suricata
source-erf-dag.c File Reference
#include "suricata-common.h"
#include "suricata.h"
#include "tm-threads.h"
#include "util-privs.h"
#include "util-device.h"
#include "tmqh-packetpool.h"
#include "source-erf-dag.h"
#include <dagapi.h>
Include dependency graph for source-erf-dag.c:

Go to the source code of this file.

Data Structures

struct  ErfDagThreadVars_
 

Macros

#define MINDATA   32768
 
#define MAXWAIT   20000
 
#define POLL_INTERVAL   1000;
 
#define BYTES_PER_LOOP   (4 * 1024 * 1024) /* 4 MB */
 

Typedefs

typedef struct ErfDagThreadVars_ ErfDagThreadVars
 

Functions

TmEcode ReceiveErfDagLoop (ThreadVars *tv, void *data, void *slot)
 Receives packets from a DAG interface. More...
 
TmEcode ReceiveErfDagThreadInit (ThreadVars *tv, void *initdata, void **data)
 Initialize the ERF receiver thread, generate a single ErfDagThreadVar structure for each thread, this will contain a DAG file descriptor which is read when the thread executes. More...
 
void ReceiveErfDagThreadExitStats (ThreadVars *tv, void *data)
 Print some stats to the log at program exit. More...
 
TmEcode ReceiveErfDagThreadDeinit (ThreadVars *tv, void *data)
 Deinitializes the DAG card. More...
 
TmEcode DecodeErfDagThreadInit (ThreadVars *, void *, void **)
 
TmEcode DecodeErfDagThreadDeinit (ThreadVars *tv, void *data)
 
TmEcode DecodeErfDag (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
 This function passes off to link type decoders. More...
 
void ReceiveErfDagCloseStream (int dagfd, int stream)
 
void TmModuleReceiveErfDagRegister (void)
 Register the ERF file receiver (reader) module. More...
 
void TmModuleDecodeErfDagRegister (void)
 Register the ERF file decoder module. More...
 

Variables

int max_pending_packets
 

Detailed Description

Author
Endace Technology Limited.
Jason MacLulich jason.nosp@m..mac.nosp@m.lulic.nosp@m.h@en.nosp@m.dace..nosp@m.com

Support for reading ERF records from a DAG card.

Only ethernet supported at this time.

Definition in file source-erf-dag.c.

Macro Definition Documentation

#define BYTES_PER_LOOP   (4 * 1024 * 1024) /* 4 MB */

Definition at line 91 of file source-erf-dag.c.

Referenced by ReceiveErfDagLoop().

#define MAXWAIT   20000

Definition at line 85 of file source-erf-dag.c.

Referenced by ReceiveErfDagThreadInit().

#define MINDATA   32768

Definition at line 82 of file source-erf-dag.c.

Referenced by ReceiveErfDagThreadInit().

#define POLL_INTERVAL   1000;

Definition at line 88 of file source-erf-dag.c.

Referenced by ReceiveErfDagThreadInit().

Typedef Documentation

Function Documentation

TmEcode DecodeErfDag ( ThreadVars tv,
Packet p,
void *  data,
PacketQueue pq,
PacketQueue postpq 
)

This function passes off to link type decoders.

Decode ErfDag DecodeErfDag reads packets from the PacketQueue and passes them off to the proper link type decoder.

Parameters
tpointer to ThreadVars
ppointer to the current packet
datapointer that gets cast into PcapThreadVars for ptv
pqpointer to the current PacketQueue

Definition at line 613 of file source-erf-dag.c.

References Packet_::datalink, DecodeEthernet(), DecodeUpdatePacketCounters(), Packet_::flags, GET_PKT_DATA, GET_PKT_LEN, LINKTYPE_ETHERNET, PacketDecodeFinalize(), PKT_PSEUDO_STREAM_END, SC_ERR_DATALINK_UNIMPLEMENTED, SCEnter, SCLogError, SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodeErfDagRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeErfDagThreadDeinit ( ThreadVars tv,
void *  data 
)

Definition at line 664 of file source-erf-dag.c.

References DecodeThreadVarsFree(), SCReturnInt, and TM_ECODE_OK.

Referenced by TmModuleDecodeErfDagRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode DecodeErfDagThreadInit ( ThreadVars tv,
void *  initdata,
void **  data 
)

Definition at line 646 of file source-erf-dag.c.

References DecodeRegisterPerfCounters(), DecodeThreadVarsAlloc(), SCEnter, SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by TmModuleDecodeErfDagRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void ReceiveErfDagCloseStream ( int  dagfd,
int  stream 
)

Definition at line 592 of file source-erf-dag.c.

Referenced by ReceiveErfDagLoop(), and ReceiveErfDagThreadDeinit().

Here is the caller graph for this function:

TmEcode ReceiveErfDagThreadDeinit ( ThreadVars tv,
void *  data 
)

Deinitializes the DAG card.

Parameters
tvpointer to ThreadVars
datapointer that gets cast into PcapThreadVars for ptv

Definition at line 580 of file source-erf-dag.c.

References ErfDagThreadVars_::dagfd, ErfDagThreadVars_::dagstream, ReceiveErfDagCloseStream(), SCEnter, SCReturnInt, and TM_ECODE_OK.

Here is the call graph for this function:

void ReceiveErfDagThreadExitStats ( ThreadVars tv,
void *  data 
)

Print some stats to the log at program exit.

Parameters
tvPointer to ThreadVars.
dataPointer to data, ErfFileThreadVars.

Definition at line 557 of file source-erf-dag.c.

References ErfDagThreadVars_::bytes, ErfDagThreadVars_::dagstream, ErfDagThreadVars_::drops, ErfDagThreadVars_::livedev, ErfDagThreadVars_::packets, SC_ATOMIC_SET, SCLogInfo, and StatsGetLocalCounterValue().

Referenced by TmModuleReceiveErfDagRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ReceiveErfDagThreadInit ( ThreadVars tv,
void *  initdata,
void **  data 
)

Initialize the ERF receiver thread, generate a single ErfDagThreadVar structure for each thread, this will contain a DAG file descriptor which is read when the thread executes.

Parameters
tvThread variable to ThreadVars
initdataInitial data to the interface passed from the user, this is processed by the user.

We assume that we have only a single name for the DAG interface.

Parameters
datadata pointer gets populated with

Definition at line 183 of file source-erf-dag.c.

References ErfDagThreadVars_::dagfd, ErfDagThreadVars_::dagname, ErfDagThreadVars_::dagstream, ErfDagThreadVars_::drops, ErfDagThreadVars_::livedev, LiveGetDevice(), MAXWAIT, MINDATA, ErfDagThreadVars_::packets, ErfDagThreadVars_::poll, POLL_INTERVAL, SC_ERR_ERF_DAG_OPEN_FAILED, SC_ERR_ERF_DAG_STREAM_OPEN_FAILED, SC_ERR_ERF_DAG_STREAM_SET_FAILED, SC_ERR_ERF_DAG_STREAM_START_FAILED, SC_ERR_INVALID_ARGUMENT, SC_ERR_INVALID_VALUE, SC_ERR_MEM_ALLOC, SCEnter, SCFree, SCLogError, SCLogInfo, SCMalloc, SCReturnInt, StatsRegisterCounter(), TM_ECODE_FAILED, TM_ECODE_OK, ErfDagThreadVars_::tv, and unlikely.

Referenced by TmModuleReceiveErfDagRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleDecodeErfDagRegister ( void  )

Register the ERF file decoder module.

Definition at line 154 of file source-erf-dag.c.

References TmModule_::cap_flags, DecodeErfDag(), DecodeErfDagThreadDeinit(), DecodeErfDagThreadInit(), TmModule_::flags, TmModule_::Func, TmModule_::name, TmModule_::RegisterTests, TmModule_::ThreadDeinit, TmModule_::ThreadExitPrintStats, TmModule_::ThreadInit, TM_FLAG_DECODE_TM, TMM_DECODEERFDAG, and tmm_modules.

Referenced by RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

void TmModuleReceiveErfDagRegister ( void  )