suricata
runmode-pcap.c File Reference
#include "suricata-common.h"
#include "tm-threads.h"
#include "conf.h"
#include "runmodes.h"
#include "runmode-pcap.h"
#include "output.h"
#include "log-httplog.h"
#include "util-debug.h"
#include "util-time.h"
#include "util-cpu.h"
#include "util-affinity.h"
#include "util-device.h"
#include "util-runmodes.h"
#include "util-atomic.h"
#include "util-misc.h"
Include dependency graph for runmode-pcap.c:

Go to the source code of this file.

Functions

const char * RunModeIdsGetDefaultMode (void)
 
int RunModeIdsPcapWorkers (void)
 Workers version of the PCAP LIVE processing. More...
 
void RunModeIdsPcapRegister (void)
 
int RunModeIdsPcapSingle (void)
 Single thread version of the Pcap live processing. More...
 
int RunModeIdsPcapAutoFp (void)
 RunModIdsPcapAutoFp set up the following thread packet handlers: More...
 

Function Documentation

const char* RunModeIdsGetDefaultMode ( void  )

Definition at line 37 of file runmode-pcap.c.

References RunModeIdsPcapWorkers().

Referenced by RunModeDispatch().

Here is the call graph for this function:

Here is the caller graph for this function:

int RunModeIdsPcapAutoFp ( void  )

RunModIdsPcapAutoFp set up the following thread packet handlers:

  • Receive thread (from pcap device)
  • Decode thread
  • Stream thread
  • Detect: If we have only 1 cpu, it will setup one Detect thread If we have more than one, it will setup num_cpus - 1 starting from the second cpu available.
  • Outputs thread By default the threads will use the first cpu available except the Detection threads if we have more than one cpu.
Return values
0If all goes well. (If any problem is detected the engine will exit()).

Definition at line 277 of file runmode-pcap.c.

References ConfGet(), RunModeInitialize(), RunModeSetLiveCaptureAutoFp(), SC_ERR_RUNMODE, SCEnter, SCLogError, SCLogInfo, SCReturnInt, thread_name_autofp, and TimeModeSetLive().

Referenced by RunModeIdsPcapRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

int RunModeIdsPcapSingle ( void  )

Single thread version of the Pcap live processing.

Definition at line 235 of file runmode-pcap.c.

References ConfGet(), RunModeInitialize(), RunModeSetLiveCaptureSingle(), SC_ERR_RUNMODE, SCEnter, SCLogError, SCLogInfo, SCReturnInt, thread_name_single, and TimeModeSetLive().

Referenced by RunModeIdsPcapRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

int RunModeIdsPcapWorkers ( void  )

Workers version of the PCAP LIVE processing.

Start N threads with each thread doing all the work.

Definition at line 309 of file runmode-pcap.c.

References ConfGet(), RunModeInitialize(), RunModeSetLiveCaptureWorkers(), SC_ERR_RUNMODE, SCEnter, SCLogError, SCLogInfo, SCReturnInt, thread_name_workers, and TimeModeSetLive().

Referenced by RunModeIdsGetDefaultMode(), and RunModeIdsPcapRegister().

Here is the call graph for this function:

Here is the caller graph for this function: