Add counters for SYN, SYN/ACK and RST TCP packets. Issue #251.

remotes/origin/master-1.2.x
Victor Julien 14 years ago
parent 298289f43f
commit ada4066238

@ -3597,6 +3597,16 @@ static int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt,
TcpSession *ssn = (TcpSession *)p->flow->protoctx; TcpSession *ssn = (TcpSession *)p->flow->protoctx;
/* update counters */
if ((p->tcph->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) {
SCPerfCounterIncr(stt->counter_tcp_synack, tv->sc_perf_pca);
} else if (p->tcph->th_flags & (TH_SYN)) {
SCPerfCounterIncr(stt->counter_tcp_syn, tv->sc_perf_pca);
}
if (p->tcph->th_flags & (TH_RST)) {
SCPerfCounterIncr(stt->counter_tcp_rst, tv->sc_perf_pca);
}
/* If we are on IPS mode, and got a drop action triggered from /* If we are on IPS mode, and got a drop action triggered from
* the IP only module, or from a reassembled msg and/or from an * the IP only module, or from a reassembled msg and/or from an
* applayer detection, then drop the rest of the packets of the * applayer detection, then drop the rest of the packets of the
@ -3904,6 +3914,15 @@ TmEcode StreamTcpThreadInit(ThreadVars *tv, void *initdata, void **data)
stt->counter_tcp_memuse = SCPerfTVRegisterCounter("tcp.memuse", tv, stt->counter_tcp_memuse = SCPerfTVRegisterCounter("tcp.memuse", tv,
SC_PERF_TYPE_Q_NORMAL, SC_PERF_TYPE_Q_NORMAL,
"NULL"); "NULL");
stt->counter_tcp_syn = SCPerfTVRegisterCounter("tcp.syn", tv,
SC_PERF_TYPE_UINT64,
"NULL");
stt->counter_tcp_synack = SCPerfTVRegisterCounter("tcp.synack", tv,
SC_PERF_TYPE_UINT64,
"NULL");
stt->counter_tcp_rst = SCPerfTVRegisterCounter("tcp.rst", tv,
SC_PERF_TYPE_UINT64,
"NULL");
/* init reassembly ctx */ /* init reassembly ctx */
stt->ra_ctx = StreamTcpReassembleInitThreadCtx(); stt->ra_ctx = StreamTcpReassembleInitThreadCtx();

@ -86,6 +86,12 @@ typedef struct StreamTcpThread_ {
uint16_t counter_tcp_reused_ssn; uint16_t counter_tcp_reused_ssn;
/** sessions reused */ /** sessions reused */
uint16_t counter_tcp_memuse; uint16_t counter_tcp_memuse;
/** syn pkts */
uint16_t counter_tcp_syn;
/** syn/ack pkts */
uint16_t counter_tcp_synack;
/** rst pkts */
uint16_t counter_tcp_rst;
/** tcp reassembly thread data */ /** tcp reassembly thread data */
TcpReassemblyThreadCtx *ra_ctx; TcpReassemblyThreadCtx *ra_ctx;

Loading…
Cancel
Save