pcap and pfring exit stats

src/source-pcap.c

@@ -300,10 +300,27 @@ TmEcode ReceivePcapThreadInit(ThreadVars *tv, void *initdata, void **data) {
  */
 void ReceivePcapThreadExitStats(ThreadVars *tv, void *data) {
     PcapThreadVars *ptv = (PcapThreadVars *)data;
+    struct pcap_stat pcap_s;
 
+    if (pcap_stats(ptv->pcap_handle, &pcap_s) < 0) {
+        SCLogError(SC_ERR_STAT_ERROR,"(%s) Failed to get pcap_stats: %s", tv->name, pcap_geterr(ptv->pcap_handle));
         SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes);
+
+        return;
+    } else {
+        SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes);
+
+        /* these numbers are not entirely accurate as ps_recv contains packets that are still waiting to be processed at exit.
+         * ps_drop only contains packets dropped by the driver and not any packets dropped by the interface.
+         * Additionally see http://tracker.icir.org/bro/ticket/18 */
+
+        SCLogInfo("(%s) Pcap Total:%" PRIu64 " Recv:%" PRIu64 " Drop:%" PRIu64 " (%02.1f%%).", tv->name,
+        (uint64_t)pcap_s.ps_recv + (uint64_t)pcap_s.ps_drop, (uint64_t)pcap_s.ps_recv,
+        (uint64_t)pcap_s.ps_drop, ((float)pcap_s.ps_drop/(float)(pcap_s.ps_drop + pcap_s.ps_recv))*100);
+
         return;
     }
+}
 
 /**
  * \brief DeInit function closes pcap_handle at exit.

src/source-pfring.c

@@ -15,6 +15,7 @@
 #include "tm-modules.h"
 #include "tm-threads.h"
 #include "source-pfring.h"
+#include "util-debug.h"
 
 TmEcode ReceivePfring(ThreadVars *, Packet *, void *, PacketQueue *);
 TmEcode ReceivePfringThreadInit(ThreadVars *, void *, void **);
@@ -256,10 +257,23 @@ TmEcode ReceivePfringThreadInit(ThreadVars *tv, void *initdata, void **data) {
  */
 void ReceivePfringThreadExitStats(ThreadVars *tv, void *data) {
     PfringThreadVars *ptv = (PfringThreadVars *)data;
+    pfring_stat pfring_s;
+
+    if(pfring_stats(ptv->pd, &pfring_s) < 0) {
+        SCLogError(SC_ERR_STAT_ERROR,"(%s) Failed to get pfring stats", tv->name);
+        SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes);
+
+        return;
+    } else {
+        SCLogInfo("(%s) Packets %" PRIu32 ", bytes %" PRIu64 "", tv->name, ptv->pkts, ptv->bytes);
+
+        SCLogInfo("(%s) Pfring Total:%" PRIu64 " Recv:%" PRIu64 " Drop:%" PRIu64 " (%02.1f%%).", tv->name,
+        (uint64_t)pfring_s.recv + (uint64_t)pfring_s.drop, (uint64_t)pfring_s.recv,
+        (uint64_t)pfring_s.drop, ((float)pfring_s.drop/(float)(pfring_s.drop + pfring_s.recv))*100);
 
-    printf(" - (%s) Packets %" PRIu32 ", bytes %" PRIu64 ".\n", tv->name, ptv->pkts, ptv->bytes);
         return;
     }
+}
 
 /**
  * \brief DeInit function closes pd at exit.