From 67b95c8c4d387531c35dec18ddfcf14cd480a4e2 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Tue, 28 Dec 2010 09:02:24 +0100 Subject: [PATCH] Auto discovery of default packet size If default-packet-size is not set, it is possible in some case to guess a correct value. If PCAP or PF_RING are used we are linked to a "physical" interface. Thus, it is possible to get information about the link MTU and hardware header size. This give us the ability to auto discover a decent default-packet-size. If suricata is running under a different running-mode, it will default to 1514. --- src/suricata.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/src/suricata.c b/src/suricata.c index 8b26a71cd3..269b480596 100644 --- a/src/suricata.c +++ b/src/suricata.c @@ -45,6 +45,7 @@ #include "util-cpu.h" #include "util-action.h" #include "util-pidfile.h" +#include "util-ioctl.h" #include "detect-parse.h" #include "detect-engine.h" @@ -814,8 +815,18 @@ int main(int argc, char **argv) /* Pull the default packet size from the config, if not found fall * back on a sane default. */ - if (ConfGetInt("default-packet-size", &default_packet_size) != 1) - default_packet_size = DEFAULT_PACKET_SIZE; + if (ConfGetInt("default-packet-size", &default_packet_size) != 1) { + switch (run_mode) { + case MODE_PCAP_DEV: + case MODE_PFRING: + /* find payload for interface and use it */ + default_packet_size = GetIfaceMaxPayloadSize(pcap_dev); + if (default_packet_size) + break; + default: + default_packet_size = DEFAULT_PACKET_SIZE; + } + } SCLogDebug("Default packet size set to %"PRIiMAX, default_packet_size); /* Since our config is now loaded we can finish configurating the