Ignore tunnel/defrag packets in log-pcap module.

15 years ago · 0814e41e50
parent 7ef00aaf19
commit 0814e41e50
1 changed files with 3 additions and 1 deletions
--- a/src/log-pcap.c
+++ b/src/log-pcap.c
@ -158,7 +158,9 @@ TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQu
        return TM_ECODE_FAILED;
    }

-    if (p->flags & PKT_PSEUDO_STREAM_END || p->flags & PKT_STREAM_NOPCAPLOG) {
+    if (p->flags & PKT_PSEUDO_STREAM_END || p->flags & PKT_STREAM_NOPCAPLOG ||
+            (IS_TUNNEL_PKT(p) && !IS_TUNNEL_ROOT_PKT(p)))
+    {
        return TM_ECODE_OK;
    }