diff --git a/include/Flow.h b/include/Flow.h index 872a6cf22e..d6afd7b824 100644 --- a/include/Flow.h +++ b/include/Flow.h @@ -83,6 +83,7 @@ class Flow : public GenericHashEntry { quota_exceeded, cli_quota_app_proto, cli_quota_is_category, srv_quota_app_proto, srv_quota_is_category; u_int16_t diff_num_http_requests; #ifdef NTOPNG_PRO + bool counted_in_aggregated_flow; bool ingress2egress_direction; u_int8_t routing_table_id; #ifndef HAVE_NEDGE @@ -299,6 +300,10 @@ class Flow : public GenericHashEntry { void processDetectedProtocol(); void setDetectedProtocol(ndpi_protocol proto_id, bool forceDetection); void setJSONInfo(const char *json); +#ifdef NTOPNG_PRO + inline bool is_counted_in_aggregated_flow() { return(counted_in_aggregated_flow); }; + inline void set_counted_in_aggregated_flow(bool val) { counted_in_aggregated_flow = val; }; +#endif bool isFlowPeer(char *numIP, u_int16_t vlanId); void incStats(bool cli2srv_direction, u_int pkt_len, u_int8_t *payload, u_int payload_len, u_int8_t l4_proto, diff --git a/src/Flow.cpp b/src/Flow.cpp index 37cac69912..809c2bac37 100644 --- a/src/Flow.cpp +++ b/src/Flow.cpp @@ -86,6 +86,8 @@ Flow::Flow(NetworkInterface *_iface, if(cli_host) routing_table_id = hp->getRoutingPolicy(cli_host->get_host_pool()); if(srv_host) routing_table_id = max_val(routing_table_id, hp->getRoutingPolicy(srv_host->get_host_pool())); } + + counted_in_aggregated_flow = false; #endif passVerdict = true, quota_exceeded = false; diff --git a/src/NetworkInterface.cpp b/src/NetworkInterface.cpp index 696fda13b8..d36e04c0de 100644 --- a/src/NetworkInterface.cpp +++ b/src/NetworkInterface.cpp @@ -414,7 +414,15 @@ void NetworkInterface::aggregatePartialFlow(Flow *flow) { } if(aggregatedFlow) { - aggregatedFlow->sumFlowStats(flow); + aggregatedFlow->sumFlowStats(flow, + /* nextFlowAggregation will be decremented by one after the current periodic + flows walk (this method is called in the periodic flows walk) + + Therefore, we can check nextFlowAggregation minus one to determine whether + a cleanup of the aggregated flows hash table is going to be performed + after this walk on the (normal, non-aggregated) flows table. + */ + ((getIfType() == interface_type_DUMMY) || (nextFlowAggregation - 1 == 0))); #ifdef AGGREGATED_FLOW_DEBUG char buf[256];