Go to the documentation of this file.
68 NoErfDagSupportExit(
ThreadVars *
tv,
const void *initdata,
void **data)
70 SCLogError(
"Error creating thread %s: you do not have support for DAG cards "
71 "enabled please recompile with --enable-dag",
87 #define POLL_INTERVAL 1000;
90 #define BYTES_PER_LOOP (4 * 1024 * 1024)
102 struct timeval maxwait,
poll;
118 uint32_t *pkts_read);
182 int stream_count = 0;
184 if (initdata == NULL) {
185 SCLogError(
"Error: No DAG interface provided.");
191 FatalError(
"Failed to allocate memory for ERF DAG thread vars.");
194 memset(ewtn, 0,
sizeof(*ewtn));
199 if (dag_parse_name(initdata, ewtn->
dagname, DAGNAME_BUFSIZE,
201 SCLogError(
"Failed to parse DAG interface: %s", (
char *)initdata);
208 SCLogError(
"Unable to get %s live device", (
char *)initdata);
213 SCLogInfo(
"Opening DAG: %s on stream: %d for processing",
225 if ((stream_count = dag_rx_get_stream_count(ewtn->
dagfd)) < 0) {
226 SCLogError(
"Failed to open stream: %d, DAG: %s, could not query stream count",
235 if (ewtn->
dagstream > stream_count * 2) {
236 SCLogError(
"Failed to open stream: %d, DAG: %s, insufficient streams: %d", ewtn->
dagstream,
247 if (dag_set_mode(ewtn->
dagfd, ewtn->
dagstream, DAG_REVERSE_MODE)) {
248 SCLogError(
"Failed to set mode to DAG_REVERSE_MODE on stream: %d, DAG: %s",
267 SCLogInfo(
"Attached and started stream: %d on DAG: %s",
273 timerclear(&ewtn->maxwait);
274 ewtn->maxwait.tv_usec =
MAXWAIT;
275 timerclear(&ewtn->
poll);
282 &(ewtn->maxwait), &(ewtn->
poll)) < 0) {
293 *data = (
void *)ewtn;
297 SCLogInfo(
"Starting processing packets from stream: %d on DAG: %s",
322 uint32_t pkts_read = 0;
336 top = dag_advance_stream(
dtv->dagfd,
dtv->dagstream, &(
dtv->btm));
338 if (errno == EAGAIN) {
339 if (
dtv->dagstream & 0x1) {
340 TmThreadsCaptureHandleTimeout(
tv, NULL);
346 SCLogError(
"Failed to read from stream: %d, DAG: %s when "
347 "using dag_advance_stream",
348 dtv->dagstream,
dtv->dagname);
353 diff = top -
dtv->btm;
358 assert(diff >= dag_record_size);
360 err = ProcessErfDagRecords(
dtv, top, &pkts_read);
363 SCLogError(
"Failed to read from stream: %d, DAG: %s",
dtv->dagstream,
dtv->dagname);
370 SCLogDebug(
"Read %d records from stream: %d, DAG: %s",
371 pkts_read,
dtv->dagstream,
dtv->dagname);
384 ProcessErfDagRecords(
ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read)
389 dag_record_t *dr = NULL;
397 while (((top - ewtn->
btm) >= dag_record_size) &&
404 prec = (
char *)ewtn->
btm;
405 dr = (dag_record_t*)prec;
419 switch (hdr_type & 0x7f) {
424 case ERF_TYPE_DSM_COLOR_ETH:
425 case ERF_TYPE_COLOR_ETH:
426 case ERF_TYPE_COLOR_HASH_ETH:
436 SCLogError(
"Processing of DAG record type: %d not implemented.", dr->type);
440 err = ProcessErfDagRecord(ewtn, prec);
465 dag_record_t *dr = (dag_record_t*)prec;
466 erf_payload_t *pload;
474 while (hdr_type & 0x80) {
475 if (
rlen < (dag_record_size + (hdr_num * 8))) {
476 SCLogError(
"Insufficient captured packet length.");
479 hdr_type = prec[(dag_record_size + (hdr_num * 8))];
484 if (
rlen < (dag_record_size + (8 * hdr_num) + 2 +
wlen)) {
490 pload = (erf_payload_t *)(prec + dag_record_size + (8 * hdr_num));
512 uint64_t
ts = dr->ts;
514 ts = (
ts & 0xffffffffULL) * 1000000;
516 uint64_t usecs =
ts >> 32;
517 if (usecs >= 1000000) {
549 SCLogInfo(
"Stream: %d; Bytes: %"PRIu64
"; Packets: %"PRIu64
577 dag_stop_stream(dagfd, stream);
578 dag_detach_stream(dagfd, stream);
611 SCLogError(
"Error: datalink type %" PRId32
" not yet supported in module DecodeErfDag",
uint16_t max_pending_packets
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
TmEcode DecodeErfDagThreadInit(ThreadVars *, void *, void **)
#define SCTIME_FROM_USECS(us)
#define StatsSyncCountersIfSignalled(tv)
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
char dagname[DAGNAME_BUFSIZE]
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
#define PKT_SET_SRC(p, src_val)
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
#define SET_PKT_LEN(p, len)
#define SCTIME_FROM_SECS(s)
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
Per thread variable structure.
TmEcode(* Func)(ThreadVars *, Packet *, void *)
void ReceiveErfDagThreadExitStats(ThreadVars *, void *)
Print some stats to the log at program exit.
void ReceiveErfDagCloseStream(int dagfd, int stream)
uint64_t StatsGetLocalCounterValue(ThreadVars *tv, uint16_t id)
Get the value of the local copy of the counter that hold this id.
void PacketPoolWait(void)
#define TM_FLAG_DECODE_TM
TmModule tmm_modules[TMM_SIZE]
TmEcode DecodeErfDag(ThreadVars *, Packet *, void *)
This function passes off to link type decoders.
void TmModuleDecodeErfDagRegister(void)
Register the ERF file decoder module.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define TM_FLAG_RECEIVE_TM
TmEcode ReceiveErfDagThreadInit(ThreadVars *, void *, void **)
Initialize the ERF receiver thread, generate a single ErfDagThreadVar structure for each thread,...
struct timeval maxwait poll
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
void TmModuleReceiveErfDagRegister(void)
Register the ERF file receiver (reader) module.
void(* ThreadExitPrintStats)(ThreadVars *, void *)
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
#define SCLogError(...)
Macro used to log ERROR messages.
void DatalinkSetGlobalType(int datalink)
Structure to hold thread specific data for all decode modules.
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
TmEcode ReceiveErfDagThreadDeinit(ThreadVars *, void *)
Deinitializes the DAG card.
TmEcode DecodeErfDagThreadDeinit(ThreadVars *tv, void *data)
TmEcode ReceiveErfDagLoop(ThreadVars *, void *data, void *slot)
Receives packets from a DAG interface.
struct TmSlot_ * slot_next
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
struct ErfDagThreadVars_ ErfDagThreadVars
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
#define LINKTYPE_ETHERNET
volatile uint8_t suricata_ctl_flags