Skip to content

Protocol Statistics Plugin

Jump to bottom
Jacob van Walraven edited this page Feb 16, 2020 · 16 revisions

The protocol statistics plugin measures the number of bytes, packets and unique flows that are detected for each of the supported application level protocols. At periodic intervals, results are exported for each protocol with the following fields:

  • protocol - Protocol that applies to the result
  • in_packets - Number of incoming packets seen
  • out_packets - Number of outgoing packets seen
  • in_bytes - Number of incoming bytes seen
  • out_bytes - Number of outgoing bytes seen
  • count_esrc_ips - Number of unique external source IPs seen
  • count_edst_ips - Number of unique external destinations IPs seen
  • count_isrc_ips - Number of unique internal source IPs seen
  • count_idst_ips - Number of unique internal destination IPs seen
  • count_flows - Number of active flows
  • interval - The time period in seconds for capture

Refer to Libprotoident for a list of supported protocols.

Configuration example:

# protocol statistics module
  protocol_statistics:
    enabled: 0
    # how often to output results in seconds
    output_interval: 60
    metrics:
      - byte_count
      - packet_count
      - flow_count
      - ip_count

A sample grafana dashboard for this plugin is available here

Clone this wiki locally