Go to the documentation of this file.
45 #define PCAP_STATE_DOWN 0
46 #define PCAP_STATE_UP 1
48 #define PCAP_RECONNECT_TIMEOUT 500000
111 static void ReceivePcapThreadExitStats(
ThreadVars *,
void *);
120 static void SourcePcapRegisterTests(
void);
160 static inline void UpdatePcapStatsValue64(uint64_t *last, uint32_t current32)
163 uint32_t last32 = *last;
166 *last += (uint32_t)(current32 - last32);
181 static inline void UpdatePcapStats64(
182 PcapStats64 *last,
const struct pcap_stat *current)
184 UpdatePcapStatsValue64(&last->
ps_recv, current->ps_recv);
185 UpdatePcapStatsValue64(&last->
ps_drop, current->ps_drop);
186 UpdatePcapStatsValue64(&last->
ps_ifdrop, current->ps_ifdrop);
191 struct pcap_stat pcap_s;
209 int pcap_activate_r = pcap_activate(ptv->
pcap_handle);
210 if (pcap_activate_r != 0) {
211 return pcap_activate_r;
231 SCLogInfo(
"Recovering interface listening");
236 static void PcapCallbackLoop(
char *user,
struct pcap_pkthdr *h, u_char *pkt)
242 struct timeval current_time;
249 p->
ts.tv_sec = h->ts.tv_sec;
250 p->
ts.tv_usec = h->ts.tv_usec;
251 SCLogDebug(
"p->ts.tv_sec %"PRIuMAX
"", (uintmax_t)p->
ts.tv_sec);
255 ptv->
bytes += h->caplen;
288 PcapDumpCounters(ptv);
295 #ifndef PCAP_ERROR_BREAK
296 #define PCAP_ERROR_BREAK -2
306 int packet_q_len = 64;
322 int r = pcap_dispatch(ptv->
pcap_handle, packet_q_len,
323 (pcap_handler)PcapCallbackLoop, (u_char *)ptv);
328 TmThreadsCaptureHandleTimeout(
tv, NULL);
332 r, pcap_geterr(ptv->pcap_handle));
339 r = PcapTryReopen(ptv);
352 PcapDumpCounters(ptv);
391 if (initdata == NULL) {
420 SCLogInfo(
"running in 'auto' checksum mode. Detection of interface "
424 char errbuf[PCAP_ERRBUF_SIZE];
427 if (strlen(errbuf)) {
429 "pcap handler for %s, error %s",
430 (
char *)pcapconfig->
iface, errbuf);
433 "pcap handler for %s",
434 (
char *)pcapconfig->
iface);
441 if (pcapconfig->
snaplen == 0) {
450 if (pcap_set_snaplen_r != 0) {
463 if (pcap_set_promisc_r != 0) {
472 if (pcap_set_timeout_r != 0) {
479 #ifdef HAVE_PCAP_SET_BUFF
482 SCLogInfo(
"going to use pcap buffer size of %" PRId32,
485 int pcap_set_buffer_size_r = pcap_set_buffer_size(ptv->
pcap_handle,
487 if (pcap_set_buffer_size_r != 0) {
489 "pcap buffer size, error %s", pcap_geterr(ptv->
pcap_handle));
498 int pcap_activate_r = pcap_activate(ptv->
pcap_handle);
499 if (pcap_activate_r != 0) {
501 "pcap handler, error %s", pcap_geterr(ptv->
pcap_handle));
562 static void ReceivePcapThreadExitStats(
ThreadVars *
tv,
void *data)
566 struct pcap_stat pcap_s;
592 SCLogInfo(
"(%s) Pcap Total:%" PRIu64
" Recv:%" PRIu64
" Drop:%" PRIu64
651 char errbuf[PCAP_ERRBUF_SIZE];
652 pcap_if_t *alldevsp = NULL;
654 struct addrinfo ai_hints;
655 struct addrinfo *ai_list = NULL;
657 memset(&ai_hints, 0,
sizeof(ai_hints));
658 ai_hints.ai_family = AF_UNSPEC;
659 ai_hints.ai_flags = AI_NUMERICHOST;
662 if (getaddrinfo(pcap_dev, NULL, &ai_hints, &ai_list) != 0) {
666 if (pcap_findalldevs(&alldevsp, errbuf)) {
667 freeaddrinfo(ai_list);
671 for (pcap_if_t *devsp = alldevsp; devsp ; devsp = devsp->next) {
672 for (pcap_addr_t *ip = devsp->addresses; ip ; ip = ip->next) {
674 if (ai_list->ai_family != ip->addr->sa_family) {
678 if (ip->addr->sa_family == AF_INET) {
679 if (memcmp(&((
struct sockaddr_in*)ai_list->ai_addr)->sin_addr,
680 &((
struct sockaddr_in*)ip->addr)->sin_addr,
681 sizeof(
struct in_addr)))
685 }
else if (ip->addr->sa_family == AF_INET6) {
686 if (memcmp(&((
struct sockaddr_in6*)ai_list->ai_addr)->sin6_addr,
687 &((
struct sockaddr_in6*)ip->addr)->sin6_addr,
688 sizeof(
struct in6_addr)))
696 freeaddrinfo(ai_list);
698 memset(pcap_dev, 0,
len);
701 pcap_freealldevs(alldevsp);
706 freeaddrinfo(ai_list);
708 pcap_freealldevs(alldevsp);
720 static void SourcePcapRegisterTests(
void)
722 SourcePcapRegisterStatsTests();
@ SC_ERR_PCAP_SET_TIMEOUT
uint16_t capture_kernel_ifdrops
struct bpf_program filter
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
@ SC_ERR_PCAP_SET_SNAPLEN
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
#define CHECKSUM_SAMPLE_COUNT
#define StatsSyncCountersIfSignalled(tv)
@ CHECKSUM_VALIDATION_DISABLE
#define SCMUTEX_INITIALIZER
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
int ChecksumAutoModeCheck(uint64_t thread_count, uint64_t iface_count, uint64_t iface_fail)
Check if the number of invalid checksums indicate checksum offloading in place.
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
size_t strlcpy(char *dst, const char *src, size_t siz)
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
int GetIfaceMaxPacketSize(const char *pcap_dev)
output max packet size for a link
#define PKT_SET_SRC(p, src_val)
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
@ CHECKSUM_VALIDATION_AUTO
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
uint16_t capture_kernel_packets
#define SCMutexUnlock(mut)
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
#define PCAP_RECONNECT_TIMEOUT
Per thread variable structure.
TmEcode(* Func)(ThreadVars *, Packet *, void *)
struct PcapThreadVars_ PcapThreadVars
Structure to hold thread specific variables.
@ SC_ERR_INVALID_ARGUMENT
uint16_t capture_kernel_drops
void PacketPoolWait(void)
@ SC_ERR_PCAP_SET_BUFF_SIZE
#define TM_FLAG_DECODE_TM
void(* DerefFunc)(void *)
TmModule tmm_modules[TMM_SIZE]
void(* RegisterTests)(void)
#define PKT_IGNORE_CHECKSUM
struct LiveDevice_ * livedev
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define TM_FLAG_RECEIVE_TM
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
64bit pcap stats counters.
char iface[PCAP_IFACE_NAME_LENGTH]
void(* ThreadExitPrintStats)(ThreadVars *, void *)
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
Structure to hold thread specific data for all decode modules.
void TmModuleReceivePcapRegister(void)
Registration Function for ReceivePcap.
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
void TimeGet(struct timeval *tv)
ChecksumValidationMode checksum_mode
struct TmSlot_ * slot_next
@ SC_ERR_PCAP_ACTIVATE_HANDLE
struct PcapStats64_ PcapStats64
64bit pcap stats counters.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Structure to hold thread specific variables.
@ SC_ERR_PCAP_SET_PROMISC
ChecksumValidationMode checksum_mode
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
volatile uint8_t suricata_ctl_flags