Changeset 962aad3

Timestamp:

03/25/10 16:01:33 (12 years ago)

Author:

Shane Alcock <salcock@…>

Branches:

4.0.1-hotfixes, cachetimestamps, develop, dpdk-ndag, etsilive, getfragoff, help, libtrace4, master, ndag_format, pfring, rc-4.0.1, rc-4.0.2, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance, ringtimestampfixes

Children:

74c5dd9

Parents:

b96e2e0

Message:

• Fixed bug where the capture length could exceed the wire length if we write full payload PCAP traces. Apparently Snort doesn't like this and will discard every packet :(

File:

• lib/format_pcapfile.c (modified) (3 diffs)

lib/format_pcapfile.c

@@ -438 +438 @@
                 if (trace_get_wire_length(packet) >= 4) {
                         hdr.wirelen = trace_get_wire_length(packet)-4;
+
                 }
                 else {
@@ -448 +449 @@
         assert(hdr.wirelen < LIBTRACE_PACKET_BUFSIZE);
 
+        /* Ensure we have a valid capture length, especially if we're going
+         * to "remove" the FCS from the wire length */
+        if (hdr.caplen > hdr.wirelen)
+                hdr.caplen = hdr.wirelen;
 
         /* Write the packet header */
@@ -459 +464 @@
         ret=wandio_wwrite(DATAOUT(out)->file,
                         ptr,
-                        remaining);
-
-        if (ret!=(int)remaining)
+                        hdr.caplen);
+
+        if (ret!=(int)hdr.caplen)
                 return -1;