Logging retransmitted pkts.

[Mike Mestnik <cheako911 () yahoo com>]

I, like many ppl, have a caped 256Kbps upload on my modem(cable).  I have
setup TC on my linux router and I'd like to be able to monitor the
effectiveness.

One of my main concern is DROPPED pkts, as this is what the modem dose
when I'm above rate.  It's impossible for me to tell when a pkt is droped,
I used nc to send udp pkts at my third hop and it's rate was just under
7Mbps and I coulden not see any traffic(like ICMP rejects) from the modem.

The only thing I can really do is log retransmitted pkts.  Luckily I'm
only interested in TCP, so retransmitted pkts should be easy to spot.  The
problem is I have seen many program to monitor TCP flows(iptraf, tcpdump,
potion) but non of them have an easy way to count duplicates.

Now I'd like snort to help, I'v chosen it since it seams to be the most
flexible.  I'm prepared todo a little coding.

For now a simple global count would be sufficient.


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users