server_stats.c File Reference

"policy" learning portion of portscan detector More...

#include "server_stats.h"
#include "flowps.h"
#include "sfxhash.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>

Go to the source code of this file.

Defines
#define	FAMILY_SIZE   1
#define	FAMILY_OFFSET   0
#define	IPV4_SIZE   4
#define	IPV4_OFFSET   (FAMILY_SIZE)
#define	PORT_SIZE   2
#define	PORT_OFFSET   (IPV4_OFFSET + IPV4_SIZE)
#define	IP_PROTO_SIZE   1
#define	IP_PROTO_OFFSET   (PORT_OFFSET + PORT_SIZE)
#define	COUNT_SIZE   4
#define	COUNT_OFFSET   (IP_PROTO_OFFSET + IP_PROTO_SIZE)
#define	STATSREC_SIZE   (FAMILY_SIZE + IPV4_SIZE + PORT_SIZE + IP_PROTO_SIZE + COUNT_SIZE)
#define	O_SYNC   O_FSYNC
Typedefs
typedef _SERVER_KEY	SERVER_KEY
Functions
static void	server_stats_init_entry (void)
void	server_stats_dump (SERVER_STATS *ssp)
void	server_stats (SERVER_STATS *ssp, int dumpall)
int	server_stats_init (SERVER_STATS *ssp, IPSET *watchnetv4, unsigned int rows, int memcap)
int	server_stats_destroy (SERVER_STATS *ssp)
int	server_stats_contains (SERVER_STATS *ssp, u_int32_t address)
u_int32_t	server_stats_hitcount_ipv4 (SERVER_STATS *ssp, u_int8_t ip_proto, u_int32_t address, u_int16_t port)
int	server_stats_add_ipv4 (SERVER_STATS *ssp, u_int8_t ip_proto, u_int32_t address, u_int16_t port, u_int32_t *retcount)
int	server_stats_remove_ipv4 (SERVER_STATS *ssp, u_int8_t ip_proto, u_int32_t address, u_int16_t port)
int	server_stats_save (SERVER_STATS *ssp, char *filename)
int	server_stats_load (SERVER_STATS *ssp, char *filename)
int	server_stats_memcap (SERVER_STATS *sbp)
int	server_stats_row_count (SERVER_STATS *sbp)
int	server_stats_overhead_bytes (SERVER_STATS *sbp)
Variables
static SERVER_KEY	s_key
static int	s_debug = 0

---

Detailed Description

"policy" learning portion of portscan detector

Author:

Chris Green <cmg@sourcefire.com>

Date:

Fri Jun 13 14:28:50 2003

This keeps a table of (dip+dport+dprotocol) -> count to help identify what is a normal looking portscan versus what is pretty far outta whack.

Definition in file server_stats.c.

---

Define Documentation

#define COUNT_OFFSET   (IP_PROTO_OFFSET + IP_PROTO_SIZE)

Definition at line 309 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define COUNT_SIZE   4

Definition at line 308 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define FAMILY_OFFSET   0

Definition at line 297 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define FAMILY_SIZE   1

Definition at line 296 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define IP_PROTO_OFFSET   (PORT_OFFSET + PORT_SIZE)

Definition at line 306 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define IP_PROTO_SIZE   1

Definition at line 305 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define IPV4_OFFSET   (FAMILY_SIZE)

Definition at line 300 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define IPV4_SIZE   4

Definition at line 299 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define O_SYNC   O_FSYNC

Referenced by server_stats_save().

#define PORT_OFFSET   (IPV4_OFFSET + IPV4_SIZE)

Definition at line 303 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define PORT_SIZE   2

Definition at line 302 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

#define STATSREC_SIZE   (FAMILY_SIZE + IPV4_SIZE + PORT_SIZE + IP_PROTO_SIZE + COUNT_SIZE)

Definition at line 311 of file server_stats.c. Referenced by server_stats_load(), and server_stats_save().

---

Typedef Documentation

typedef struct _SERVER_KEY SERVER_KEY

---

Function Documentation

void server_stats (  SERVER_STATS *  ssp, int  dumpall )

Definition at line 67 of file server_stats.c. References calc_percent(), flow_printf(), _SERVER_STATS::ipv4_table, server_stats_dump(), server_stats_memcap(), server_stats_overhead_bytes(), sfxhash_anr_count(), sfxhash_count(), sfxhash_find_fail(), sfxhash_find_success(), and sfxhash_find_total(). Referenced by flowps_stats().

int server_stats_add_ipv4 (  SERVER_STATS *  ssp, u_int8_t  ip_proto, u_int32_t  address, u_int16_t  port, u_int32_t *  retcount )

Definition at line 220 of file server_stats.c. References _SERVER_KEY::address, FLOW_BADJUJU, FLOW_ENULL, FLOW_SUCCESS, FLOWASSERT, ipset_contains(), IPV4_FAMILY, _SERVER_STATS::ipv4_table, _SERVER_STATS::ipv4_watch, NULL, _SERVER_KEY::port, _SERVER_KEY::protocol, SERVER_STATS_MAX_HITCOUNT, sfxhash_add(), SFXHASH_INTABLE, sfxhash_mru(), SFXHASH_NOMEM, and SFXHASH_OK. Referenced by flowps_get_score().

int server_stats_contains (  SERVER_STATS *  ssp, u_int32_t  address )

See if we are watching this particular IP Parameters: ssp  server stats pointer address  ipv4 address in NETWORK BYTE ORDER Returns: 1 if this SERVER_STATS is watching this network Definition at line 178 of file server_stats.c. References FLOW_DISABLED, FLOW_SUCCESS, ipset_contains(), IPV4_FAMILY, and _SERVER_STATS::ipv4_watch. Referenced by flowps_server_watch().

int server_stats_destroy (  SERVER_STATS *  ssp  )

Definition at line 157 of file server_stats.c. References FLOW_ENULL, FLOW_SUCCESS, ipset_free(), _SERVER_STATS::ipv4_table, _SERVER_STATS::ipv4_watch, and sfxhash_delete().

void server_stats_dump (  SERVER_STATS *  ssp  )

Print out the entirety of the server cache. Parameters: ssp  server stats pointer Definition at line 41 of file server_stats.c. References _SERVER_KEY::address, _sfxhash_node::data, flow_printf(), _SERVER_STATS::ipv4_table, _sfxhash_node::key, NULL, _SERVER_KEY::port, _SERVER_KEY::protocol, sfxhash_ghead(), and sfxhash_gnext(). Referenced by server_stats().

u_int32_t server_stats_hitcount_ipv4 (  SERVER_STATS *  ssp, u_int8_t  ip_proto, u_int32_t  address, u_int16_t  port )

Definition at line 194 of file server_stats.c. References _SERVER_KEY::address, FLOWASSERT, ipset_contains(), IPV4_FAMILY, _SERVER_STATS::ipv4_table, _SERVER_STATS::ipv4_watch, NULL, _SERVER_KEY::port, _SERVER_KEY::protocol, and sfxhash_find(). Referenced by flowps_get_score().

int server_stats_init (  SERVER_STATS *  ssp, IPSET *  watchnetv4, unsigned int  rows, int  memcap )

Initialize the server stats structure If we do not specify a watchnet, then we have no use for this structure Parameters: ssp  server stats structure to initialize watchnet  what network we're watching for information rows  how many rows the underlying table should use memcap  what our total memory limit is Returns: FLOW_SUCCESS on success Definition at line 115 of file server_stats.c. References FLOW_EINVALID, FLOW_ENOMEM, FLOW_ENULL, FLOW_SUCCESS, ipset_copy(), ipset_family(), IPV4_FAMILY, _SERVER_STATS::ipv4_table, _SERVER_STATS::ipv4_watch, memset, NULL, server_stats_init_entry(), sfxhash_delete(), and sfxhash_new(). Referenced by flowps_init().

static void server_stats_init_entry (  void   )  [static]

initialize the static s_init_key variable once and only once.This is used to zero out the key so that if the compiler pads the structure, we still have 0's in this keylookup. Definition at line 479 of file server_stats.c. References memset. Referenced by server_stats_init().

int server_stats_load (  SERVER_STATS *  ssp, char *  filename )

load a server stats file fmt: 1 char for the family hex network representation of the IP (8 chars) hex network representation of the port (2 chars) 1 char for the ip_proto (1 char) hex network representation of the hit count (4 chars) yes this record format is hard to use but it's easy to parse! :> Parameters: ssp  server stats pointer filename  filename to load Returns: FLOW_SUCCESS on sucess Definition at line 408 of file server_stats.c. References _SERVER_KEY::address, COUNT_OFFSET, COUNT_SIZE, FAMILY_OFFSET, FAMILY_SIZE, FLOW_BADJUJU, FLOW_EINVALID, FLOW_ENULL, FLOW_NOTFOUND, FLOW_SUCCESS, IP_PROTO_OFFSET, IP_PROTO_SIZE, IPV4_OFFSET, IPV4_SIZE, _SERVER_STATS::ipv4_table, memcpy, _SERVER_KEY::port, PORT_OFFSET, PORT_SIZE, _SERVER_KEY::protocol, sfxhash_add(), and STATSREC_SIZE.

int server_stats_memcap (  SERVER_STATS *  sbp  )

get the memcap Parameters: sbp  server_stats ptr to return the memcap of Returns: memcap or -1 Definition at line 498 of file server_stats.c. References _SERVER_STATS::ipv4_table, _sfxhash::mc, MEMCAP::memcap, and NULL. Referenced by FlowPSOutputConfig(), and server_stats().

int server_stats_overhead_bytes (  SERVER_STATS *  sbp  )

get the overhead # of bytes Parameters: sbp  server_stats ptr to return the memcap of Returns: nrows or -1 Definition at line 529 of file server_stats.c. References _SERVER_STATS::ipv4_table, NULL, and sfxhash_overhead_bytes(). Referenced by FlowPSOutputConfig(), and server_stats().

int server_stats_remove_ipv4 (  SERVER_STATS *  ssp, u_int8_t  ip_proto, u_int32_t  address, u_int16_t  port )

Definition at line 276 of file server_stats.c. References _SERVER_KEY::address, FLOW_ENULL, FLOW_SUCCESS, _SERVER_STATS::ipv4_table, _SERVER_KEY::port, _SERVER_KEY::protocol, and sfxhash_remove().

int server_stats_row_count (  SERVER_STATS *  sbp  )

get the node count Parameters: sbp  server_stats ptr to return the memcap of Returns: nrows or -1 Definition at line 513 of file server_stats.c. References _SERVER_STATS::ipv4_table, _sfxhash::nrows, and NULL. Referenced by FlowPSOutputConfig().

int server_stats_save (  SERVER_STATS *  ssp, char *  filename )

Definition at line 314 of file server_stats.c. References _SERVER_KEY::address, COUNT_OFFSET, COUNT_SIZE, _sfxhash_node::data, FAMILY_OFFSET, FAMILY_SIZE, FLOW_EINVALID, FLOW_ENULL, FLOW_NOTFOUND, flow_printf(), FLOW_SUCCESS, IP_PROTO_OFFSET, IP_PROTO_SIZE, IPV4_OFFSET, IPV4_SIZE, _SERVER_STATS::ipv4_table, _sfxhash_node::key, memcpy, NULL, O_SYNC, _SERVER_KEY::port, PORT_OFFSET, PORT_SIZE, _SERVER_KEY::protocol, s_debug, sfxhash_ghead(), sfxhash_gnext(), and STATSREC_SIZE.

---

Variable Documentation

int s_debug = 0 [static]

Definition at line 34 of file server_stats.c.

SERVER_KEY s_key [static]

Definition at line 33 of file server_stats.c.

---