Snort mailing list archives
Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ?
From: Andreas Maus <maus () ypbind de>
Date: Fri, 24 Nov 2006 22:38:00 +0100
On Thu, Nov 23, 2006 at 02:24:00PM -0500, Harry Hoffman wrote:
something like: preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000 reset
Nope. debian3164m:~# grep 'preprocessor perfmonitor: time' /etc/snort/snort.conf | grep -v '^#' preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000 reset Same behaviour: *** Caught Usr-Signal Snort ran for 0 Days 16 Hours 23 Minutes 2 Seconds Packet analysis time averages: Snort Analyzed 244 Packets Per Hour Snort Analyzed 3 Packets Per Minute Snort Analyzed 0 Packets Per Second Snort received 3913 packets Analyzed: 18959(484.513%) Dropped: 0(0.000%) Outstanding: 4294952250(471422070039773184.000%) =============================================================================== Breakdown by protocol: TCP: 8790 (46.363%) UDP: 575 (3.033%) ICMP: 200 (1.055%) ARP: 9394 (49.549%) EAPOL: 0 (0.000%) IPv6: 0 (0.000%) ETHLOOP: 0 (0.000%) IPX: 0 (0.000%) FRAG: 0 (0.000%) OTHER: 0 (0.000%) DISCARD: 0 (0.000%) =============================================================================== Action Stats: ALERTS: 25 LOGGED: 25 PASSED: 0 =============================================================================== TCP Stream Reassembly Stats: TCP Packets Used: 8790 (46.363%) Stream Trackers: 122 Stream flushes: 39 Segments used: 61 Segments Queued: 61 Stream4 Memory Faults: 0 =============================================================================== Andreas. ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Andreas Maus (Nov 22)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Andreas Maus (Nov 23)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Harry Hoffman (Nov 23)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Andreas Maus (Nov 24)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Harry Hoffman (Nov 23)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Bamm Visscher (Nov 26)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Andreas Maus (Nov 27)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Bamm Visscher (Nov 27)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Andreas Maus (Nov 27)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Andreas Maus (Nov 27)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Andreas Maus (Nov 23)
- Re: Looooots of "Outstanding" and "Analyzed" packets - counter wrap ? Justin Heath (Nov 27)