[Snort-users] Looooots of "Outstanding" and "Analyzed" packets - counter wrap ?

Andreas Maus maus at ...13999...
Fri Nov 24 16:38:00 EST 2006


On Thu, Nov 23, 2006 at 02:24:00PM -0500, Harry Hoffman wrote:
> something like:
> preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt
> 10000 reset
Nope.

debian3164m:~# grep  'preprocessor perfmonitor: time' /etc/snort/snort.conf | grep -v '^#'
preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000 reset

Same behaviour:

*** Caught Usr-Signal 
Snort ran for 0 Days 16 Hours 23 Minutes 2 Seconds 
Packet analysis time averages: 

Snort Analyzed 244 Packets Per Hour 
Snort Analyzed 3 Packets Per Minute 
Snort Analyzed 0 Packets Per Second 

Snort received 3913 packets 
Analyzed: 18959(484.513%) 
Dropped: 0(0.000%) 
Outstanding: 4294952250(471422070039773184.000%) 
=============================================================================== 
Breakdown by protocol: 
TCP: 8790 (46.363%) 
UDP: 575 (3.033%) 
ICMP: 200 (1.055%) 
ARP: 9394 (49.549%) 
EAPOL: 0 (0.000%) 
IPv6: 0 (0.000%) 
ETHLOOP: 0 (0.000%) 
IPX: 0 (0.000%) 
FRAG: 0 (0.000%) 
OTHER: 0 (0.000%) 
DISCARD: 0 (0.000%) 
=============================================================================== 
Action Stats: 
ALERTS: 25 
LOGGED: 25 
PASSED: 0 
=============================================================================== 
TCP Stream Reassembly Stats: 
TCP Packets Used: 8790 (46.363%) 
Stream Trackers: 122 
Stream flushes: 39 
Segments used: 61 
Segments Queued: 61 
Stream4 Memory Faults: 0 
=============================================================================== 

Andreas.





More information about the Snort-users mailing list