gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

poc3

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-16 11:46:35 +02:00
parent e8e5515e24
commit e5d344622e
22 changed files with 3511 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/flow_tracker.py
+23 -8
View File
@@ -68,7 +68,12 @@ class FlowTracker:
"bytes_total": 0, "bytes_in": 0, "bytes_out": 0,
"bytes_internal": 0, "bytes_external": 0,
"packets_total": 0, "packets_in": 0, "packets_out": 0,
"packets_internal": 0, "packets_external": 0,
}
# Monotonic counters are kept separately from the one-second sampling
# bucket above. Prometheus can safely apply rate()/increase() to these
# even when its scrape interval differs from the UI sampling interval.
self._traffic_counters = dict.fromkeys(self._rate_counters, 0)
def observe(self, frame: bytes) -> None:
parsed = _parse_frame(frame)
@@ -138,23 +143,33 @@ class FlowTracker:
"parse_errors": self._parse_errors,
"throughput_samples": self._throughput_samples,
"update_interval_seconds": self.update_interval,
"traffic_counters": dict(self._traffic_counters),
}
def _record_throughput(self, src_ip: str, dest_ip: str, frame_bytes: int, now: float) -> None:
direction = self.normalizer._direction(src_ip, dest_ip)
counters = self._rate_counters
counters["bytes_total"] += frame_bytes
counters["packets_total"] += 1
totals = self._traffic_counters
for target in (counters, totals):
target["bytes_total"] += frame_bytes
target["packets_total"] += 1
if direction == "inbound":
counters["bytes_in"] += frame_bytes
counters["packets_in"] += 1
for target in (counters, totals):
target["bytes_in"] += frame_bytes
target["packets_in"] += 1
elif direction == "outbound":
counters["bytes_out"] += frame_bytes
counters["packets_out"] += 1
for target in (counters, totals):
target["bytes_out"] += frame_bytes
target["packets_out"] += 1
elif direction == "internal":
counters["bytes_internal"] += frame_bytes
for target in (counters, totals):
target["bytes_internal"] += frame_bytes
target["packets_internal"] += 1
else:
counters["bytes_external"] += frame_bytes
for target in (counters, totals):
target["bytes_external"] += frame_bytes
target["packets_external"] += 1
elapsed = now - self._rate_started
if elapsed < 1.0: