sfthd.h File Reference

#include "sflsq.h"
#include "sfghash.h"
#include "sfxhash.h"

Go to the source code of this file.

Defines
#define	THD_MAX_GENID   8129
#define	THD_GEN_ID_1_ROWS   4096
#define	THD_GEN_ID_ROWS   512
#define	THD_TOO_MANY_THDOBJ   -15
#define	THD_PRIORITY_SUPPRESS   1000000
Enumerations
enum	{ THD_TYPE_LIMIT, THD_TYPE_THRESHOLD, THD_TYPE_BOTH, THD_TYPE_SUPPRESS }
enum	{ THD_TRK_SRC, THD_TRK_DST }
Functions
THD_STRUCT *	sfthd_new (unsigned nbytes)
int	sfthd_create_threshold (THD_STRUCT *thd, unsigned gen_id, unsigned sig_id, int tracking, int type, int priority, int count, int seconds, unsigned ip_address, unsigned ip_mask, unsigned not_flag)
int	sfthd_test_threshold (THD_STRUCT *thd, unsigned gen_id, unsigned sig_id, unsigned sip, unsigned dip, long curtime)
int	sfthd_show_objects (THD_STRUCT *thd)

---

Detailed Description

Definition in file sfthd.h.

---

Define Documentation

#define THD_GEN_ID_1_ROWS   4096

Definition at line 18 of file sfthd.h. Referenced by sfthd_create_threshold_local().

#define THD_GEN_ID_ROWS   512

Definition at line 19 of file sfthd.h. Referenced by sfthd_create_threshold_local().

#define THD_MAX_GENID   8129

Max GEN_ID value - Set this to the Max Used by Snort, this is used for the dimensions of the gen_id lookup array. Rows in each hash table, by gen_id. Definition at line 17 of file sfthd.h. Referenced by print_thd_local(), print_thresholding(), sfthd_create_threshold_global(), sfthd_create_threshold_local(), sfthd_show_objects(), and sfthd_test_threshold().

#define THD_PRIORITY_SUPPRESS   1000000

Definition at line 38 of file sfthd.h. Referenced by ParseSFSuppress(), and sfthd_create_threshold_local().

#define THD_TOO_MANY_THDOBJ   -15

Definition at line 21 of file sfthd.h. Referenced by ParseRuleOptions(), and sfthd_create_threshold_local().

---

Enumeration Type Documentation

anonymous enum

Type of Thresholding Enumeration values: THD_TYPE_LIMIT  THD_TYPE_THRESHOLD  THD_TYPE_BOTH  THD_TYPE_SUPPRESS  Definition at line 26 of file sfthd.h.

anonymous enum

Tracking by src, or by dst Enumeration values: THD_TRK_SRC  THD_TRK_DST  Definition at line 43 of file sfthd.h.

---

Function Documentation

int sfthd_create_threshold (  THD_STRUCT *  thd, unsigned  gen_id, unsigned  sig_id, int  tracking, int  type, int  priority, int  count, int  seconds, unsigned  ip_address, unsigned  ip_mask, unsigned  not_flag )

Add a permanent threshold object to the threshold table. Multiple objects may be defined for each gen_id and sig_id pair. Internally a unique threshold id is generated for each pair. Threshold objects track the number of events seen during the time interval specified by seconds. Depending on the type of threshold object and the count value, the thresholding object determines if the current event should be logged or dropped. Parameters: thd  Threshold object from sfthd_new() gen_id  Generator id sig_id  Signauture id tracking  Selects tracking by src ip or by dst ip type  Thresholding type: Limit, Threshold, or Limt+Threshold, Suppress priority  Assigns a relative priority to this object, higher numbers imply higher priority count  Number of events seconds  Time duration over which this threshold object acts. ip  IP address, for supression ip-mask  IP mask, applied with ip_mask, for supression Returns: integer Return values: 0  successfully added the thresholding object !0  failed --- Local and Global Thresholding is setup here --- Definition at line 443 of file sfthd.c. References sfthd_create_threshold_global(), and sfthd_create_threshold_local(). Referenced by sfthreshold_create().

THD_STRUCT* sfthd_new (  unsigned  nbytes  )

Create a threshold table, initialize the threshold system, and optionally limit it's memory usage. Parameters: nbytes  maximum memory to use for thresholding objects, in bytes. Returns: THD_STRUCT* Return values: 0  error !0  valid THD_STRUCT Definition at line 48 of file sfthd.c. References THD_STRUCT::ip_gnodes, THD_STRUCT::ip_nodes, and sfxhash_new(). Referenced by sfthreshold_init().

int sfthd_show_objects (  THD_STRUCT *  thd  )

A function to print the thresholding objects to stdout. Definition at line 1081 of file sfthd.c. References THD_NODE::count, _sfghash_node::data, THD_NODE::ip_address, THD_NODE::ip_mask, THD_NODE::priority, THD_NODE::seconds, sfghash_findfirst(), sfghash_findnext(), sflist_first(), sflist_next(), THD_STRUCT::sfthd_array, THD_ITEM::sfthd_node_list, THD_ITEM::sig_id, THD_NODE::thd_id, THD_MAX_GENID, THD_TYPE_BOTH, THD_TYPE_LIMIT, THD_TYPE_SUPPRESS, THD_TYPE_THRESHOLD, THD_NODE::tracking, and THD_NODE::type.

int sfthd_test_threshold (  THD_STRUCT *  thd, unsigned  gen_id, unsigned  sig_id, unsigned  sip, unsigned  dip, long  curtime )

Test a an event against the threshold database. Events without thresholding objects are automatically loggable. Parameters: thd  Threshold table pointer gen_id  Generator Id from the event sig_id  Signature Id from the event sip  Event/Packet Src IP address dip  Event/Packet Dst IP address curtime  Current Event/Packet time Returns: integer Return values: 0  : Event is loggable !0  : Event should not be logged Definition at line 923 of file sfthd.c. References THD_ITEM::gen_id, sfghash_find(), sflist_first(), sflist_next(), THD_STRUCT::sfthd_array, THD_STRUCT::sfthd_garray, THD_ITEM::sfthd_node_list, sfthd_test_gobject(), sfthd_test_object(), THD_ITEM::sig_id, THD_NODE::thd_id, THD_MAX_GENID, and THD_NODE::type. Referenced by sfthreshold_test().

---