suricata
source-pcap-file-helper.h File Reference
#include "suricata-common.h"
#include "tm-threads.h"
Include dependency graph for source-pcap-file-helper.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  PcapFileGlobalVars_
 
struct  PcapFileSharedVars_
 
struct  PcapFileFileVars_
 

Typedefs

typedef struct PcapFileGlobalVars_ PcapFileGlobalVars
 
typedef struct PcapFileSharedVars_ PcapFileSharedVars
 
typedef struct PcapFileFileVars_ PcapFileFileVars
 

Functions

TmEcode PcapFileDispatch (PcapFileFileVars *ptv)
 Main PCAP file reading Loop function. More...
 
TmEcode InitPcapFile (PcapFileFileVars *pfv)
 
void CleanupPcapFileFileVars (PcapFileFileVars *pfv)
 
TmEcode ValidateLinkType (int datalink, DecoderFunc *decoder)
 

Detailed Description

Typedef Documentation

Data specific to a single pcap file

Data that is shared amongst File, Directory, and Thread level vars

Function Documentation

TmEcode InitPcapFile ( PcapFileFileVars pfv)

From a PcapFileFileVars, prepare the filename for processing by setting pcap_handle, datalink, and filter

Parameters
pfvPcapFileFileVars object to populate
Returns

Definition at line 163 of file source-pcap-file-helper.c.

References PcapFileSharedVars_::bpf_string, PcapFileFileVars_::datalink, PcapFileFileVars_::filename, PcapFileFileVars_::filter, PcapFileFileVars_::pcap_handle, SC_ERR_BPF, SC_ERR_FOPEN, SC_ERR_INVALID_ARGUMENT, SCLogDebug, SCLogError, SCLogInfo, SCReturnInt, PcapFileFileVars_::shared, TM_ECODE_FAILED, unlikely, and ValidateLinkType().

Referenced by PcapDetermineDirectoryOrFile(), and PcapFileGlobalInit().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode PcapFileDispatch ( PcapFileFileVars ptv)

Main PCAP file reading Loop function.

Dispatch a file for processing, where the information necessary to process that file is as PcapFileFileVars object.

Parameters
ptvPcapFileFileVars object to be processed
Returns

Definition at line 119 of file source-pcap-file-helper.c.

References PcapFileSharedVars_::cb_result, PcapFileFileVars_::filename, PcapFileSharedVars_::files, PacketPoolWait(), pcap_filename, PcapFileFileVars_::pcap_handle, SC_ERR_PCAP_DISPATCH, SCEnter, SCLogError, SCLogInfo, SCReturnInt, PcapFileFileVars_::shared, StatsSyncCountersIfSignalled, strlcpy(), suricata_ctl_flags, SURICATA_STOP, TM_ECODE_DONE, TM_ECODE_FAILED, TM_ECODE_OK, PcapFileSharedVars_::tv, and unlikely.

Referenced by PcapDetermineDirectoryOrFile(), and PcapFileGlobalInit().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode ValidateLinkType ( int  datalink,
DecoderFunc decoder 
)

Determine if a datalink type is valid, setting a decoder function if valid.

Parameters
datalinkDatalink type to validate
decoderPointer to decoder to set if valid
Returns
TM_ECODE_OK if valid datalink type and decoder has been set.

Definition at line 202 of file source-pcap-file-helper.c.

References DecodeEthernet(), DecodeNull(), DecodePPP(), DecodeRaw(), DecodeSll(), LINKTYPE_ETHERNET, LINKTYPE_GRE_OVER_IP, LINKTYPE_IPV4, LINKTYPE_LINUX_SLL, LINKTYPE_NULL, LINKTYPE_PPP, LINKTYPE_RAW, LINKTYPE_RAW2, SC_ERR_UNIMPLEMENTED, SCLogError, SCReturnInt, TM_ECODE_FAILED, and TM_ECODE_OK.

Referenced by InitPcapFile(), and PcapFileGlobalInit().

Here is the call graph for this function:

Here is the caller graph for this function: