85 Commits (845cbcce90a1d5c2f92c7e9034b8166666298793)

Author	SHA1	Message	Date
Eric Leblond	1fa4233d67	pfring: get vlan id from header ... PF_RING is delivering the packet with VLAN header stripped. This patch updates the code to get the information from PF_RING extended header information. This patch uses the new function SCKernelVersionIsAtLeast to know that we've got a old kernel that do not strip the VLAN header from the message before sending it to userspace.	12 years ago
Eric Leblond	3ce39433dd	capture: use 64 bits counters ... Some of the packets counters were using a 32bit integer. Given the bandwidth that is often seen, this is not a good idea. This patch switches to 64bit counter.	12 years ago
Victor Julien	f7b1aefaf4	Bug 1107: decoders: bail out on pseudo packets ... Flow-timeout code injects pseudo packets into the decoders, leading to various issues. For a full explanation, see: https://redmine.openinfosecfoundation.org/issues/1107 This patch works around the issues with a hack. It adds a check to each of the decoder entry points to bail out as soon as a pseudo packet from the flow timeout is encountered. Ticket #1107.	12 years ago
Victor Julien	5f307acace	Pass ThreadVars ptr to various thread init funcs ... To be able to register counters from AppLayerGetCtxThread, the ThreadVars pointer needs to be available in it and thus in it's callers: - AppLayerGetCtxThread - DecodeThreadVarsAlloc - StreamTcpReassembleInitThreadCtx	12 years ago
Eric Leblond	c115e63dc2	pfring: fix live device counter usage ... Live device counter was in fact the number of packets seen by suricata and not the total number of packet reported by pfring. This patch fixes this by using counter provided by kernel instead. Pfring kernel counter is per socket and is not cleared after read. So to get the number of packet on the interface we can add the new value for this thread and add it to the interface counter.	12 years ago
Ken Steele	882d98733f	Fix pfring so that zero-copy mode can work. ... Detect when default_packet_size is zero, which enables zero-copy mode for pfring and in that case, do what AF Packet does and set pkt_ext pointer to the data and set PKT_ZERO_COPY flag.	12 years ago
Eric Leblond	28c5c68192	error checking: add missing alloc error treatment ... The return of some malloc like functions was not treated in some places of the code.	12 years ago
Eric Leblond	3088b6ac34	Add invalid pkt counter. ... This patch adds and increments a invalid packet counter. It does this by introducing PacketDecodeFinalize function This function is incrementing the invalid counter and is also signalling the packet to CUDA.	12 years ago
Eric Leblond	853732210e	pfring: improve error reporting at device opening ... This patch improves the error message displayed if pfring_open fails.	12 years ago
Victor Julien	677cd03e52	Counters: more unused code removal	12 years ago
Victor Julien	698ff4e4aa	Counters: remove all unused parts of the API	12 years ago
Ken Steele	5532af4621	Create SCMUTEX_INITIALIZER to abstract out PTHREAD_MUTEX_INITIALIZER ... This allows replacing pthread mutexes with other types of mutex.	12 years ago
Eric Leblond	c6e8c5bf1f	pf_ring: avoid to ask for extended header. ... This patch update pf_ring capture to avoid to ask for extended header. They are only needed when rxonly checksum checks is used and this is only possible when interface is not a DNA interface.	12 years ago
Anoop Saldanha	9698a5d78c	Code to enable cuda support for pfring live mode.	12 years ago
Eric Leblond	e14a817fbd	pfring: delete unused define.	13 years ago
Eric Leblond	ca1a70a04b	pfring: fix build failure	13 years ago
Eric Leblond	8d0260b27e	Add atomic counter for iface drop.	13 years ago
Eric Leblond	8957113550	pf-ring: fix build	13 years ago
Eric Leblond	d3195b0f70	pf_ring: don't set cluster for DNA interface.	13 years ago
Eric Leblond	3acdd4da1d	pf-ring: add counter for kernel drop and packets ... This patch adds a counter for kernel drop and packets by using the same strategy as the one used in af-packet.	13 years ago
Anoop Saldanha	b33986c887	Add a packet src for every packet generated inside suricata.	13 years ago
Eric Leblond	928ade1d04	pf-ring: suppress unused variable.	13 years ago
Eric Leblond	c3b9a5e97f	pf-ring: add missing header.	13 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	13 years ago
Eric Leblond	566674ae4a	Fix logic operator. ... Previous patches on the same subject did not fixed this error as it was undetected because the code was not compiled on my setup.	13 years ago
Eric Leblond	cdbc9be1c3	pf_ring: set cluster_id even if only one thread is used.	13 years ago
Anoop Saldanha	34581ce902	rx TMs shouldn't return TM_ECODE_FAILED if engine is in shutdown mode + minor cleanup	13 years ago
Eric Leblond	0227a87fcb	cleaning: fix warning when building with clang. ... clang was issuing some warnings related to unused return in function. This patch adds some needed error treatment and ignore the rest of the warnings by adding a cast to void.	13 years ago
Anoop Saldanha	bc6cf43840	#482 - use decode_flag for all decode TMs. Use the flag as a way to retrieve decode TMs from ThreadVars	13 years ago
Victor Julien	1bb0199dd7	pfring: protect pfring_set_bpf_filter with a lock as it's not thread safe.	13 years ago
Victor Julien	94c312512d	pfring: move missing timestamp handling code to PfringProcessPacket.	13 years ago
Chris Wakelin	a5f948f436	Fix missing timestamps in some flavours of PF_RING	13 years ago
Eric Leblond	dbf5d79e43	pfring: follow API change ... As pointed out in issue #459, pf_ring API has changed. Since 5.4.0 release pf_ring_open has one less argument.	13 years ago
Anoop Saldanha	cd4705e699	flag recieve acq tms that previously missed the receive_tm flag	13 years ago
Eric Leblond	9a2a4802f4	pf-ring: add support for checksum verif mode ... This patch adds support for checksum verification mode. Supported mode are yes, no, auto and rx-only.	14 years ago
Eric Leblond	5dc46ae7c7	pf-ring: Mark emitted traffic as non checksummed ... The traffic sent by an interface is potentially offloaded. This patch adds detection of TX packets and set the corresponding flag.	14 years ago
Eric Leblond	0ac1cabf2a	autotools: fix problem of pfring configuration.	14 years ago
deltay	d5e254d504	Add pfring bpf filter, require pfring >= 5.1	14 years ago
Eric Leblond	866d681ff2	pfring: fix stupid enum usage. ... pfring code is not using standard notation for the cluster_type enum and this leads to a horrific code in pfring acquisition code.	14 years ago
Eric Leblond	a6a0d4eae6	pfring: use deinit function. ... This fixes #368.	14 years ago
Eric Leblond	01beefc1c9	pfring: improve error handling ... Treat TmThreadsSlotProcessPkt return.	14 years ago
Anoop Saldanha	d68f182ebd	introduce SCPerfSyncCounters/SCPerfSyncCounters macro to synchronize counters	14 years ago
Anoop Saldanha	f7b1972263	update broken stats.log. Use pktacqloop funcs in pcap-file, pfring, pcap-live, af-pkt to sync counters - bug #343	14 years ago
Eric Leblond	45d5c3ca59	runmode: introduce configuration dereferencing. ... A devide configuration can be used by multiple threads. It is thus necessary to wait that all threads stop using the configuration before freeing it. This patch introduces an atomic counter and a free function which has to be called by each thread when it will not use anymore the structure. If the configuration is not used anymore, it is freed by the free function.	14 years ago
Eric Leblond	d3d99ffa13	Fix coding style and use SC* function. ... This patch fixes the coding style and uses Suricata function instead of plain lic version.	14 years ago
Eric Leblond	a64dcfeba2	pfring: use factorisation function ... This patch convert pfring to pktacqloop and use the new factorisation function. This also fixes commmand line parsing of pfring which is now able to work like af-packet: - 'suricata -c s.yaml --pfring' start suricata with all interfaces in conf - 'suricata -c s.yaml --pfring=eth2' start suricata on eth2	14 years ago
Anoop Saldanha	3f1c4efceb	Add new flags var to tm module. TMs can now set flags to identify special properties. Also use these to identify receive TMs	14 years ago
Eric Leblond	de1d002ea6	Return OK when leaving cleanly.	14 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	14 years ago
William	b3f7e6a2fc	Only set PF_RING cluster if we have more than one receive thread. Gives us accurate drop stats.	14 years ago