Project

General

Profile

Actions
Copy link

Bug #4237

closed

Pcap file length is not correct calculated.

Added by shuo yao almost 4 years ago. Updated 5 months ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
5.0.0
Effort:
Difficulty:
Label:
C

Description

In log-pcap.c function PcapLog(ThreadVars *t, void *thread_data, const Packet *p)

Ihe size of pcap packet is calculated like this:

len = sizeof(*pl->h) + GET_PKT_LEN(p);

but sizeof(*pl->h) is 24 while the real length of a pcap packet header is 16.

It will cause the size of pcap file to become a little bigger than the real size. And the size of pcap header is not added to the total size of pcap file and also need to be fixed.

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #7037: pcap/log: MacOS rotates file well before limit is reachedClosedVictor JulienActions
Actions
Copy link
 #1

Updated by Philippe Antoine 5 months ago

  • Related to Bug #7037: pcap/log: MacOS rotates file well before limit is reached added
Actions
Copy link
 #2

Updated by Philippe Antoine 5 months ago

  • Status changed from New to Closed

Thanks for the report, it was found again and fixed in https://redmine.openinfosecfoundation.org/issues/7037

Actions
Copy link

Also available in: Atom PDF