Field |
Meaning |
num_pkts |
The number of packets sent by the endpoint, as seen by
the monitor. The endpoint may have sent others
that the network dropped upstream from the monitor. |
num_rxmit |
The number of packets retransmitted by the endpoint,
as seen by the monitor. |
num_rxmit_bytes |
The number of bytes retransmitted by the endpoint. |
num_in_order |
The number of packets sent by the endpoint that
arrived at the monitor in order, where
``in order'' means in the same order
as sent by the endpoint, rather than
in sequence number. (Thus, a retransmission
can arrive in order, by this definition.)
Bro determines if the packet arrived in
order by applying heuristics to the IP
identification (ID) field, which in general
will increase by a small amount between
successive packets transmitted by an
endpoint. |
num_OO |
The number of packets sent by the endpoint that arrived
at the monitor out of order. See the previous
entry for the definition of ``in order'',
and hence ``out of order.'' |
num_repl |
The number of extra copies of packets
sent by the endpoint that arrived at
the monitor. Bro considers a packet
replicated if its IP ID field is the same
as for the previous packet it saw from
the endpoint. Using this definition,
a replication is most likely caused by
a network mechanism such as duplication of
a packet by a router, rather than a transport
mechanism such as retransmission, though
some TCPs fully reuse packets when
retransmitting them, including their
IP ID field. |
endian_type |
Whether the advance of the IP ID field
as seen by the monitor was consistent with
big-endian (network order) addition,
little-endian, or undetermined. The
three values are represented by the
Bro constants ENDIAN_BIG,
ENDIAN_LITTLE, and
ENDIAN_UNKNOWN. In addition,
the value can be ENDIAN_CONFUSED,
meaning that the monitor saw conflicting
evidence for little- and big-endian. |
|