Actions
Bug #5502
openSuricata hangs and then exits when the first PCAP processed has 0 packets
Affected Versions:
Effort:
Difficulty:
Label:
Description
When I start Suricata and process a PCAP file with 0 packets, the process hangs and quits:
*start suricata*
> suricatasc -c "pcap-file /tmp/packets_no.pcap /tmp/"
< {"message": "Successfully added file to list", "return": "OK"}
> suricatasc -c pcap-file-list
*no response, process is stuck for 1 minute and then quits with error*
18/8/2022 -- 14:52:35 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
18/8/2022 -- 14:53:01 - <Notice> - all 0 packet processing threads, 0 management threads initialized, engine started.
18/8/2022 -- 14:53:38 - <Warning> - [ERRCODE: SC_ERR_PCAP_DISPATCH(20)] - Failed to init pcap file /tmp/packets_no.pcap, skipping
18/8/2022 -- 14:53:38 - <Error> - [ERRCODE: SC_ERR_PCAP_OPEN_OFFLINE(26)] - failed to get first packet timestamp. pcap_next_ex(): -2
18/8/2022 -- 14:53:39 - <Notice> - all 25 packet processing threads, 2 management threads initialized, engine started.
18/8/2022 -- 14:53:39 - <Error> - [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - pcap file reader thread failed to initialize
18/8/2022 -- 14:54:40 - <Error> - [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all flow manager threads to shutdown in time
If I start Suricata and process some normal PCAP file first, and later send a PCAP file with 0 packets, it is handled fine and creates an empty report file.
*start suricata*
> suricatasc -c "pcap-file /tmp/packets_yes.pcap /tmp/a/"
< {"message": "Successfully added file to list", "return": "OK"}
> suricatasc -c "pcap-file /tmp/packets_no.pcap /tmp/b/"
< {"message": "Successfully added file to list", "return": "OK"}
> suricatasc -c "pcap-file-list"
< {"message": {"count": 0, "files": []}, "return": "OK"}
* eve.json was written for each PCAP file and suricata process is fine *
Expected behavior:
Scanning a 0-packet PCAP file produces an empty report with no errors.
Actual behavior:
Scanning a 0-packet PCAP file as the first file to a new Suricata process hangs and then quits with error.
Files
Actions