From 3fe8ac21d023f0020d059996ec2522814f7605c5 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Tue, 15 Sep 2026 09:58:09 +0200 Subject: [PATCH] pcap-file: advance the directory watermark for all files In continuous pcap-file directory mode, a file that makes InitPcapFile() fail (malformed content, not a pcap, unsupported link type, truncated header) was skipped without folding its mtime into last_time_seen. This caused the file(s) to be reinspected on every follow-up poll until a newer valid file was processed. Ticket: 9129 --- src/source-pcap-file-directory-helper.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/source-pcap-file-directory-helper.c b/src/source-pcap-file-directory-helper.c index 5a50462826..fc762fcd9f 100644 --- a/src/source-pcap-file-directory-helper.c +++ b/src/source-pcap-file-directory-helper.c @@ -431,6 +431,9 @@ TmEcode PcapDirectoryDispatchForTimeRange(PcapFileDirectoryVars *pv, if (InitPcapFile(pftv) == TM_ECODE_FAILED) { SCLogWarning("Failed to init pcap file %s, skipping", current_file->filename); + if (CompareTimes(¤t_file->modified_time, &last_time_seen) > 0) { + CopyTime(¤t_file->modified_time, &last_time_seen); + } CleanupPendingFile(current_file); CleanupPcapFileFileVars(pftv); status = TM_ECODE_OK;