Could someone explain the the dropped and link columns in the broctl netstats output?
Ex
recvd=12409185 dropped=33782 link=12409185
I’m trying to figure out what is causing the drops.
Thanks.
Hi,
Could someone explain the the dropped and link columns in the broctl
netstats output?Ex
recvd=12409185 dropped=33782 link=12409185
The information comes out of the get_net_stats.bif. Documentation is at
https://www.bro.org/sphinx/scripts/base/bif/stats.bif.bro.html#id-get_net_stats.
According to this, the numbers mean: "the number of packets (i) received
by Bro, (ii) dropped, and (iii) seen on the link (not always available)."
For the standard pcap input method, received is incremented each time that
Bro handles a packet. Dropped and link come out of pcap_stats
(pcap_stats(3PCAP) man page | TCPDUMP & LIBPCAP) and are set to
ps_recv (link) and ps_drop (dropped). ps_ifdrop does not seem to be
available.
I hope that helps,
Johanna