Actions
Bug #310
closedFix thread exit stats for pcap (unsigned int overflow)
Status:
Closed
Priority:
Low
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:
Description
The attached patch corrects source-pcap.c:ReceivePcapThreadExitStats() report of percent packet loss. This small fix may have already reached you via Will Metcalf.
The percentage computation is effectively: (float)dropped / (float)(dropped + received)
However, the dropped + received addition can overflow -- they are each @u_int@s, which are 32-bit unsigned ints on my system.
How to reproduce: blast a few more than 4294967295 packets total at a pcap-listening suricata, and watch the % dropped computation. If you've dropped enough, you might see packet loss > 100%.
Files
Updated by Will Metcalf over 13 years ago
- Status changed from New to Resolved
- % Done changed from 0 to 100
#314 supersedes this, Mike's fix is incorporated there as well.
Updated by Victor Julien about 13 years ago
- Status changed from Resolved to Closed
Actions