mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
565e138754
Reading a pcap from /dev/stdin or a named pipe currently fails with "failed to get first packet timestamp. pcap_next_ex(): -1" because InitPcapFile calls setvbuf on the FILE* underlying the pcap handle after libpcap has already consumed the pcap header. On a non-seekable fd glibc cannot recover from that and the next read returns -1. Detect non-regular files via fstat and skip setvbuf in that case so the read keeps working on pipes, fifos and stdin. Accept pcap-file.buffer-size values of 0, which disables setvbuf buffering as an explicit opt-out, or PCAP_FILE_BUFFER_SIZE_MIN (4 KiB) to PCAP_FILE_BUFFER_SIZE_MAX (64 MiB). Treat any non-zero setvbuf return value as an error, not just negative values. When pcap-file.buffer-size fails to parse, retain the default buffer size instead of falling through and setting it to 0. The branches are now mutually exclusive so only one of the parse-error, accepted, or out-of-range messages is logged. Update the user guide: --pcap-file-buffer-size now documents valid values of 0 (disables setvbuf buffering) or 4 KiB to 64 MiB, and pcap-file.rst notes that 0 is the opt-out for non-seekable sources such as stdin and named pipes. Bug: #8464. |
4 weeks ago | |
|---|---|---|
| .. | ||
| af-packet.rst | 7 months ago | |
| af-xdp.rst | 4 years ago | |
| dpdk.rst | 11 months ago | |
| ebpf-xdp.rst | 1 month ago | |
| endace-dag.rst | 6 years ago | |
| index.rst | 7 months ago | |
| myricom.rst | 6 years ago | |
| napatech.rst | 3 years ago | |
| netmap.rst | 3 years ago | |
| pcap-file.rst | 4 weeks ago | |