mtu: track max mtu for capture devices

src/decode.h

@@ -594,7 +594,11 @@ typedef struct Packet_
 #endif
 Packet;
 
-#define DEFAULT_PACKET_SIZE (1500 + ETHERNET_HEADER_LEN)
+/** highest mtu of the interfaces we monitor */
+extern int g_default_mtu;
+#define DEFAULT_MTU 1500
+
+#define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN)
 /* storage: maximum ip packet size + link header */
 #define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28)
 uint32_t default_packet_size;

src/suricata.c

@@ -213,6 +213,9 @@ int g_detect_disabled = 0;
 /** set caps or not */
 int sc_set_caps = FALSE;
 
+/** highest mtu of the interfaces we monitor */
+int g_default_mtu = 0;
+
 int EngineModeIsIPS(void)
 {
     return (g_engine_mode == ENGINE_MODE_IPS);
@@ -2360,6 +2363,8 @@ static int ConfigGetCaptureValue(SCInstance *suri)
                             dev[len-1] = '\0';
                         }
                     }
+                    int mtu = GetIfaceMTU(dev);
+                    g_default_mtu = MAX(mtu, g_default_mtu);
 
                     unsigned int iface_max_packet_size = GetIfaceMaxPacketSize(dev);
                     if (iface_max_packet_size > default_packet_size)
@@ -2369,6 +2374,7 @@ static int ConfigGetCaptureValue(SCInstance *suri)
                     break;
                 /* fall through */
             default:
+                g_default_mtu = DEFAULT_MTU;
                 default_packet_size = DEFAULT_PACKET_SIZE;
         }
     } else {