Go to the documentation of this file.
34 static void PcapFileCallbackLoop(
char *user,
struct pcap_pkthdr *h, u_char *pkt);
48 "Failed to delete %s", pfv->
filename);
59 void PcapFileCallbackLoop(
char *user,
struct pcap_pkthdr *h, u_char *pkt)
72 p->
ts.tv_sec = h->ts.tv_sec;
73 p->
ts.tv_usec = h->ts.tv_usec % 1000000;
74 SCLogDebug(
"p->ts.tv_sec %"PRIuMAX
"", (uintmax_t)p->
ts.tv_sec);
127 (u_char *)ptv->first_pkt_data);
128 ptv->first_pkt_hdr = NULL;
129 ptv->first_pkt_data = NULL;
132 int packet_q_len = 64;
146 int r = pcap_dispatch(ptv->
pcap_handle, packet_q_len,
147 (pcap_handler)PcapFileCallbackLoop, (u_char *)ptv);
150 r, pcap_geterr(ptv->pcap_handle), ptv->filename);
156 SCLogInfo(
"pcap file %s end of file reached (pcap err code %" PRId32
")",
158 ptv->shared->files++;
162 "Pcap callback PcapFileCallbackLoop failed for %s", ptv->filename);
179 if (r <= 0 || pfv->first_pkt_hdr == NULL) {
181 "failed to get first packet timestamp. pcap_next_ex(): %d", r);
193 char errbuf[PCAP_ERRBUF_SIZE] =
"";
218 pcap_freecode(&pfv->
filter);
221 pcap_freecode(&pfv->
filter);
227 if (!PeekFirstPacketTimestamp(pfv))
262 "datalink type %"PRId32
" not (yet) supported in module PcapFile.",
TmEcode PcapFileDispatch(PcapFileFileVars *ptv)
Main PCAP file reading Loop function.
const u_char * first_pkt_data
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
TmEcode ValidateLinkType(int datalink, DecoderFunc *DecoderFn)
PcapFileSharedVars * shared
@ SC_ERR_PCAP_FILE_DELETE_FAILED
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define LINKTYPE_LINUX_SLL
void TmThreadsInitThreadsTimestamp(const struct timeval *ts)
int DecodeCHDLC(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define StatsSyncCountersIfSignalled(tv)
@ CHECKSUM_VALIDATION_DISABLE
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
@ SC_ERR_PCAP_OPEN_OFFLINE
int ChecksumAutoModeCheck(uint64_t thread_count, uint64_t iface_count, uint64_t iface_fail)
Check if the number of invalid checksums indicate checksum offloading in place.
size_t strlcpy(char *dst, const char *src, size_t siz)
#define PKT_SET_SRC(p, src_val)
int DecodeNull(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
@ CHECKSUM_VALIDATION_AUTO
ChecksumValidationMode checksum_mode
TmEcode InitPcapFile(PcapFileFileVars *pfv)
#define LINKTYPE_GRE_OVER_IP
@ SC_ERR_INVALID_ARGUMENT
void PacketPoolWait(void)
#define PACKET_PROFILING_TMM_END(p, id)
#define PKT_IGNORE_CHECKSUM
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
char pcap_filename[PATH_MAX]
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
struct timeval first_pkt_ts
#define PACKET_PROFILING_TMM_START(p, id)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
#define LINKTYPE_CISCO_HDLC
const char * PcapFileGetFilename(void)
int DecodeRaw(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
struct pcap_pkthdr * first_pkt_hdr
PcapFileGlobalVars pcap_g
struct bpf_program filter
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
void CleanupPcapFileFileVars(PcapFileFileVars *pfv)
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define LINKTYPE_ETHERNET
volatile uint8_t suricata_ctl_flags