zeek
zeek copied to clipboard
Add filtered field for packet source stats
Right now there isn't a field for packets that were filtered from packet sources and all of the packet sources seem to not know what to do with the number of filtered packets so most just don't report them anywhere. I think we could have filtered bytes as a metric for some packet sources as well so we might want to add that as well.
I can add the field to the stats block but it's going to require the packet sources to fill it in. I'm not sure we should leave it as a zero if the packet source doesn't support it though, as that could be misleading. For example, while you can set a filter on a pcap source, you can't get the number of packets filtered back from libpcap.
Could make it optional. But maybe this would be better reported through the new metrics API now, depending where we're going with existing stats in general.