diff --git a/include/NetworkInterface.h b/include/NetworkInterface.h index 1d2d381777..28c71a9556 100644 --- a/include/NetworkInterface.h +++ b/include/NetworkInterface.h @@ -73,7 +73,7 @@ class NetworkInterface : public Checkpointable { u_int8_t alertLevel, purgeRuns; u_int32_t bridge_lan_interface_id, bridge_wan_interface_id; u_int32_t num_hashes; - + /* Disaggregations */ u_int16_t numVirtualInterfaces; set flowHashingIgnoredInterfaces; @@ -121,7 +121,7 @@ class NetworkInterface : public Checkpointable { u_int32_t last_remote_pps, last_remote_bps; u_int8_t packet_drops_alert_perc; TimeSeriesExporter *tsExporter; - + /* Sub-interface views */ u_int8_t numSubInterfaces; NetworkInterface *subInterfaces[MAX_NUM_VIEW_INTERFACES]; @@ -215,7 +215,7 @@ class NetworkInterface : public Checkpointable { Host *host, Paginator *p, const char *sortColumn); - + bool isNumber(const char *str); bool validInterface(char *name); bool isInterfaceUp(char *name); @@ -231,7 +231,7 @@ class NetworkInterface : public Checkpointable { void topItemsCommit(const struct timeval *when); void checkMacIPAssociation(bool triggerEvent, u_char *_mac, u_int32_t ipv4); - + public: /** * @brief A Constructor @@ -336,7 +336,8 @@ class NetworkInterface : public Checkpointable { virtual u_int64_t getCheckPointNumBytes(); virtual u_int32_t getCheckPointNumPacketDrops(); - inline void _incStats(bool ingressPacket, time_t when, u_int16_t eth_proto, u_int16_t ndpi_proto, + inline void _incStats(bool ingressPacket, time_t when, + u_int16_t eth_proto, u_int16_t ndpi_proto, u_int pkt_len, u_int num_pkts, u_int pkt_overhead) { ethStats.incStats(ingressPacket, eth_proto, num_pkts, pkt_len, pkt_overhead); ndpiStats.incStats(when, ndpi_proto, 0, 0, 1, pkt_len); @@ -346,7 +347,7 @@ class NetworkInterface : public Checkpointable { }; inline void incFlagsStats(u_int8_t flags) { pktStats.incFlagStats(flags); }; - inline void incStats(bool ingressPacket, time_t when, u_int16_t eth_proto, u_int16_t ndpi_proto, + inline void incStats(bool ingressPacket, time_t when, u_int16_t eth_proto, u_int16_t ndpi_proto, u_int pkt_len, u_int num_pkts, u_int pkt_overhead) { #ifdef HAVE_NEDGE /* In nedge, we only update the stats periodically with conntrack */ @@ -516,7 +517,7 @@ class NetworkInterface : public Checkpointable { PacketDumperTuntap *getPacketDumperTap(void) { return pkt_dumper_tap; } bool registerLiveCapture(struct ntopngLuaContext * const luactx); bool deregisterLiveCapture(struct ntopngLuaContext * const luactx); - + #ifdef NTOPNG_PRO void updateHostsL7Policy(u_int16_t host_pool_id); void updateFlowsL7Policy(); @@ -550,7 +551,7 @@ class NetworkInterface : public Checkpointable { inline void setBridgeLanInterfaceId(u_int32_t v) { bridge_lan_interface_id = v; }; inline u_int32_t getBridgeLanInterfaceId() { return(bridge_lan_interface_id); }; inline void setBridgeWanInterfaceId(u_int32_t v) { bridge_wan_interface_id = v; }; - inline u_int32_t getBridgeWanInterfaceId() { return(bridge_wan_interface_id); }; + inline u_int32_t getBridgeWanInterfaceId() { return(bridge_wan_interface_id); }; inline HostHash* get_hosts_hash() { return(hosts_hash); } inline MacHash* get_macs_hash() { return(macs_hash); } inline VlanHash* get_vlans_hash() { return(vlans_hash); } @@ -572,7 +573,7 @@ class NetworkInterface : public Checkpointable { inline FlowProfile* getFlowProfile(Flow *f) { return(flow_profiles ? flow_profiles->getFlowProfile(f) : NULL); } inline bool checkProfileSyntax(char *filter) { return(flow_profiles ? flow_profiles->checkProfileSyntax(filter) : false); } #endif - + bool passShaperPacket(TrafficShaper *a_shaper, TrafficShaper *b_shaper, struct pcap_pkthdr *h); void initL7Policer(); #endif @@ -642,9 +643,9 @@ class NetworkInterface : public Checkpointable { } inline bool mdnsQueueResolveIPv4(u_int32_t ipv4addr, bool alsoUseGatewayDNS) { - return(mdns ? mdns->queueResolveIPv4(ipv4addr, alsoUseGatewayDNS) : false); + return(mdns ? mdns->queueResolveIPv4(ipv4addr, alsoUseGatewayDNS) : false); } - + inline void mdnsFetchResolveResponses(lua_State* vm, int32_t timeout_sec = 2) { if(mdns) mdns->fetchResolveResponses(vm, timeout_sec); } diff --git a/src/Flow.cpp b/src/Flow.cpp index 073ee41eea..da8912b894 100644 --- a/src/Flow.cpp +++ b/src/Flow.cpp @@ -3377,6 +3377,7 @@ void Flow::fixAggregatedFlowFields() { } /* ***************************************************** */ + #if defined(NTOPNG_PRO) && defined(HAVE_NETFILTER) void Flow::setPacketsBytes(time_t now, u_int32_t s2d_pkts, u_int32_t d2s_pkts, u_int64_t s2d_bytes, u_int64_t d2s_bytes) { @@ -3384,8 +3385,6 @@ void Flow::setPacketsBytes(time_t now, u_int32_t s2d_pkts, u_int32_t d2s_pkts, u_int overhead = 0; bool nf_existing_flow; - updateSeen(); - /* netfilter (depending on configured timeouts) could expire a flow before than ntopng. This heuristics attempt to detect such events. @@ -3397,8 +3396,8 @@ void Flow::setPacketsBytes(time_t now, u_int32_t s2d_pkts, u_int32_t d2s_pkts, and the detection of event NFCT_T_DESTROY. */ nf_existing_flow = !(cli2srv_packets > s2d_pkts || cli2srv_bytes > s2d_bytes - || srv2cli_packets > d2s_pkts || srv2cli_bytes > d2s_bytes); - + || srv2cli_packets > d2s_pkts || srv2cli_bytes > d2s_bytes); + iface->_incStats(isIngress2EgressDirection(), now, eth_proto, ndpiDetectedProtocol.app_protocol, nf_existing_flow ? s2d_bytes - cli2srv_bytes : s2d_bytes, nf_existing_flow ? s2d_pkts - cli2srv_packets : s2d_pkts, @@ -3410,13 +3409,19 @@ void Flow::setPacketsBytes(time_t now, u_int32_t s2d_pkts, u_int32_t d2s_pkts, nf_existing_flow ? d2s_pkts - srv2cli_packets : d2s_pkts, overhead); - if(nf_existing_flow) + if(nf_existing_flow) { cli2srv_packets = s2d_pkts, cli2srv_bytes = s2d_bytes, srv2cli_packets = d2s_pkts, srv2cli_bytes = d2s_bytes; - else - cli2srv_packets += s2d_pkts, cli2srv_bytes += s2d_bytes, - srv2cli_packets += d2s_pkts, srv2cli_bytes += d2s_bytes; + updateSeen(); + } else { + if((s2d_pkts + d2s_pkts) > 0) { + cli2srv_packets += s2d_pkts, cli2srv_bytes += s2d_bytes, + srv2cli_packets += d2s_pkts, srv2cli_bytes += d2s_bytes; + updateSeen(); + } + /* Don't update seen if no traffic has been observed */ + } } #endif diff --git a/src/NetworkInterface.cpp b/src/NetworkInterface.cpp index b968bd0ee2..6997c0100f 100644 --- a/src/NetworkInterface.cpp +++ b/src/NetworkInterface.cpp @@ -1954,13 +1954,13 @@ void NetworkInterface::purgeIdle(time_t when) { last_pkt_rcvd = when; - if((n = purgeIdleFlows()) > 0) - ntop->getTrace()->traceEvent(TRACE_DEBUG, "Purged %u/%u idle flows on %s", - n, getNumFlows(), ifname); + n = purgeIdleFlows(); + ntop->getTrace()->traceEvent(TRACE_DEBUG, "Purged %u/%u idle flows on %s", + n, getNumFlows(), ifname); - if((m = purgeIdleHostsMacsASesVlans()) > 0) - ntop->getTrace()->traceEvent(TRACE_DEBUG, "Purged %u/%u idle hosts/macs on %s", - n, getNumHosts()+getNumMacs(), ifname); + m = purgeIdleHostsMacsASesVlans(); + ntop->getTrace()->traceEvent(TRACE_DEBUG, "Purged %u/%u idle hosts/macs on %s", + m, getNumHosts()+getNumMacs(), ifname); } if(pkt_dumper) pkt_dumper->idle(when);