snort-users May 2009 archive
Main Archive Page > Month Archives  > snort-users archives
snort-users: Re: [Snort-users] Get reliable SnortSP drop statist

Re: [Snort-users] Get reliable SnortSP drop statistics

From: Russ Combs <rcombs_at_nospam>
Date: Wed May 13 2009 - 16:05:16 GMT
To: Loc Etienne <loic.etienne@cern.ch>


On both issues, that is how SnortSP works at present ...

The drop count is maintained on the engine side and doesn't get reported by the Snort analytic, which always reports zero. Depending on how SnortSP is configured, eg with multiple load-balanced Snort analytics, it really doesn't make sense for the analytics to output drop counts. That may be removed in the future but was left in for overall compatibility.

Also, when using the tool to control SnortSP via socket, the responses are not yet routed back over the socket, but instead go to syslog or whatever as configured. That is work still to be done.

Thanks for pointing these issues out. I'll try to get those into the README before the next release.

Russ

On Wed, May 13, 2009 at 8:52 AM, Loc Etienne <loic.etienne@cern.ch> wrote:

> Hello guys,
>
> I'm currently running snortsp beta 3 on a link with very high traffic
> (500-600mbits/s) and I have noticed something strange concerning the packet
> drop statistics.
>
> We currently run the perfmonitor preprocessor with the following config:
> preprocessor perfmonitor: time 600 file /opt/snort/log/current/snort.stats
> pktcnt 100000
>
> When looking at its output, it always report 0.000 packet drop ratio
>
> Examples:
>
>
> 1242216008,0.000,598.942,0.005,87.934,853,68.964,556.730,526.659,906.033,295.431,3173088,3173088,144.991,0,250175,0.000,0.000,0.000,0.000,0.000,0.000,0,0,0,0,8,0.000,0.000,100.000,15.421,10.819,73.760,99.455,0.298,0.247,14.802,10.048,75.150,0.020,0.000,99.977,14.971,10.249,74.779,0.118,0.103,99.778,13.328,9.072,77.600,598.942,0.000,0.000,1.664,600.606,852,0,0,1434,853,87.790,0.000,0.000,0.145,87.934,52739772,0,0,0.000,0.000,0,0,3173088,715758,943715,1514173,233.324,87.807,416.650,0.000,0.000,0,0,0.000,0,0.000,
> (...)
>
> 1242218389,0.000,530.755,0.000,77.491,858,74.349,505.810,483.263,928.088,177.573,450360,450360,106.160,0,153813,0.000,0.000,0.000,0.000,0.000,0.000,0,0,0,0,8,0.852,0.948,98.200,14.748,18.953,66.300,2.367,2.657,94.976,16.991,21.658,61.351,8.667,10.020,81.313,0.248,0.321,99.432,0.607,0.672,98.721,99.688,0.181,0.131,530.755,0.000,0.000,1.223,531.977,857,0,0,1439,858,77.385,0.000,0.000,0.106,77.491,46453551,0,0,0.000,0.000,0,0,450360,130207,169289,150880,283.355,50.508,256.326,0.000,0.000,0,0,0.000,0,0.000,
>
>
> However, when I query directly the snortsp engine with eng.stats("e1") in
> the LUA shell for example, I get the following:
>
> [*] ACTIVE data source s1 received 153960354 packets on eth2
> Analyzed: 70274715 (45.645%)
> Dropped: 83685639 (54.355%)
> Idle Cycles: 70274660
> [-] Ethernet Stats:
> Count: 70304420
> (...)
>
> Do you see any reason why these two methods would report different numbers?
> Is the preprocessor printing another drop ratio than the engine?
>
> Also, we have another snort instance running on a production server (deamon
> mode), and we would like to check the output of the eng.stats() command.
> According to the documentation, it is possible to use the snortsp_tool to
> interface directly with snortsp through a kernel socket. It works fine to
> issue commands to snort, but we are unable to redirect it's output back to
> us. There is not much documentation on snortsp_tool out there, so maybe
> there is an easy way to do that?
>
> Thanks in advance for your expertise !
>
> Cheers,
> Loc Etienne
>
>
>
>
> ------------------------------------------------------------------------------
> The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your
> production scanning environment may not be a perfect world - but thanks to
> Kodak, there's a perfect scanner to get the job done! With the NEW KODAK
> i700
> Series Scanner you'll get full speed at 300 dpi even with all image
> processing features enabled. http://p.sf.net/sfu/kodak-com
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>



The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your production scanning environment may not be a perfect world - but thanks to Kodak, there's a perfect scanner to get the job done! With the NEW KODAK i700 Series Scanner you'll get full speed at 300 dpi even with all image processing features enabled. http://p.sf.net/sfu/kodak-com



Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users