Suricata

In log-pcap.c function PcapLog(ThreadVars *t, void *thread_data, const Packet *p)

Ihe size of pcap packet is calculated like this:

len = sizeof(*pl->h) + GET_PKT_LEN(p);

but sizeof(*pl->h) is 24 while the real length of a pcap packet header is 16.

It will cause the size of pcap file to become a little bigger than the real size. And the size of pcap header is not added to the total size of pcap file and also need to be fixed.