sostat: group packet loss stats into one section

[dougburks]

NIC
PF_RING
Snort or Suricata
Bro

also include a note that Bro capture_loss may indicate upstream packet loss as well

[weslambert]

Doug,

Is this intended to just re-arrange the sostat output into a single packet loss section, or to modify/simplify it as well (separating certain parts from the other output)? I'm assuming you would want to make it as simple as possible for the end user to diagnose problems and to troubleshoot.

For example, in regard to:

NIC --> only showing the interface, RX, TX Packets, and dropped packets for an interface
PF_RING --> only showing the application and packet loss for pf_ring (instead of the additional info)
Snort/Suricata --> Dropped packets/percentage
Bro --> capture loss, note

Finally, would netsniff-ng be included in this as well?

Thanks,
Wes

[dougburks]

Hi Wes,

Replies inline.

Is this intended to just re-arrange the sostat output into a single packet loss section, or to modify/simplify it as well (separating certain parts from the other output)? I'm assuming you would want to make it as simple as possible for the end user to diagnose problems and to troubleshoot.

For example, in regard to:

NIC --> only showing the interface, RX, TX Packets, and dropped packets for an interface
PF_RING --> only showing the application and packet loss for pf_ring (instead of the additional info)
Snort/Suricata --> Dropped packets/percentage
Bro --> capture loss, note

Yes, sounds good.

Finally, would netsniff-ng be included in this as well?

Yes, please.

Thanks!

[weslambert]

Security-Onion-Solutions/securityonion-sostat#4

[dougburks]

submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/T966mq5ePD8/discussion

[dougburks]

published:
http://blog.securityonion.net/2016/07/securityonion-sostat-20120722.html