Project

General

Profile

Actions
Copy link

Bug #5880

open

pcap recursive mode not working as expected

Added by Andreas Herz over 2 years ago. Updated 19 days ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
6.0.10, 7.0.0-rc1, 8.0.0
Effort:
Difficulty:
Label:
Needs Suricata-Verify test

Description

As reported by this user in the forum https://forum.suricata.io/t/suricata-recursive-traversal-into-sub-directories-in-pcap-offline-mode-dont-work/3273 the recursive pcap mode is not working as expected. I was able to confirm with 6.0.10 and 7.0.0-rc1 as well.

Actions
Copy link
 #1

Updated by Andreas Herz over 2 years ago

  • Label Needs Suricata-Verify test, Needs backport added
Actions
Copy link
 #2

Updated by Philippe Antoine 19 days ago

  • Affected Versions 8.0.0 added

Confirmed

 ./src/suricata -r pcaps --pcap-file-recursive -k none -c suricata.yaml -l log --disable-detection
Notice: suricata: This is Suricata version 8.0.1-dev (2a17ab6d88 2025-08-27) running in USER mode [LogVersion:suricata.c:1208]
Notice: threads: Threads created -> RX: 1 W: 16 FM: 1 FR: 1   Engine started. [TmThreadWaitOnThreadRunning:tm-threads.c:1982]
Notice: suricata: Signal Received.  Stopping engine. [SuricataMainLoop:suricata.c:2931]
Notice: pcap: read 0 files, 0 packets, 0 bytes [ReceivePcapFileThreadExitStats:source-pcap-file.c:414]


find pcaps/ -type f
pcaps/sub2/cme_query.pcap
pcaps/sub1/2016949.pcap
Actions
Copy link
 #3

Updated by Philippe Antoine 19 days ago

  • Label deleted (Needs backport)
Actions
Copy link

Also available in: Atom PDF