aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

schema/decoder: add descriptions for stats counters

Browse Source 
Task #7793
pull/13743/head
Juliana Fajardini 11 months ago committed by Victor Julien
parent 342c649186
commit 49629f7cb6
2 changed files with 182 additions and 90 deletions
Show Stats Download Patch File Download Diff File

270
etc/schema.json
Unescape Escape View File

@ -5641,31 +5641,40 @@
}, },
"decoder": { "decoder": {
"type": "object", "type": "object",
"description": "Statistics for packet decoding engine",
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"arp": { "arp": {
"type": "integer" "type": "integer",
"description": "Number of ARP packets decoded"
}, },
"avg_pkt_size": { "avg_pkt_size": {
"type": "integer" "type": "integer",
"description": "Average packet size decoded"
}, },
"bytes": { "bytes": {
"type": "integer" "type": "integer",
"description": "Number of bytes decoded by the engine"
}, },
"chdlc": { "chdlc": {
"type": "integer" "type": "integer",
"description": "Number of Cisco HDLC packets decoded"
}, },
"erspan": { "erspan": {
"type": "integer" "type": "integer",
"description": "Number of ERSPAN packets decoded"
}, },
"esp": { "esp": {
"type": "integer" "type": "integer",
"description": "Number of ESP packets decoded"
}, },
"ethernet": { "ethernet": {
"type": "integer" "type": "integer",
"description": "Number of Ethernet packets decoded"
}, },
"event": { "event": {
"type": "object", "type": "object",
"description": "Statistics on events raised during packet decoding",
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"afpacket": { "afpacket": {
@ -5684,25 +5693,32 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"invalid_hardware_size": { "invalid_hardware_size": {
"type": "integer" "type": "integer",
"description": "Number of ARP packets with invalid hardware size (valid size is 6)"
}, },
"invalid_pkt": { "invalid_pkt": {
"type": "integer" "type": "integer",
"description": "Number of invalid decoded ARP packets"
}, },
"invalid_protocol_size": { "invalid_protocol_size": {
"type": "integer" "type": "integer",
"description": "Number of ARP packets with invalid protocol size (valid size is 4)"
}, },
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of ARP packets with header length too small"
}, },
"unsupported_hardware": { "unsupported_hardware": {
"type": "integer" "type": "integer",
"description": "Number of ARP packets with unsupported hardware"
}, },
"unsupported_opcode": { "unsupported_opcode": {
"type": "integer" "type": "integer",
"description": "Number of ARP packets with unsupported Operation Codes"
}, },
"unsupported_protocol": { "unsupported_protocol": {
"type": "integer" "type": "integer",
"description": "Number of ARP packets with unsupported protocol"
} }
} }
}, },
@ -5711,7 +5727,8 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of packets too small for CHDLC"
} }
} }
}, },
@ -5720,7 +5737,8 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of packets too small for DCE"
} }
} }
}, },
@ -5729,13 +5747,16 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"header_too_small": { "header_too_small": {
"type": "integer" "type": "integer",
"description": "Number of packets with header too small for ERPSAN"
}, },
"too_many_vlan_layers": { "too_many_vlan_layers": {
"type": "integer" "type": "integer",
"description": "Number of packets with too many VLAN layers for ERPSAN"
}, },
"unsupported_version": { "unsupported_version": {
"type": "integer" "type": "integer",
"description": "Number of packets with unsupported version for ERPSAN"
} }
} }
}, },
@ -5744,7 +5765,8 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of packets too small for ESP"
} }
} }
}, },
@ -5753,10 +5775,12 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of packets too small for Ethernet"
}, },
"unknown_ethertype": { "unknown_ethertype": {
"type": "integer" "type": "integer",
"description": "Number of packets with Unkonwn Ethertype for Ethernet"
} }
} }
}, },
@ -5765,7 +5789,8 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"unknown_payload_type": { "unknown_payload_type": {
"type": "integer" "type": "integer",
"description": "Number of packets with unknown payload type for Geneve"
} }
} }
}, },
@ -5774,49 +5799,64 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of packets too small for GRE"
}, },
"version0_flags": { "version0_flags": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 0 flags set for GRE"
}, },
"version0_hdr_too_big": { "version0_hdr_too_big": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 0 and header too big for GRE"
}, },
"version0_malformed_sre_hdr": { "version0_malformed_sre_hdr": {
"type": "integer" "type": "integer",
"description": "Number of packets of with version 0 and malformed SRE header for GRE"
}, },
"version0_recur": { "version0_recur": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 0 and flag recursion control set for GRE"
}, },
"version1_chksum": { "version1_chksum": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 and checksum flag set for GRE"
}, },
"version1_flags": { "version1_flags": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 flags set for GRE"
}, },
"version1_hdr_too_big": { "version1_hdr_too_big": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 and header too big for GRE"
}, },
"version1_malformed_sre_hdr": { "version1_malformed_sre_hdr": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 and malformed SRE header for GRE"
}, },
"version1_no_key": { "version1_no_key": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 and no key flag set for GRE"
}, },
"version1_recur": { "version1_recur": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 and flag recursion control set for GRE"
}, },
"version1_route": { "version1_route": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 and flag route set for GRE"
}, },
"version1_ssr": { "version1_ssr": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 and flag SSR set for GRE"
}, },
"version1_wrong_protocol": { "version1_wrong_protocol": {
"type": "integer" "type": "integer",
"description": "Number of packets with version 1 and wrong protocol set for GRE"
}, },
"wrong_version": { "wrong_version": {
"type": "integer" "type": "integer",
"description": "Number of packets with wrong version set for GRE"
} }
} }
}, },
@ -5825,19 +5865,24 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"ipv4_trunc_pkt": { "ipv4_trunc_pkt": {
"type": "integer" "type": "integer",
"description": "Number of truncated packets for ICMPv4"
}, },
"ipv4_unknown_ver": { "ipv4_unknown_ver": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv4 packets with unknown version"
}, },
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of packets too small for ICMPv4"
}, },
"unknown_code": { "unknown_code": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv4 packets with unknown code"
}, },
"unknown_type": { "unknown_type": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv4 packets with unknown type"
} }
} }
}, },
@ -5846,28 +5891,36 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"experimentation_type": { "experimentation_type": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv6 packets with private experimentation type"
}, },
"ipv6_trunc_pkt": { "ipv6_trunc_pkt": {
"type": "integer" "type": "integer",
"description": "Number of truncated ICMPv6 packets"
}, },
"ipv6_unknown_version": { "ipv6_unknown_version": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv6 packets with unknown version"
}, },
"mld_message_with_invalid_hl": { "mld_message_with_invalid_hl": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv6 packets with MLD messages and invalid HL (not 1)"
}, },
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of packets too small for ICMPv6"
}, },
"unassigned_type": { "unassigned_type": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv6 packets with unassigned type"
}, },
"unknown_code": { "unknown_code": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv6 packets with unknown code"
}, },
"unknown_type": { "unknown_type": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv6 packets with unknown type"
} }
} }
}, },
@ -5876,7 +5929,8 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"header_too_small": { "header_too_small": {
"type": "integer" "type": "integer",
"description": "Number of IEEE802.1ah packets with header too small"
} }
} }
}, },
@ -5885,7 +5939,8 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"invalid_ip_version": { "invalid_ip_version": {
"type": "integer" "type": "integer",
"description": "Number of RAW packets with invalid IP version"
} }
} }
}, },
@ -6155,17 +6210,18 @@
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "Number of SLL decoded packets that were too small"
} }
} }
}, },
"sll2": { "sll2": {
"type": "object", "type": "object",
"description": "The number of times the SLL2 header was too small to be valid",
"additionalProperties": false, "additionalProperties": false,
"properties": { "properties": {
"pkt_too_small": { "pkt_too_small": {
"type": "integer" "type": "integer",
"description": "The number of times the SLL2 header was too small to be valid"
} }
} }
}, },
@ -6247,110 +6303,144 @@
} }
}, },
"geneve": { "geneve": {
"type": "integer" "type": "integer",
"description": "Number of GENEVE packets decoded"
}, },
"gre": { "gre": {
"type": "integer" "type": "integer",
"description": "Number of GRE packets decoded"
}, },
"icmpv4": { "icmpv4": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv4 packets decoded"
}, },
"icmpv6": { "icmpv6": {
"type": "integer" "type": "integer",
"description": "Number of ICMPv6 packets decoded"
}, },
"ieee8021ah": { "ieee8021ah": {
"type": "integer" "type": "integer",
"description": "Number of IEEE802.1ah packets decoded"
}, },
"invalid": { "invalid": {
"type": "integer" "type": "integer",
"description": "Number of invalid packets decoded"
}, },
"ipv4": { "ipv4": {
"type": "integer" "type": "integer",
"description": "Number of IPv4 packets decoded"
}, },
"ipv4_in_ipv4": { "ipv4_in_ipv4": {
"type": "integer" "type": "integer",
"description": "Number of IPv4 in IPv4 packets decoded"
}, },
"ipv4_in_ipv6": { "ipv4_in_ipv6": {
"type": "integer" "type": "integer",
"description": "Number of IPv4 in IPv6 packets decoded"
}, },
"ipv6": { "ipv6": {
"type": "integer" "type": "integer",
"description": "Number of IPv6 packets decoded"
}, },
"ipv6_in_ipv4": { "ipv6_in_ipv4": {
"type": "integer" "type": "integer",
"description": "Number of IPv6 in IPv4 packets decoded"
}, },
"ipv6_in_ipv6": { "ipv6_in_ipv6": {
"type": "integer" "type": "integer",
"description": "Number of IPv6 in IPv6 packets decoded"
}, },
"max_mac_addrs_dst": { "max_mac_addrs_dst": {
"type": "integer" "type": "integer",
"description": "Maximum amount of destination MAC addresses seen per flow (only if ethernet header logging enabled)"
}, },
"max_mac_addrs_src": { "max_mac_addrs_src": {
"type": "integer" "type": "integer",
"description": "Maximum amount of source MAC addresses seen per flow (only if ethernet header logging enabled)"
}, },
"max_pkt_size": { "max_pkt_size": {
"type": "integer" "type": "integer",
"description": "Maximum packet size decoded by the engine"
}, },
"mpls": { "mpls": {
"type": "integer" "type": "integer",
"description": "Number of MPLS packets decoded"
}, },
"nsh": { "nsh": {
"type": "integer" "type": "integer",
"description": "Number of NSH packets decoded"
}, },
"null": { "null": {
"type": "integer" "type": "integer",
"description": "Number of LINKTYPE_NULL packets decoded"
}, },
"pkts": { "pkts": {
"type": "integer" "type": "integer",
"description": "Number of packets decoded"
}, },
"ppp": { "ppp": {
"type": "integer" "type": "integer",
"description": "Number of PPP packets decoded"
}, },
"pppoe": { "pppoe": {
"type": "integer" "type": "integer",
"description": "Number of PPPOE packets decoded"
}, },
"raw": { "raw": {
"type": "integer" "type": "integer",
"description": "Number of RAW packets decoded"
}, },
"sctp": { "sctp": {
"type": "integer" "type": "integer",
"description": "Number of STCP packets decoded"
}, },
"sll": { "sll": {
"type": "integer" "type": "integer",
"description": "Number of SLL packets decoded"
}, },
"sll2": { "sll2": {
"type": "integer", "type": "integer",
"description": "The number of SLL2 frames encountered" "description": "The number of SLL2 frames encountered"
}, },
"tcp": { "tcp": {
"type": "integer" "type": "integer",
"description": "Number of TCP packets decoded"
}, },
"teredo": { "teredo": {
"type": "integer" "type": "integer",
"description": "Number of Teredo packets decoded"
}, },
"too_many_layers": { "too_many_layers": {
"type": "integer" "type": "integer",
"description": "Number of decoded packets that reach maximum layers for the engine"
}, },
"udp": { "udp": {
"type": "integer" "type": "integer",
"description": "Number of UDP packets decoded"
}, },
"unknown_ethertype": { "unknown_ethertype": {
"type": "integer" "type": "integer",
"description": "Number of decoded packets with unknown ethertype"
}, },
"vlan": { "vlan": {
"type": "integer" "type": "integer",
"description": "Number of VLAN layer 2 packets decoded"
}, },
"vlan_qinq": { "vlan_qinq": {
"type": "integer" "type": "integer",
"description": "Number of VLAN layer 2 (Q-in-Q) packets decoded"
}, },
"vlan_qinqinq": { "vlan_qinqinq": {
"type": "integer" "type": "integer",
"description": "Number of VLAN layer 3 (Q-in-Q-in-Q) packets decoded"
}, },
"vntag": { "vntag": {
"type": "integer" "type": "integer",
"description": "Number of VNTAG packets decoded"
}, },
"vxlan": { "vxlan": {
"type": "integer" "type": "integer",
"description": "Number of VXLAN packets decoded"
} }
} }
}, },

2
src/decode-events.c
Unescape Escape View File

@ -599,6 +599,8 @@ const struct DecodeEvents_ DEvents[] = {
"decoder.nsh.unknown_payload", "decoder.nsh.unknown_payload",
NSH_UNKNOWN_PAYLOAD, NSH_UNKNOWN_PAYLOAD,
}, },
/* GENERIC EVENTS */
{ {
"decoder.too_many_layers", "decoder.too_many_layers",
GENERIC_TOO_MANY_LAYERS, GENERIC_TOO_MANY_LAYERS,

Write Preview
Loading…
Cancel
Save