aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add per app layer parser profiling

Browse Source 
Per packet per app layer parser profiling. Example summary output:

Per App layer parser stats:

App Layer              IP ver   Proto   cnt        min      max          avg
--------------------   ------   -----   ------     ------   ----------   -------
ALPROTO_HTTP            IPv4       6    163394        126     38560320     42814
ALPROTO_FTP             IPv4       6       644        117        26100      2566
ALPROTO_TLS             IPv4       6       670        117         7137       799
ALPROTO_SMB             IPv4       6    114794        126       225270       957
ALPROTO_DCERPC          IPv4       6      5207        126        25596      1266

Also added to the csv out.

In the csv out there is a new column "stream (no app)" that removes the
app layer parsers from the stream tracking. So raw stream engine performance
becomes visible.
remotes/origin/master-1.1.x
Victor Julien 14 years ago
parent 0cc9f39200
commit fca541f40e
9 changed files with 250 additions and 5 deletions
Show Stats Download Patch File Download Diff File

2
src/Makefile.am
Unescape Escape View File

@ -237,7 +237,7 @@ counters.c counters.h \
app-layer.c app-layer.h \ app-layer.c app-layer.h \
app-layer-detect-proto.c app-layer-detect-proto.h \ app-layer-detect-proto.c app-layer-detect-proto.h \
app-layer-parser.c app-layer-parser.h \ app-layer-parser.c app-layer-parser.h \
app-layer-protos.h \ app-layer-protos.c app-layer-protos.h \
app-layer-htp.c app-layer-htp.h \ app-layer-htp.c app-layer-htp.h \
app-layer-smb.c app-layer-smb.h \ app-layer-smb.c app-layer-smb.h \
app-layer-smb2.c app-layer-smb2.h \ app-layer-smb2.c app-layer-smb2.h \

56
src/app-layer-protos.c
Unescape Escape View File

@ -0,0 +1,56 @@
/* Copyright (C) 2007-2011 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Victor Julien <victor@inliniac.net>
*/
#include "suricata-common.h"
#define CASE_CODE(E) case E: return #E
/**
* \brief Maps the ALPROTO_*, to its string equivalent
*
* \param proto app layer protocol id
*
* \retval string equivalent for the alproto
*/
const char *TmModuleAlprotoToString(int proto)
{
switch (proto) {
CASE_CODE (ALPROTO_UNKNOWN);
CASE_CODE (ALPROTO_HTTP);
CASE_CODE (ALPROTO_FTP);
CASE_CODE (ALPROTO_SMTP);
CASE_CODE (ALPROTO_TLS);
CASE_CODE (ALPROTO_SSH);
CASE_CODE (ALPROTO_IMAP);
CASE_CODE (ALPROTO_MSN);
CASE_CODE (ALPROTO_JABBER);
CASE_CODE (ALPROTO_SMB);
CASE_CODE (ALPROTO_SMB2);
CASE_CODE (ALPROTO_DCERPC);
CASE_CODE (ALPROTO_DCERPC_UDP);
default:
return "ALPROTO_UNDEFINED";
}
}

2
src/app-layer-protos.h
Unescape Escape View File

@ -45,5 +45,7 @@ enum {
ALPROTO_MAX, ALPROTO_MAX,
}; };
const char *TmModuleAlprotoToString(int proto);
#endif /* __APP_LAYER_PROTOS_H__ */ #endif /* __APP_LAYER_PROTOS_H__ */

6
src/app-layer.c
Unescape Escape View File

@ -33,6 +33,7 @@
#include "util-debug.h" #include "util-debug.h"
#include "util-print.h" #include "util-print.h"
#include "util-profiling.h"
//#define PRINT //#define PRINT
extern uint8_t engine_mode; extern uint8_t engine_mode;
@ -161,7 +162,10 @@ int AppLayerHandleTCPData(AlpProtoDetectThreadCtx *dp_ctx, Flow *f,
FlowL7DataPtrInit(f); FlowL7DataPtrInit(f);
f->alproto = alproto; f->alproto = alproto;
ssn->flags |= STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED; ssn->flags |= STREAMTCP_FLAG_APPPROTO_DETECTION_COMPLETED;
PACKET_PROFILING_APP_START(dp_ctx, alproto);
r = AppLayerParse(f, alproto, flags, data, data_len); r = AppLayerParse(f, alproto, flags, data, data_len);
PACKET_PROFILING_APP_END(dp_ctx, alproto);
} else { } else {
if (flags & STREAM_TOSERVER) { if (flags & STREAM_TOSERVER) {
SCLogDebug("alp_proto_ctx.toserver.max_len %u", alp_proto_ctx.toserver.max_len); SCLogDebug("alp_proto_ctx.toserver.max_len %u", alp_proto_ctx.toserver.max_len);
@ -193,7 +197,9 @@ int AppLayerHandleTCPData(AlpProtoDetectThreadCtx *dp_ctx, Flow *f,
/* if we don't have a data object here we are not getting it /* if we don't have a data object here we are not getting it
* a start msg should have gotten us one */ * a start msg should have gotten us one */
if (alproto != ALPROTO_UNKNOWN) { if (alproto != ALPROTO_UNKNOWN) {
PACKET_PROFILING_APP_START(dp_ctx, alproto);
r = AppLayerParse(f, alproto, flags, data, data_len); r = AppLayerParse(f, alproto, flags, data, data_len);
PACKET_PROFILING_APP_END(dp_ctx, alproto);
} else { } else {
SCLogDebug(" smsg not start, but no l7 data? Weird"); SCLogDebug(" smsg not start, but no l7 data? Weird");
} }

14
src/decode.h
Unescape Escape View File

@ -53,6 +53,8 @@
#include "detect-reference.h" #include "detect-reference.h"
#include "app-layer-protos.h"
#ifdef __SC_CUDA_SUPPORT__ #ifdef __SC_CUDA_SUPPORT__
#define CUDA_MAX_PAYLOAD_SIZE 1500 #define CUDA_MAX_PAYLOAD_SIZE 1500
#endif #endif
@ -272,12 +274,17 @@ typedef struct PktProfilingTmmData_ {
uint64_t ticks_end; uint64_t ticks_end;
} PktProfilingTmmData; } PktProfilingTmmData;
typedef struct PktProfilingAppData_ {
uint64_t ticks_spent;
} PktProfilingAppData;
/** \brief Per pkt stats storage */ /** \brief Per pkt stats storage */
typedef struct PktProfiling_ { typedef struct PktProfiling_ {
uint64_t ticks_start; uint64_t ticks_start;
uint64_t ticks_end; uint64_t ticks_end;
PktProfilingTmmData tmm[TMM_SIZE]; PktProfilingTmmData tmm[TMM_SIZE];
PktProfilingAppData app[ALPROTO_MAX];
} PktProfiling; } PktProfiling;
#endif /* PROFILING */ #endif /* PROFILING */
@ -465,6 +472,13 @@ typedef struct AlpProtoDetectDirectionThread_ {
typedef struct AlpProtoDetectThreadCtx_ { typedef struct AlpProtoDetectThreadCtx_ {
AlpProtoDetectDirectionThread toserver; AlpProtoDetectDirectionThread toserver;
AlpProtoDetectDirectionThread toclient; AlpProtoDetectDirectionThread toclient;
#ifdef PROFILING
uint64_t ticks_start;
uint64_t ticks_end;
uint32_t ticks_spent;
uint16_t alproto;
#endif
} AlpProtoDetectThreadCtx; } AlpProtoDetectThreadCtx;
/** \brief Structure to hold thread specific data for all decode modules */ /** \brief Structure to hold thread specific data for all decode modules */

23
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -58,6 +58,8 @@
#include "detect-engine-state.h" #include "detect-engine-state.h"
#include "util-profiling.h"
#define PSEUDO_PACKET_PAYLOAD_SIZE 65416 /* 64 Kb minus max IP and TCP header */ #define PSEUDO_PACKET_PAYLOAD_SIZE 65416 /* 64 Kb minus max IP and TCP header */
#ifdef DEBUG #ifdef DEBUG
@ -1853,6 +1855,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags); STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags);
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
NULL, 0, flags|STREAM_EOF); NULL, 0, flags|STREAM_EOF);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
/* even if app layer detection failed, we will now move on to /* even if app layer detection failed, we will now move on to
* release reassembly for both directions. */ * release reassembly for both directions. */
@ -1950,12 +1953,14 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
stream->tmp_ra_app_base_seq = ra_base_seq; stream->tmp_ra_app_base_seq = ra_base_seq;
} else { } else {
/* process what we have so far */ /* process what we have so far */
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
stream->ra_app_base_seq = ra_base_seq; stream->ra_app_base_seq = ra_base_seq;
} }
@ -1998,6 +2003,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags); STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags);
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
NULL, 0, flags|STREAM_GAP); NULL, 0, flags|STREAM_GAP);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_len = 0; data_len = 0;
/* set a GAP flag and make sure not bothering this stream anymore */ /* set a GAP flag and make sure not bothering this stream anymore */
@ -2075,6 +2081,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_sent += data_len; data_sent += data_len;
data_len = 0; data_len = 0;
@ -2085,6 +2092,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_sent += data_len; data_sent += data_len;
data_len = 0; data_len = 0;
@ -2147,6 +2155,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_sent += data_len; data_sent += data_len;
data_len = 0; data_len = 0;
@ -2157,6 +2166,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_sent += data_len; data_sent += data_len;
data_len = 0; data_len = 0;
@ -2198,6 +2208,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_sent += data_len; data_sent += data_len;
stream->tmp_ra_app_base_seq = ra_base_seq; stream->tmp_ra_app_base_seq = ra_base_seq;
} else { } else {
@ -2206,6 +2217,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_sent += data_len; data_sent += data_len;
stream->ra_app_base_seq = ra_base_seq; stream->ra_app_base_seq = ra_base_seq;
} }
@ -2225,6 +2237,7 @@ static int StreamTcpReassembleInlineAppLayer (TcpReassemblyThreadCtx *ra_ctx,
STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags); STREAM_SET_INLINE_FLAGS(ssn, stream, p, flags);
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
NULL, 0, flags|STREAM_EOF); NULL, 0, flags|STREAM_EOF);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
/* even if app layer detection failed, we will now move on to /* even if app layer detection failed, we will now move on to
* release reassembly for both directions. */ * release reassembly for both directions. */
@ -2607,6 +2620,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
STREAM_SET_FLAGS(ssn, stream, p, flags); STREAM_SET_FLAGS(ssn, stream, p, flags);
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
NULL, 0, flags|STREAM_EOF); NULL, 0, flags|STREAM_EOF);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
/* even if app layer detection failed, we will now move on to /* even if app layer detection failed, we will now move on to
* release reassembly for both directions. */ * release reassembly for both directions. */
@ -2740,12 +2754,14 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
stream->tmp_ra_app_base_seq = ra_base_seq; stream->tmp_ra_app_base_seq = ra_base_seq;
} else { } else {
/* process what we have so far */ /* process what we have so far */
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
stream->ra_app_base_seq = ra_base_seq; stream->ra_app_base_seq = ra_base_seq;
} }
@ -2787,6 +2803,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
STREAM_SET_FLAGS(ssn, stream, p, flags); STREAM_SET_FLAGS(ssn, stream, p, flags);
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
NULL, 0, flags|STREAM_GAP); NULL, 0, flags|STREAM_GAP);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_len = 0; data_len = 0;
/* set a GAP flag and make sure not bothering this stream anymore */ /* set a GAP flag and make sure not bothering this stream anymore */
@ -2889,6 +2906,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_len = 0; data_len = 0;
stream->tmp_ra_app_base_seq = ra_base_seq; stream->tmp_ra_app_base_seq = ra_base_seq;
@ -2898,6 +2916,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_len = 0; data_len = 0;
stream->ra_app_base_seq = ra_base_seq; stream->ra_app_base_seq = ra_base_seq;
@ -2959,6 +2978,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_len = 0; data_len = 0;
stream->tmp_ra_app_base_seq = ra_base_seq; stream->tmp_ra_app_base_seq = ra_base_seq;
@ -2968,6 +2988,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
data_len = 0; data_len = 0;
stream->ra_app_base_seq = ra_base_seq; stream->ra_app_base_seq = ra_base_seq;
@ -3013,6 +3034,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
stream->tmp_ra_app_base_seq = ra_base_seq; stream->tmp_ra_app_base_seq = ra_base_seq;
} else { } else {
/* process what we have so far */ /* process what we have so far */
@ -3020,6 +3042,7 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
BUG_ON(data_len > sizeof(data)); BUG_ON(data_len > sizeof(data));
AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn, AppLayerHandleTCPData(&ra_ctx->dp_ctx, p->flow, ssn,
data, data_len, flags); data, data_len, flags);
PACKET_PROFILING_APP_STORE(&ra_ctx->dp_ctx, p);
stream->ra_app_base_seq = ra_base_seq; stream->ra_app_base_seq = ra_base_seq;
} }

3
src/stream-tcp.c
Unescape Escape View File

@ -63,6 +63,7 @@
#include "util-host-os-info.h" #include "util-host-os-info.h"
#include "util-privs.h" #include "util-privs.h"
#include "util-profiling.h"
//#define DEBUG //#define DEBUG
@ -3765,6 +3766,8 @@ TmEcode StreamTcp (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, Packe
return TM_ECODE_OK; return TM_ECODE_OK;
} }
PACKET_PROFILING_APP_RESET(&stt->ra_ctx->dp_ctx);
SCMutexLock(&p->flow->m); SCMutexLock(&p->flow->m);
ret = StreamTcpPacket(tv, p, stt, pq); ret = StreamTcpPacket(tv, p, stt, pq);
SCMutexUnlock(&p->flow->m); SCMutexUnlock(&p->flow->m);

115
src/util-profiling.c
Unescape Escape View File

@ -95,6 +95,9 @@ SCProfilePacketData packet_profile_data6[257]; /**< all proto's + tunnel */
SCProfilePacketData packet_profile_tmm_data4[TMM_SIZE][257]; SCProfilePacketData packet_profile_tmm_data4[TMM_SIZE][257];
SCProfilePacketData packet_profile_tmm_data6[TMM_SIZE][257]; SCProfilePacketData packet_profile_tmm_data6[TMM_SIZE][257];
SCProfilePacketData packet_profile_app_data4[TMM_SIZE][257];
SCProfilePacketData packet_profile_app_data6[TMM_SIZE][257];
/** /**
* Used for generating the summary data to print. * Used for generating the summary data to print.
*/ */
@ -232,6 +235,8 @@ SCProfilingInit(void)
memset(&packet_profile_data6, 0, sizeof(packet_profile_data6)); memset(&packet_profile_data6, 0, sizeof(packet_profile_data6));
memset(&packet_profile_tmm_data4, 0, sizeof(packet_profile_tmm_data4)); memset(&packet_profile_tmm_data4, 0, sizeof(packet_profile_tmm_data4));
memset(&packet_profile_tmm_data6, 0, sizeof(packet_profile_tmm_data6)); memset(&packet_profile_tmm_data6, 0, sizeof(packet_profile_tmm_data6));
memset(&packet_profile_app_data4, 0, sizeof(packet_profile_app_data4));
memset(&packet_profile_app_data6, 0, sizeof(packet_profile_app_data6));
const char *filename = ConfNodeLookupChildValue(conf, "filename"); const char *filename = ConfNodeLookupChildValue(conf, "filename");
if (filename != NULL) { if (filename != NULL) {
@ -280,7 +285,11 @@ SCProfilingInit(void)
for (i = 0; i < TMM_SIZE; i++) { for (i = 0; i < TMM_SIZE; i++) {
fprintf(packet_profile_csv_fp, "%s,", TmModuleTmmIdToString(i)); fprintf(packet_profile_csv_fp, "%s,", TmModuleTmmIdToString(i));
} }
fprintf(packet_profile_csv_fp, "threading\n"); fprintf(packet_profile_csv_fp, "threading,");
for (i = 0; i < ALPROTO_MAX; i++) {
fprintf(packet_profile_csv_fp, "%s,", TmModuleAlprotoToString(i));
}
fprintf(packet_profile_csv_fp, "STREAM (no app)\n");
profiling_packets_csv_enabled = 1; profiling_packets_csv_enabled = 1;
} }
@ -682,6 +691,7 @@ void SCProfilingDumpPacketStats(void) {
fprintf(fp, " IPv6 %3d %8u %6u %10u %8"PRIu64"\n", i, pd->cnt, fprintf(fp, " IPv6 %3d %8u %6u %10u %8"PRIu64"\n", i, pd->cnt,
pd->min, pd->max, pd->tot / pd->cnt); pd->min, pd->max, pd->tot / pd->cnt);
} }
fprintf(fp, "Note: Protocol 256 tracks pseudo/tunnel packets.\n");
fprintf(fp, "\nPer Thread module stats:\n"); fprintf(fp, "\nPer Thread module stats:\n");
@ -713,8 +723,43 @@ void SCProfilingDumpPacketStats(void) {
continue; continue;
} }
fprintf(fp, "%3d IPv6 %3d %8u %6u %10u %8"PRIu64"\n", fprintf(fp, "%-24s IPv6 %3d %8u %6u %10u %8"PRIu64"\n",
m, p, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt); TmModuleTmmIdToString(m), p, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt);
}
}
fprintf(fp, "Note: TMM_STREAMTCP includes TCP app layer parsers, see below.\n");
fprintf(fp, "\nPer App layer parser stats:\n");
fprintf(fp, "\n%-20s %-6s %-5s %-8s %-6s %-10s %-8s\n",
"App Layer", "IP ver", "Proto", "cnt", "min", "max", "avg");
fprintf(fp, "%-20s %-6s %-5s %-8s %-6s %-10s %-8s\n",
"--------------------", "------", "-----", "------", "------", "----------", "-------");
for (m = 0; m < ALPROTO_MAX; m++) {
int p;
for (p = 0; p < 257; p++) {
SCProfilePacketData *pd = &packet_profile_app_data4[m][p];
if (pd->cnt == 0) {
continue;
}
fprintf(fp, "%-20s IPv4 %3d %8u %6u %10u %8"PRIu64"\n",
TmModuleAlprotoToString(m), p, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt);
}
}
for (m = 0; m < ALPROTO_MAX; m++) {
int p;
for (p = 0; p < 257; p++) {
SCProfilePacketData *pd = &packet_profile_app_data6[m][p];
if (pd->cnt == 0) {
continue;
}
fprintf(fp, "%-20s IPv6 %3d %8u %6u %10u %8"PRIu64"\n",
TmModuleAlprotoToString(m), p, pd->cnt, pd->min, pd->max, pd->tot / pd->cnt);
} }
} }
@ -734,15 +779,74 @@ void SCProfilingPrintPacketProfile(Packet *p) {
int i; int i;
uint32_t tmm_total = 0; uint32_t tmm_total = 0;
uint32_t tmm_streamtcp_tcp = 0;
for (i = 0; i < TMM_SIZE; i++) { for (i = 0; i < TMM_SIZE; i++) {
PktProfilingTmmData *pdt = &p->profile.tmm[i]; PktProfilingTmmData *pdt = &p->profile.tmm[i];
uint32_t tmm_delta = (uint32_t)(pdt->ticks_end - pdt->ticks_start); uint32_t tmm_delta = (uint32_t)(pdt->ticks_end - pdt->ticks_start);
fprintf(packet_profile_csv_fp, "%u,", tmm_delta); fprintf(packet_profile_csv_fp, "%u,", tmm_delta);
tmm_total += tmm_delta; tmm_total += tmm_delta;
if (p->proto == IPPROTO_TCP && i == TMM_STREAMTCP) {
tmm_streamtcp_tcp = tmm_delta;
}
} }
fprintf(packet_profile_csv_fp, "%u\n", delta - tmm_total); fprintf(packet_profile_csv_fp, "%u,", delta - tmm_total);
uint32_t app_total = 0;
for (i = 0; i < ALPROTO_MAX; i++) {
PktProfilingAppData *pdt = &p->profile.app[i];
fprintf(packet_profile_csv_fp,"%"PRIu64",", pdt->ticks_spent);
if (p->proto == IPPROTO_TCP) {
app_total += pdt->ticks_spent;
}
}
fprintf(packet_profile_csv_fp, "%"PRIu32",", tmm_streamtcp_tcp - app_total);
fprintf(packet_profile_csv_fp,"\n");
}
void SCProfilingUpdatePacketAppRecord(int alproto, uint8_t ipproto, PktProfilingAppData *pdt, int ipver) {
if (pdt == NULL) {
return;
}
SCProfilePacketData *pd;
if (ipver == 4)
pd = &packet_profile_app_data4[alproto][ipproto];
else
pd = &packet_profile_app_data6[alproto][ipproto];
if (pd->min == 0 || pdt->ticks_spent < pd->min) {
pd->min = pdt->ticks_spent;
}
if (pd->max < pdt->ticks_spent) {
pd->max = pdt->ticks_spent;
}
pd->tot += pdt->ticks_spent;
pd->cnt ++;
}
void SCProfilingUpdatePacketAppRecords(Packet *p) {
int i;
for (i = 0; i < ALPROTO_MAX; i++) {
PktProfilingAppData *pdt = &p->profile.app[i];
if (pdt->ticks_spent == 0) {
continue;
}
if (PKT_IS_IPV4(p)) {
SCProfilingUpdatePacketAppRecord(i, p->proto, pdt, 4);
} else {
SCProfilingUpdatePacketAppRecord(i, p->proto, pdt, 6);
}
}
} }
void SCProfilingUpdatePacketTmmRecord(int module, uint8_t proto, PktProfilingTmmData *pdt, int ipver) { void SCProfilingUpdatePacketTmmRecord(int module, uint8_t proto, PktProfilingTmmData *pdt, int ipver) {
@ -820,6 +924,8 @@ void SCProfilingAddPacket(Packet *p) {
} }
SCProfilingUpdatePacketTmmRecords(p); SCProfilingUpdatePacketTmmRecords(p);
SCProfilingUpdatePacketAppRecords(p);
} else if (PKT_IS_IPV6(p)) { } else if (PKT_IS_IPV6(p)) {
SCProfilePacketData *pd = &packet_profile_data6[p->proto]; SCProfilePacketData *pd = &packet_profile_data6[p->proto];
@ -849,6 +955,7 @@ void SCProfilingAddPacket(Packet *p) {
} }
SCProfilingUpdatePacketTmmRecords(p); SCProfilingUpdatePacketTmmRecords(p);
SCProfilingUpdatePacketAppRecords(p);
} }
} }
SCMutexUnlock(&packet_profile_lock); SCMutexUnlock(&packet_profile_lock);

34
src/util-profiling.h
Unescape Escape View File

@ -86,6 +86,35 @@ void SCProfilingAddPacket(Packet *);
memset(&(p)->profile, 0x00, sizeof(PktProfiling)); \ memset(&(p)->profile, 0x00, sizeof(PktProfiling)); \
} }
#define PACKET_PROFILING_APP_START(dp, id) \
if (profiling_packets_enabled) { \
(dp)->ticks_start = UtilCpuGetTicks(); \
(dp)->alproto = (id); \
}
#define PACKET_PROFILING_APP_END(dp, id) \
if (profiling_packets_enabled) { \
BUG_ON((id) != (dp)->alproto); \
(dp)->ticks_end = UtilCpuGetTicks(); \
(dp)->ticks_spent = ((dp)->ticks_end - (dp)->ticks_start); \
}
#define PACKET_PROFILING_APP_RESET(dp) \
if (profiling_packets_enabled) { \
(dp)->ticks_start = 0; \
(dp)->ticks_end = 0; \
(dp)->ticks_spent = 0; \
(dp)->alproto = 0; \
}
#define PACKET_PROFILING_APP_STORE(dp, p) \
if (profiling_packets_enabled) { \
if ((dp)->alproto < ALPROTO_MAX) { \
(p)->profile.app[(dp)->alproto].ticks_spent += (dp)->ticks_spent; \
} \
}
void SCProfilingInit(void); void SCProfilingInit(void);
void SCProfilingDestroy(void); void SCProfilingDestroy(void);
void SCProfilingInitRuleCounters(DetectEngineCtx *); void SCProfilingInitRuleCounters(DetectEngineCtx *);
@ -107,6 +136,11 @@ void SCProfilingUpdateRuleCounter(uint16_t, uint64_t, int);
#define PACKET_PROFILING_RESET(p) #define PACKET_PROFILING_RESET(p)
#define PACKET_PROFILING_APP_START(dp, id)
#define PACKET_PROFILING_APP_END(dp, id)
#define PACKET_PROFILING_APP_RESET(dp)
#define PACKET_PROFILING_APP_STORE(dp, p)
#endif /* PROFILING */ #endif /* PROFILING */
#endif /* ! __UTIL_PROFILE_H__ */ #endif /* ! __UTIL_PROFILE_H__ */

Write Preview
Loading…
Cancel
Save