From 49514082b4232065dcdc6ff99486a741f6909f98 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Fri, 30 Jun 2017 15:00:40 +0200 Subject: [PATCH] af-packet: optimize BPF This patch turn on code optimization on BPF filter building by libpcap. This allow to reduce the size of the BPF bytecode and thus increase the size of BPF filter supported by Suricata. Reported-by: Martijn van Oosterhout --- src/source-af-packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/source-af-packet.c b/src/source-af-packet.c index 2f31916208..ce46d8af7f 100644 --- a/src/source-af-packet.c +++ b/src/source-af-packet.c @@ -2085,7 +2085,7 @@ TmEcode AFPSetBPFFilter(AFPThreadVars *ptv) ptv->datalink, /* linktype_arg */ &filter, /* program */ ptv->bpf_filter, /* const char *buf */ - 0, /* optimize */ + 1, /* optimize */ 0 /* mask */ ) == -1) { SCLogError(SC_ERR_AFP_CREATE, "Filter compilation failed.");