Go to the documentation of this file.
44 "Multi threaded pcap live mode. Packets from "
45 "each flow are assigned to a single detect thread, "
46 "unlike \"pcap_live_auto\" where packets from "
47 "the same flow can be processed by any detect "
51 "Workers pcap live mode, each thread does all"
52 " tasks from acquisition to logging",
58 static void PcapDerefConfig(
void *conf)
67 static void *ParsePcapConfig(
const char *iface)
69 const char *threadsstr = NULL;
89 memset(aconf, 0x00,
sizeof(*aconf));
94 if ((
ConfGetInt(
"pcap.buffer-size", &value)) == 1) {
95 if (value >= 0 && value <= INT_MAX) {
96 SCLogInfo(
"Pcap will use %d buffer size", (
int)value);
100 "value of %" PRIiMAX
" is invalid. Valid range is "
108 if ((
ConfGet(
"bpf-filter", &tmpbpf)) == 1) {
118 if (pcap_node == NULL) {
119 SCLogInfo(
"Unable to find pcap config using default value");
127 if (if_root == NULL && if_default == NULL) {
128 SCLogInfo(
"Unable to find pcap config for "
129 "interface %s, using default value",
135 if (if_root == NULL) {
136 if_root = if_default;
143 if (threadsstr != NULL) {
146 "pcap.threads: %s, resetting to 1",
158 const char *s_limit = NULL;
161 if (ret == 1 && s_limit) {
165 SCLogError(
"Failed to parse pcap buffer size: %s", s_limit);
169 if (bsize == (uint64_t)((uint64_t)INT_MAX + (uint64_t)1))
170 bsize = (uint64_t)INT_MAX;
172 if (bsize > INT_MAX) {
173 SCLogError(
"Failed to set pcap buffer size: 2gb max. %" PRIu64
" > %d", bsize,
185 SCLogDebug(
"could not get bpf or none specified");
190 SCLogInfo(
"BPF filter set from command line or via old 'bpf-filter' option.");
194 if (strcmp(tmpctype,
"auto") == 0) {
207 SCLogDebug(
"could not get promisc or none specified");
214 SCLogDebug(
"could not get snaplen or none specified");
222 static int PcapConfigGeThreadsCount(
void *conf)
234 const char *live_dev = NULL;
241 (void)
ConfGet(
"pcap.single-pcap-dev", &live_dev);
244 PcapConfigGeThreadsCount,
252 SCLogInfo(
"RunModeIdsPcapSingle initialised");
275 const char *live_dev = NULL;
281 (void)
ConfGet(
"pcap.single-pcap-dev", &live_dev);
289 SCLogInfo(
"RunModeIdsPcapAutoFp initialised");
303 const char *live_dev = NULL;
309 (void)
ConfGet(
"pcap.single-pcap-dev", &live_dev);
317 SCLogInfo(
"RunModeIdsPcapWorkers initialised");
const char * thread_name_workers
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
int RunModeSetLiveCaptureWorkers(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
int ConfGetChildValueBoolWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, int *val)
int ParseSizeStringU64(const char *size, uint64_t *res)
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
void RunModeInitialize(void)
const char * thread_name_autofp
void RunModeRegisterNewRunMode(enum RunModes runmode, const char *name, const char *description, int(*RunModeFunc)(void), void(*RunModeIsIPSEnabled)(void))
Registers a new runmode.
@ CHECKSUM_VALIDATION_DISABLE
int StringParseInt32(int32_t *res, int base, size_t len, const char *str)
int ConfGetChildValueIntWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, intmax_t *val)
const char * thread_name_single
int ConfValIsTrue(const char *val)
Check if a value is true.
size_t strlcpy(char *dst, const char *src, size_t siz)
int RunModeSetLiveCaptureAutoFp(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
@ CHECKSUM_VALIDATION_ENABLE
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
@ CHECKSUM_VALIDATION_AUTO
ConfNode * ConfFindDeviceConfig(ConfNode *node, const char *iface)
Find the configuration node for a specific device.
int RunModeIdsPcapSingle(void)
Single thread version of the Pcap live processing.
int ConfGetChildValueWithDefault(const ConfNode *base, const ConfNode *dflt, const char *name, const char **vptr)
#define SCLogWarning(...)
Macro used to log WARNING messages.
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
void(* DerefFunc)(void *)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
void TimeModeSetLive(void)
void RunModeIdsPcapRegister(void)
char iface[PCAP_IFACE_NAME_LENGTH]
int RunModeIdsPcapAutoFp(void)
RunModIdsPcapAutoFp set up the following thread packet handlers:
#define SCLogError(...)
Macro used to log ERROR messages.
int ConfValIsFalse(const char *val)
Check if a value is false.
int RunModeSetLiveCaptureSingle(ConfigIfaceParserFunc ConfigParser, ConfigIfaceThreadsCountFunc ModThreadsCount, const char *recv_mod_name, const char *decode_mod_name, const char *thread_name, const char *live_dev)
ChecksumValidationMode checksum_mode
int RunModeIdsPcapWorkers(void)
Workers version of the PCAP LIVE processing.
const char * RunModeIdsGetDefaultMode(void)