From owner-freebsd-bugs@freebsd.org Mon Dec 14 16:38:00 2015 Return-Path: Delivered-To: freebsd-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 72889A47955 for ; Mon, 14 Dec 2015 16:38:00 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 63C301B79 for ; Mon, 14 Dec 2015 16:38:00 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id tBEGc06N090650 for ; Mon, 14 Dec 2015 16:38:00 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 205320] net: incorrect BPF stats Date: Mon, 14 Dec 2015 16:38:00 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 10.1-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: elofu17@hotmail.com X-Bugzilla-Status: New X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2015 16:38:00 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D205320 Bug ID: 205320 Summary: net: incorrect BPF stats Product: Base System Version: 10.1-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: elofu17@hotmail.com In e.g. 'netstat -B', the Recv column show the total amount of packets rece= ived by BPF. Quite often, this value is *less* than the Match value. This should be impossible! Example: I send 2000000 packets to ix1 while running tcpdump on it. After the 2000000 packets are sent, I run: # netstat -B =C2=A0=C2=A0Pid Netif Flags Recv Drop Match Sblen Hblen Command 25553 bridge0 p--s--- 1996862 0 2000000 0 0 tcpdump 1996862 is less than 2000000. I reported this to the freebsd-net maillist where Alexander V. Chernikov replied that "Recv" is read from d->bd_rcount, which is not a per-cpu count= er. Also it is incremented in an unlocked state. "Match" on the other hand increases when filter returned a match condition,= and use a (w)locked bpf descriptor, so this one is accurate. All sniffing tools that report some form of BPF statistics (snort, suricata, tcpdump, tshark, etc) give very confusing and inaccurate values. This need to be fixed. /Elof --=20 You are receiving this mail because: You are the assignee for the bug.=