[Snort-users] afpacket DAQ - large "Outstanding" number/percent

Randal T. Rioux randy at ...13561...
Wed Oct 13 21:38:44 EDT 2010


On 10/13/2010 03:11 PM, Jason Wallace wrote:
> Is anyone else seeing a strange "Outstanding" number/percent after
> exiting when using afpacket in passive mode? It only seems to occur in
> daemon mode (-D).
> 
> 
> Oct 13 15:05:46  snort[1331]: Can't acquire (-1) -
> afpacket_daq_acquire: Poll failed: Interrupted system call!
> Oct 13 15:05:47 snort[1331]:
> ===============================================================================
> Oct 13 15:05:47 snort[1331]: Packet I/O Totals:
> Oct 13 15:05:47 snort[1331]:    Received:       650083
> Oct 13 15:05:47 snort[1331]:    Analyzed:        24754 (  3.808%)
> Oct 13 15:05:47 snort[1331]:     Dropped:            0 (  0.000%)
> Oct 13 15:05:47 snort[1331]:    Filtered:       625332 ( 96.193%)
> Oct 13 15:05:47 snort[1331]: Outstanding: 18446744073709551613
> (2837598287250944.000%)
> Oct 13 15:05:47 snort[1331]:    Injected:            0
> Oct 13 15:05:47 snort[1331]:
> ===============================================================================
<snip>

This was just brought up in a recent thread:

http://marc.info/?l=snort-users&m=128146282807445&w=2

Looks like it was never fully explained. I think we'll just have to go
with Justin's answer that it just means it's really, really good ;-)

Randy




More information about the Snort-users mailing list