TABLE OF CONTENTS Can you determine when your network segments are experiencing drops in connectivity? Can you determine trends in traffic utilization? Using the Perfmonitor preprocessor on your Snort sensors, you can determine this as well as an entire laundry list of information about your sensors as seen in Table 2.3.
| Field Name | Description |
|---|---|
| Unixtime | Used for duration and runtime calculations |
| %pkts dropped | Percentage of packets the snort process has dropped |
| Alerts/second | Number of IDS events per second |
| K-packets/second | |
| Avg-bytes/packet | Average amount of data in each packet |
| Syns/second | Number of TCP SYN flagged packets per second |
| Synacks/second | Number of TCP SYN/ACK flagged packets per second |
| New-sessions/second | STREAM4 number of new TCP sessions per second |
| Deleted-sessions/second | STREAM4 number of closed TCP sessions per second |
| Total-sessions | STREAM4 total number of TCP sessions |
| opened | |
| Max-sessions | STREAM4 the highest number of total TCP sessions |
| Streamflushes/second | STREAM4 the number of connections passed through the preprocessor per second |
| Streamfaults/second | STREAM4 the number of failed TCP sessions per second |
| Fragcompletes/second | FRAG2 number of fragmented packets that were reassembled per second |
| Fraginserts/second | FRAG2 number of fragmented packets that were inserted into partial packets per second |
| Fragdeletes/second | FRAG2 number of fragmented packets that were deleted from the packet assembler of FRAG2 per second |
