[Snort-devel] [ snort-Bugs-740902 ] 2.0.x-bug: Statistics are wrong

From: SourceForge.net <noreply(at)sourceforge.net>
Date: Wed May 21 2003 - 01:26:49 EDT

Bugs item #740902, was opened at 2003-05-21 07:26 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=103357&aid=740902&group_id=3357

Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Martin Olsson (elof)
Assigned to: Nobody/Anonymous (nobody)
Summary: 2.0.x-bug: Statistics are wrong

Initial Comment:
When exiting snort you get a page of statistics. I got this page when running snort v2.0.1beta (Build 82), built with --enable-debug and executed like this:
SNORT_DEBUG=2 /usr/sentor/bin/snort -c /usr/sentor/etc/snort.conf -l /usr/sentor/log -u snort -g snort net 10.0.0.0/8 and not port 22

---

Snort analyzed 13927 out of 13927 packets, dropping 0(0.000%) packets

Breakdown by protocol:                Action Stats:
    TCP: 57         (0.409%)          ALERTS: 2         
    UDP: 26         (0.187%)          LOGGED: 2         
   ICMP: 2          (0.014%)          PASSED: 0         
    ARP: 46         (0.330%)
  EAPOL: 0          (0.000%)
   IPv6: 0          (0.000%)
    IPX: 0          (0.000%)
  OTHER: 0          (0.000%)
DISCARD: 0          (0.000%)

==============================================

Shouldn't the total sum of the protocols be equal to the number of analyzed packets?
(57+26+2+46+0+0+0+0+0) != 13927

...also the total sum of the percentage values should be 100%, IMHO.

Martin Olsson
Sentor AB, Sweden

---

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=103357&aid=740902&group_id=3357

---

This SF.net email is sponsored by: ObjectStore. If flattening out C++ or Java code to make your application fit in a relational database is painful, don't do it! Check out ObjectStore. Now part of Progress Software. http://www.objectstore.net/sourceforge

---

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Wed May 21 09:21:34 2003