Project

General

Profile

Actions

Bug #310

closed

Fix thread exit stats for pcap (unsigned int overflow)

Added by Mike Pomraning over 11 years ago. Updated over 11 years ago.

Status:
Closed
Priority:
Low
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

The attached patch corrects source-pcap.c:ReceivePcapThreadExitStats() report of percent packet loss. This small fix may have already reached you via Will Metcalf.

The percentage computation is effectively: (float)dropped / (float)(dropped + received)

However, the dropped + received addition can overflow -- they are each @u_int@s, which are 32-bit unsigned ints on my system.

How to reproduce: blast a few more than 4294967295 packets total at a pcap-listening suricata, and watch the % dropped computation. If you've dropped enough, you might see packet loss > 100%.


Files

Actions #1

Updated by Will Metcalf over 11 years ago

  • Status changed from New to Resolved
  • % Done changed from 0 to 100

#314 supersedes this, Mike's fix is incorporated there as well.

Actions #2

Updated by Victor Julien over 11 years ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF