mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
0aea826776
In order to track flow rate and thus determine a course of action or categorize it as elephant flow, track a flow's byte count per direction in a ring buffer for a given time interval. The implementation is simple and keeps overwriting the buffer and updating the final sum. The sum of all the elements in the ring buffer at any point in time should reflect the number of bytes for the respective flow in the last of a given configured interval. e.g. if the definition says that the flows must be tracked by a rate of 100k bytes in 10 seconds, the ring buffer at any point in time should carry the total number of bytes seen by the respective flow in the last 10 seconds. So far, the implementation only supports reading the flow rate definition from suricata.yaml and using it to track the flows. This solution adds up a space complexity to the existing Flow struct. However, the added space complexity should only take effect if the feature is in use. Since this buffer extends the Flow struct, it does not impact the usual business logic or complexity of the code. This implementation is currently limited to defining the time interval of flow rate in seconds only. However, the number of seconds defined are directly proportional to the aforementioned added space complexity as that's the size of the ring buffer. Feature 5647 |
2 years ago | |
|---|---|---|
| .. | ||
| Makefile.am | 2 years ago | |
| classification.config | 6 years ago | |
| reference.config | 2 years ago | |
| schema.json | 2 years ago | |
| suricata.logrotate.in | ||
| suricata.service.in | ||