master: The MTU closing IP calculation added

Author: Emir Özbir

main.go

@@ -76,9 +76,9 @@ func TcpStream(device string, filter string) {
 		tcp, ok := tcpLayer.(*layers.TCP)
 
 		ip, ok := ipLayer.(*layers.IPv4)
-
-		if ip.Flags.String() == "DF" {
-			dfMetric.WithLabelValues(ip.SrcIP.String(), ip.DstIP.String(), detectedDeviceName).Add(1.0)
+		if ip.Flags&layers.IPv4DontFragment != 0 {
+			pktSize := len(ip.Payload) + 20 // IP header
+			dfPacketSizeHistogram.WithLabelValues(detectedDeviceName).Observe(float64(pktSize))
 		}
 
 		for _, val := range tcp.Options {

prometheus.go

@@ -28,6 +28,12 @@ var (
 		Help: "TCP RST metrics that contains details and error type",
 	}, []string{"srcIp", "dstIp", "deviceName"})
 
+	dfPacketSizeHistogram = promauto.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "ip_df_packet_size_bytes",
+		Help:    "Size distribution of IP packets with DF flag set",
+		Buckets: []float64{576, 1280, 1400, 1420, 1450, 1472, 1480, 1500, 1505, 9000},
+	}, []string{"device"})
+
 	dfMetric = promauto.NewCounterVec(prometheus.CounterOpts{
 		Name: "ip_df_metric",
 		Help: "Ip layer do not fragment metric",