zeek icon indicating copy to clipboard operation
zeek copied to clipboard

Add filtered field for packet source stats

Open sethhall opened this issue 4 years ago • 2 comments

Right now there isn't a field for packets that were filtered from packet sources and all of the packet sources seem to not know what to do with the number of filtered packets so most just don't report them anywhere. I think we could have filtered bytes as a metric for some packet sources as well so we might want to add that as well.

sethhall avatar Nov 10 '20 20:11 sethhall

I can add the field to the stats block but it's going to require the packet sources to fill it in. I'm not sure we should leave it as a zero if the packet source doesn't support it though, as that could be misleading. For example, while you can set a filter on a pcap source, you can't get the number of packets filtered back from libpcap.

timwoj avatar Jul 18 '22 20:07 timwoj

Could make it optional. But maybe this would be better reported through the new metrics API now, depending where we're going with existing stats in general.

rsmmr avatar Jul 19 '22 07:07 rsmmr