stream/tcp: add tcp.async_stream stats counter - v2#15089
stream/tcp: add tcp.async_stream stats counter - v2#15089jufajardini wants to merge 1 commit intoOISF:mainfrom
tcp.async_stream stats counter - v2#15089Conversation
The counter is incremented when the engine detects an asynchronous TCP stream and stream.async-oneside: true. Same as with midstream pickups, we want more visibility into when the engine is applying this setting. Task OISF#8339
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #15089 +/- ##
==========================================
- Coverage 82.61% 82.58% -0.03%
==========================================
Files 990 990
Lines 271655 271661 +6
==========================================
- Hits 224415 224347 -68
- Misses 47240 47314 +74
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
WARNING:
Pipeline = 30478 |
| if (!stream_config.async_oneside) | ||
| return 0; | ||
|
|
||
| StatsCounterIncr(&tv->stats, stt->counter_tcp_async_stream); |
There was a problem hiding this comment.
Are you sure we count the flow only once ?
If I have an async flow with client only : I see first syn, then packet ack
It looks like we update in StreamTcpPacketStateNone before doing StreamTcpPacketSetState(p, ssn, TCP_SYN_SENT);, then a second time here for the same flow
There was a problem hiding this comment.
so, a flow with a single syn packet does not increase the counter, but has STREAMTCP_FLAG_ASYNC
Maybe DEBUG_VALIDATION to ensure we count the flow only once
3 participants
The counter is incremented when the engine detects an asynchronous TCP stream and stream.async-oneside: true.
Same as with midstream pickups, we want more visibility into when the engine is applying this setting.
Task #8339
Link to ticket: https://redmine.openinfosecfoundation.org/issues/
Previous PR: #14967
Describe changes:
ASYNCflag in a valid packet (we first want to make sure there's "harm" in flagging, and that this isn't something that would impact negatively the engine (since the engine removes the flag in a further step, if it interprets if the stream isn't async)async.onesidecounter when the engine sees traffic from the other directionProvide values to any of the below to override the defaults.
SV_BRANCH=OISF/suricata-verify#2955