|Assignee:||Eric Leblond||% Done:|
#3 Updated by Eric Leblond over 1 year ago
- % Done changed from 0 to 100
It is already working with at least pcap v1.3.0 (version since 2010 should work if we trust website).
It is enough to do:
bin/suricata -r ~eric/git/oisf/benches/sample-wlan0.pcapng
to have a correct parsing of sample-wlan0.pcapng which is a pcap-ng 1.0 file:
file ~eric/git/oisf/benches/sample-wlan0.pcapng /home/eric/git/oisf/benches/sample-wlan0.pcapng: pcap-ng capture file - version 1.0
#7 Updated by Eric Leblond over 1 year ago
It is not mentioned in any feature request (http://sourceforge.net/tracker/?group_id=53067&atid=469580). It is possible this is not planned at all as it will break some important part of the API. For example, pcap_datalink() which is used by suricata as a pcap handle argument. This is not good in pcap-ng where the datalink can depends on the packet (and need to be updated for each packets).
Currently, when running in pcap mode with a file with two different interfaces (on Ethernet and one tuntap iface), we've got this:
 10/9/2012 -- 17:50:19 - (source-pcap-file.c:188) <Error> (ReceivePcapFileLoop) -- [ERRCODE: SC_ERR_PCAP_DISPATCH(20)] - error code -1 an interface has a type 12 different from the type of the first interface
pcap detects the problem but do not support the feature.