0.5        0.0          0.5          0
   365    25509   1   8       2472         0         0                1232        0.5        0.0          0.5          0
   366    17803   1  10         26         0         0                  12        0.5        0.0          0.5          0
   367    24083   1   4        210         0         0                 104        0.5        0.0          0.5          0
   368    24413   1   4          8         0         0                   3        0.5        0.0          0.5          0
   369    20957   1   8       2323         0         0                1146        0.5        0.0          0.5          0
   370     5817   1   5         63         0         0                  30        0.5        0.0          0.5          0
   371    17354   1   4          3         0         0                   1        0.5        0.0          0.5          0
   372    26963   1   1         63         0         0                  30        0.5        0.0          0.5          0
   373    28195   1   1         63         0         0                  30        0.5        0.0          0.5          0
   374    23755   1   4          8         0         0                   3        0.5        0.0          0.5          0
   375    17609   1   5         21         0         0                  10        0.5        0.0          0.5          0
   376    26964   1   1         63         0         0                  30        0.5        0.0          0.5          0
   377    25676   1   5        211         0         0                 101        0.5        0.0          0.5          0
   378    17201   3   2         22         0         0                  10        0.5        0.0          0.5          0
   379    17200   1   9         22         0         0                  10        0.5        0.0          0.5          0
   380     7060   1   6          1         0         0                   0        0.5        0.0          0.5          0
   381    23738   1   3         16         0         0                   7        0.5        0.0          0.5          0
   382    27252   1   2         18         0         0                   8        0.5        0.0          0.5          0
   383    19648   1  11        414         0         0                 197        0.5        0.0          0.5          0
   384    26803   1   3         10         0         0                   4        0.5        0.0          0.5          0
   385    30920   1   1          2         0         0                   0        0.5        0.0          0.5          0
   386     7597   1   7          5         0         0                   2        0.5        0.0          0.5          0
   387    18683   1  14          4         0         0                   1        0.5        0.0          0.5          0
   388    24553   1   4         15         0         0                   7        0.5        0.0          0.5          0
   389    23741   1   3          8         0         0                   3        0.5        0.0          0.5          0
   390    24209   1   4         53         0         0                  24        0.5        0.0          0.5          0
   391    24107   1   7          5         0         0                   2        0.5        0.0          0.5          0
   392    20572   1  10      21915         0         0                9923        0.5        0.0          0.5          0
   393    23658   1   4         12         0         0                   5        0.4        0.0          0.4          0
   394     8466   1   5        139         0         0                  62        0.4        0.0          0.4          0
   395    25807   1   3        654         0         0                 287        0.4        0.0          0.4          0
   396    23729   1   3         15         0         0                   6        0.4        0.0          0.4          0
   397    28575   1   1         33         0         0                  14        0.4        0.0          0.4          0
   398    26924   1   1          3         0         0                   1        0.4        0.0          0.4          0
   399    24594   1   2        112         0         0                  47        0.4        0.0          0.4          0
   400    23684   1   3         10         0         0                   4        0.4        0.0          0.4          0
   401    28474   1   2       2472         0         0                1040        0.4        0.0          0.4          0
   402    19148   1  10         66         0         0                  27        0.4        0.0          0.4          0
   403    23743   1   3         20         0         0                   8        0.4        0.0          0.4          0
   404    26242   1   5         16         0         0                   6        0.4        0.0          0.4          0
   405    23747   1   3         12         0         0                   5        0.4        0.0          0.4          0
   406    24550   1   3         24         0         0                   9        0.4        0.0          0.4          0
   407    19807   1   8        238         0         0                  98        0.4        0.0          0.4          0
   408    23683   1   3         20         0         0                   8        0.4        0.0          0.4          0
   409    29442   1   1         63         0         0                  25        0.4        0.0          0.4          0
   410    26106   1   4         64         0         0                  26        0.4        0.0          0.4          0
   411    20959   1   7        638         0         0                 260        0.4        0.0          0.4          0
   412    24679   1   3         15         0         0                   6        0.4        0.0          0.4          0
   413    24680   1   4         15         0         0                   6        0.4        0.0          0.4          0
   414    24678   1   3         15         0         0                   6        0.4        0.0          0.4          0
   415    24681   1   4         15         0         0                   6        0.4        0.0          0.4          0
   416    19253   1  10       4715         0         0                1911        0.4        0.0          0.4          0
   417    23748   1   4         12         0         0                   4        0.4        0.0          0.4          0
   418    25391   1   3       3950         0         0                1580        0.4        0.0          0.4          0
   419    28585   1   3       2205         0         0                 859        0.4        0.0          0.4          0
   420    21326   1   6       1076         0         0                 417        0.4        0.0          0.4          0
   421    23058   1   2          1         0         0                   0        0.4        0.0          0.4          0
   422    29346   1   1      37457         0         0               14519        0.4        0.0          0.4          0
   423     6298   1   4       2310         0         0                 880        0.4        0.0          0.4          0
   424    23464   1   3         24         0         0                   9        0.4        0.0          0.4          0
   425    28586   1   3        218         0         0                  82        0.4        0.0          0.4          0
   426    28956   1   1      37457         0         0               14038        0.4        0.0          0.4          0
   427    23760   1   6         20         0         0                   7        0.4        0.0          0.4          0
   428    23761   1   3         20         0         0                   7        0.4        0.0          0.4          0
   429    27257   1   4          1         0         0                   0        0.4        0.0          0.4          0
   430    19646   1  11         49         0         0                  18        0.4        0.0          0.4          0
   431     6090   1   5          2         0         0                   0        0.4        0.0          0.4          0
   432    24412   1   4        134         0         0                  48        0.4        0.0          0.4          0
   433     6017   1   6         77         0         0                  27        0.4        0.0          0.4          0
   434    30767   1   1         63         0         0                  21        0.3        0.0          0.3          0
   435    24706   1   3     155293         0         0               53596        0.3        0.0          0.3          0
   436    15727   1  22       1443         0         0                 496        0.3        0.0          0.3          0
   437    25122   1   4        203         0         0                  69        0.3        0.0          0.3          0
   438    27701   1   1        203         0         0                  69        0.3        0.0          0.3          0
   439    25376   1   5        142         0         0                  48        0.3        0.0          0.3          0
   440    23870   1   6        935         0         0                 317        0.3        0.0          0.3          0
   441    23746   1   3         10         0         0                   3        0.3        0.0          0.3          0
   442    28902   1   1          5         0         0                   1        0.3        0.0          0.3          0
   443    26398   1   2        128         0         0                  42        0.3        0.0          0.3          0
   444    16218   1   9      37457         0         0               12376        0.3        0.0          0.3          0
   445    20160   1   8          7         0         0                   2        0.3        0.0          0.3          0
   446    25050   1   5        686         0         0                 225        0.3        0.0          0.3          0
   447    30789   1   4       6812         0         0                2198        0.3        0.0          0.3          0
   448    27816   1   5        203         0         0                  65        0.3        0.0          0.3          0
   449    26209   1   4       1634         0         0                 526        0.3        0.0          0.3          0
   450    25680   1   3         11         0         0                   3        0.3        0.0          0.3          0
   451    24879   1   4       2993         0         0                 943        0.3        0.0          0.3          0
   452    24551   1   6      17625         0         0                5517        0.3        0.0          0.3          0
   453    26700   1   3      17625         0         0                5517        0.3        0.0          0.3          0
   454     7636   1   5       3037         0         0                 947        0.3        0.0          0.3          0
   455    21429   1   9          4         0         0                   1        0.3        0.0          0.3          0
   456    21453   1   6          4         0         0                   1        0.3        0.0          0.3          0
   457     7726   1   6         25         0         0                   7        0.3        0.0          0.3          0
   458    29183   1   1        570         0         0                 171        0.3        0.0          0.3          0
   459     7072   1   6        487         0         0                 145        0.3        0.0          0.3          0
   460    21342   1   9       1539         0         0                 454        0.3        0.0          0.3          0
   461    23739   1   3          8         0         0                   2        0.3        0.0          0.3          0
   462    26210   1   4         38         0         0                  11        0.3        0.0          0.3          0
   463    23687   1   4          6         0         0                   1        0.3        0.0          0.3          0
   464    19685   1  11        281         0         0                  81        0.3        0.0          0.3          0
   465    15511   1   5          1         0         0                   0        0.3        0.0          0.3          0
   466     6045   1   6         48         0         0                  13        0.3        0.0          0.3          0
   467    20153   1   9       1297         0         0                 348        0.3        0.0          0.3          0
   468    23479   1   3        434         0         0                 115        0.3        0.0          0.3          0
   469     5815   1   4        465         0         0                 123        0.3        0.0          0.3          0
   470    26661   1   3       5345         0         0                1411        0.3        0.0          0.3          0
   471    17447   1   5     155293         0         0               40718        0.3        0.0          0.3          0
   472    23478   1   3        436         0         0                 113        0.3        0.0          0.3          0
   473    21795   1   5       2380         0         0                 614        0.3        0.0          0.3          0
   474    22942   1   4       2380         0         0                 614        0.3        0.0          0.3          0
   475     5813   1   4       8147         0         0                2085        0.3        0.0          0.3          0
   476    19118   1  10        161         0         0                  40        0.3        0.0          0.3          0
   477    25865   1   1       1416         0         0                 353        0.2        0.0          0.2          0
   478    28593   1   1       2380         0         0                 588        0.2        0.0          0.2          0
   479    18451   1  14       1465         0         0                 331        0.2        0.0          0.2          0
   480    18308   1  10         32         0         0                   7        0.2        0.0          0.2          0
   481     7606   1   4       2416         0         0                 545        0.2        0.0          0.2          0
   482    23682   1   3          4         0         0                   0        0.2        0.0          0.2          0
   483    20144   1   8       1134         0         0                 239        0.2        0.0          0.2          0
   484    20149   1   9       1134         0         0                 239        0.2        0.0          0.2          0
   485    24506   1   6         23         0         0                   4        0.2        0.0          0.2          0
   486     7631   1   5          8         0         0                   1        0.2        0.0          0.2          0
   487    25530   1   1       7723         0         0                1588        0.2        0.0          0.2          0
   488    20842   1   7     126870         0         0               25329        0.2        0.0          0.2          0
   489     7751   1   4       9562         0         0                1849        0.2        0.0          0.2          0
   490    29902   1   2       1132         0         0                 218        0.2        0.0          0.2          0
   491    19049   1   6         18         0         0                   3        0.2        0.0          0.2          0
   492    28234   1   3         81         0         0                  15        0.2        0.0          0.2          0
   493    29182   1   1        161         0         0                  30        0.2        0.0          0.2          0
   494    19647   1  11          2         0         0                   0        0.2        0.0          0.2          0
   495    28907   1   1         58         0         0                   9        0.2        0.0          0.2          0
   496     7101   1   7        315         0         0                  51        0.2        0.0          0.2          0
   497    29185   1   1          2         0         0                   0        0.2        0.0          0.2          0
   498     5958   1   4          4         0         0                   0        0.2        0.0          0.2          0
   499     7689   1   4         16         0         0                   2        0.1        0.0          0.1          0
   500    29545   1   1         20         0         0                   2        0.1        0.0          0.1          0
   501    29544   1   1         20         0         0                   2        0.1        0.0          0.1          0
   502    29543   1   1         20         0         0                   2        0.1        0.0          0.1          0
   503    29546   1   1         20         0         0                   2        0.1        0.0          0.1          0
   504     6149   1   4         55         0         0                   7        0.1        0.0          0.1          0
   505    26449   1   3         94         0         0                  12        0.1        0.0          0.1          0
   506    25610   1   2       1752         0         0                 235        0.1        0.0          0.1          0
   507     6285   1   4       1505         0         0                 190        0.1        0.0          0.1          0
   508    23971   1   5        453         0         0                  57        0.1        0.0          0.1          0
   509     6096   1   5          2         0         0                   0        0.1        0.0          0.1          0
   510    26471   1   5          1         0         0                   0        0.1        0.0          0.1          0
   511    25674   1   1          2         0         0                   0        0.1        0.0          0.1          0
   512     7103   1  10         20         0         0                   1        0.1        0.0          0.1          0
   513     7659   1   4         43         0         0                   3        0.1        0.0          0.1          0
   514    25030   1   1          8         0         0                   0        0.1        0.0          0.1          0
   515     6089   1   4          2         0         0                   0        0.1        0.0          0.1          0
   516    23176   1   4         16         0         0                   1        0.1        0.0          0.1          0
   517     7604   1   4         18         0         0                   1        0.1        0.0          0.1          0
   518     7753   1   5         18         0         0                   1        0.1        0.0          0.1          0
   519     7795   1   4          3         0         0                   0        0.1        0.0          0.1          0
   520     7111   1   8          2         0         0                   0        0.1        0.0          0.1          0
===============================================================================
Memory usage summary:
  Total non-mmapped bytes (arena):       178913280
  Bytes in mapped regions (hblkhd):      13864960
  Total allocated space (uordblks):      97518528
  Total free space (fordblks):           81394752
  Topmost releasable block (keepcost):   108512
===============================================================================
Packet I/O Totals:
   Received:       247311
   Analyzed:       247313 (100.001%)
    Dropped:            0 (  0.000%)
   Filtered:            0 (  0.000%)
Outstanding:            0 (  0.000%)
   Injected:            0
===============================================================================
Breakdown by protocol (includes rebuilt packets):
        Eth:       247479 (100.000%)
       VLAN:          146 (  0.059%)
        IP4:       247017 ( 99.813%)
       Frag:            0 (  0.000%)
       ICMP:          518 (  0.209%)
        UDP:         3561 (  1.439%)
        TCP:       242511 ( 97.993%)
        IP6:            0 (  0.000%)
    IP6 Ext:            0 (  0.000%)
   IP6 Opts:            0 (  0.000%)
      Frag6:            0 (  0.000%)
      ICMP6:            0 (  0.000%)
       UDP6:            0 (  0.000%)
       TCP6:            0 (  0.000%)
     Teredo:            0 (  0.000%)
    ICMP-IP:            0 (  0.000%)
    IP4/IP4:            0 (  0.000%)
    IP4/IP6:            0 (  0.000%)
    IP6/IP4:            0 (  0.000%)
    IP6/IP6:            0 (  0.000%)
        GRE:            0 (  0.000%)
    GRE Eth:            0 (  0.000%)
   GRE VLAN:            0 (  0.000%)
    GRE IP4:            0 (  0.000%)
    GRE IP6:            0 (  0.000%)
GRE IP6 Ext:            0 (  0.000%)
   GRE PPTP:            0 (  0.000%)
    GRE ARP:            0 (  0.000%)
    GRE IPX:            0 (  0.000%)
   GRE Loop:            0 (  0.000%)
       MPLS:            0 (  0.000%)
        ARP:          279 (  0.113%)
        IPX:            0 (  0.000%)
   Eth Loop:           16 (  0.006%)
   Eth Disc:            0 (  0.000%)
   IP4 Disc:          299 (  0.121%)
   IP6 Disc:            0 (  0.000%)
   TCP Disc:            0 (  0.000%)
   UDP Disc:            0 (  0.000%)
  ICMP Disc:            0 (  0.000%)
All Discard:          299 (  0.121%)
      Other:          295 (  0.119%)
Bad Chk Sum:          366 (  0.148%)
    Bad TTL:            0 (  0.000%)
     S5 G 1:          120 (  0.048%)
     S5 G 2:           46 (  0.019%)
      Total:       247479
===============================================================================
Action Stats:
     Alerts:            0 (  0.000%)
     Logged:            0 (  0.000%)
     Passed:            0 (  0.000%)
Limits:
      Match:            0
      Queue:            0
        Log:            0
      Event:            0
      Alert:            0
Verdicts:
      Allow:       156237 ( 63.174%)
      Block:          272 (  0.110%)
    Replace:           42 (  0.017%)
  Whitelist:        90762 ( 36.700%)
  Blacklist:            0 (  0.000%)
     Ignore:            0 (  0.000%)
===============================================================================
Normalizer statistics:
              ip4::trim: 0
               ip4::tos: 0
                ip4::df: 0
                ip4::rf: 0
               ip4::ttl: 0
              ip4::opts: 0
            icmp4::echo: 0
               ip6::ttl: 0
              ip6::opts: 0
            icmp6::echo: 0
           tcp::syn_opt: 0
            tcp::ts_ecr: 0
               tcp::opt: 0
               tcp::pad: 0
               tcp::rsv: 0
           tcp::ecn_pkt: 0
                tcp::ns: 0
               tcp::urg: 0
               tcp::urp: 0
              tcp::trim: 0
           tcp::ecn_ssn: 0
            tcp::ts_nop: 0
          tcp::ips_data: 65
             tcp::block: 272
===============================================================================
Frag3 statistics:
        Total Fragments: 0
      Frags Reassembled: 0
               Discards: 0
          Memory Faults: 0
               Timeouts: 0
               Overlaps: 0
              Anomalies: 0
                 Alerts: 0
                  Drops: 0
     FragTrackers Added: 0
    FragTrackers Dumped: 0
FragTrackers Auto Freed: 0
    Frag Nodes Inserted: 0
     Frag Nodes Deleted: 0
===============================================================================
Stream5 statistics:
            Total sessions: 3430
              TCP sessions: 1694
              UDP sessions: 1736
             ICMP sessions: 0
               IP sessions: 0
                TCP Prunes: 0
                UDP Prunes: 0
               ICMP Prunes: 0
                 IP Prunes: 0
TCP StreamTrackers Created: 1703
TCP StreamTrackers Deleted: 1703
              TCP Timeouts: 0
              TCP Overlaps: 65
       TCP Segments Queued: 94441
     TCP Segments Released: 94441
       TCP Rebuilt Packets: 12472
         TCP Segments Used: 93598
              TCP Discards: 422
                  TCP Gaps: 0
      UDP Sessions Created: 1736
      UDP Sessions Deleted: 1736
              UDP Timeouts: 0
              UDP Discards: 0
                    Events: 342
           Internal Events: 0
           TCP Port Filter
                  Filtered: 0
                 Inspected: 0
                   Tracked: 207180
           UDP Port Filter
                  Filtered: 0
                 Inspected: 0
                   Tracked: 1736
===============================================================================
HTTP Inspect - encodings (Note: stream-reassembled packets included):
    POST methods:                         11        
    GET methods:                          3076      
    HTTP Request Headers extracted:       3090      
    HTTP Request Cookies extracted:       2428      
    Post parameters extracted:            11        
    HTTP response Headers extracted:      3005      
    HTTP Response Cookies extracted:      287       
    Unicode:                              0         
    Double unicode:                       0         
    Non-ASCII representable:              0         
    Directory traversals:                 0         
    Extra slashes ("//"):                 4         
    Self-referencing paths ("./"):        0         
    HTTP Response Gzip packets extracted: 746       
    Gzip Compressed Data Processed:       3455928.00
    Gzip Decompressed Data Processed:     13502927.00
    Total packets processed:              106881    
===============================================================================
SMTP Preprocessor Statistics
  Total sessions                                    : 50
  Max concurrent sessions                           : 14
  Base64 attachments decoded                        : 6
  Total Base64 decoded bytes                        : 48526
  Quoted-Printable attachments decoded              : 15
  Total Quoted decoded bytes                        : 264523
  UU attachments decoded                            : 0
  Total UU decoded bytes                            : 0
  Non-Encoded MIME attachments extracted            : 63
  Total Non-Encoded MIME bytes extracted            : 174515
  Sessions not decoded due to memory unavailability : 19
===============================================================================
dcerpc2 Preprocessor Statistics
  Total sessions: 0
===============================================================================
SSL Preprocessor:
   SSL packets decoded: 2369      
          Client Hello: 406       
          Server Hello: 412       
           Certificate: 136       
           Server Done: 800       
   Client Key Exchange: 133       
   Server Key Exchange: 0         
         Change Cipher: 800       
              Finished: 0         
    Client Application: 551       
    Server Application: 238       
                 Alert: 29        
  Unrecognized records: 601       
  Completed handshakes: 0         
        Bad handshakes: 0         
      Sessions ignored: 236       
    Detection disabled: 9         
===============================================================================
SIP Preprocessor Statistics
  Total sessions: 0
===============================================================================
Reputation Preprocessor Statistics
  Total Memory Allocated: 584128
  Number of packets whitelisted: 34803
===============================================================================
Snort exiting


More information about the Snort-devel mailing list