[Snort-users] Looooots of "Outstanding" and "Analyzed" packets - counter wrap ?

Andreas Maus maus at ...13999...
Wed Nov 22 13:55:58 EST 2006


Hi.

I'm running Snort Version 2.6.1 (Build 24) inline and
don't have any problems so far.

But after a look at the stats Snort generates after
a restart (after stop) I start to think about their
meanings. Especially the number of "Analyzed" and 
"Outstanding" packets:

[... snipp ...]
Snort ran for 0 Days 19 Hours 37 Minutes 20 Seconds
Packet analysis time averages:

Snort Analyzed 270 Packets Per Hour
Snort Analyzed 4 Packets Per Minute
Snort Analyzed 0 Packets Per Second

Snort received 5145 packets
    Analyzed: 37793(734.558%)
    Dropped: 0(0.000%)
    Outstanding: 4294934648(358537307160051712.000%)
    ===============================================================================
    Breakdown by protocol:
      TCP: 23839      (63.078%)
      UDP: 3472       (9.187%)
     ICMP: 265        (0.701%)
      ARP: 10217      (27.034%)
    EAPOL: 0          (0.000%)
     IPv6: 0          (0.000%)
  ETHLOOP: 0          (0.000%)
      IPX: 0          (0.000%)
     FRAG: 0          (0.000%)
    OTHER: 0          (0.000%)
  DISCARD: 0          (0.000%)
    ===============================================================================
    Action Stats:

[... snipp ...]

O.K. no packets are dropped which is a Good Thing (tm), but where does
the odd counters for analyzed (over 700 % ?) and outstanding packets
(358537307160051712.000% ! *gasp*)? The number of outstanding packets
looks strange. If I subtract the number of outstanding packets from
2^32 I will get a more reasonable number of 32648. Counter wrap ?

Any comments/hints would be helpfull.

Many thanks in advance,

Andreas.

P.S.: The system is running Debian 3.1 (stable) with:
debian3164m:~# uname -a
Linux debian3164m 2.6.8-12-amd64-k8-smp #1 SMP Tue Sep 19 01:04:26 UTC 2006 x86_64 GNU/Linux





More information about the Snort-users mailing list