Go to the documentation of this file.
47 #define PCAP_STATE_DOWN 0
48 #define PCAP_STATE_UP 1
50 #define PCAP_RECONNECT_TIMEOUT 500000
113 static void ReceivePcapThreadExitStats(
ThreadVars *,
void *);
122 static void SourcePcapRegisterTests(
void);
162 static inline void UpdatePcapStatsValue64(uint64_t *last, uint32_t current32)
165 uint32_t last32 = *last;
168 *last += (uint32_t)(current32 - last32);
183 static inline void UpdatePcapStats64(
184 PcapStats64 *last,
const struct pcap_stat *current)
186 UpdatePcapStatsValue64(&last->
ps_recv, current->ps_recv);
187 UpdatePcapStatsValue64(&last->
ps_drop, current->ps_drop);
188 UpdatePcapStatsValue64(&last->
ps_ifdrop, current->ps_ifdrop);
193 struct pcap_stat pcap_s;
211 int pcap_activate_r = pcap_activate(ptv->
pcap_handle);
212 if (pcap_activate_r != 0 && pcap_activate_r != PCAP_ERROR_ACTIVATED) {
213 return pcap_activate_r;
231 SCLogInfo(
"Recovering interface listening");
236 static void PcapCallbackLoop(
char *user,
struct pcap_pkthdr *h, u_char *pkt)
253 ptv->
bytes += h->caplen;
286 PcapDumpCounters(ptv);
293 #ifndef PCAP_ERROR_BREAK
294 #define PCAP_ERROR_BREAK -2
304 int packet_q_len = 64;
324 int r = pcap_dispatch(ptv->
pcap_handle, packet_q_len,
325 (pcap_handler)PcapCallbackLoop, (u_char *)ptv);
330 TmThreadsCaptureHandleTimeout(
tv, NULL);
333 SCLogError(
"error code %" PRId32
" %s", r, pcap_geterr(ptv->pcap_handle));
340 r = PcapTryReopen(ptv);
346 SCLogError(
"Pcap callback PcapCallbackLoop failed");
353 PcapDumpCounters(ptv);
392 if (initdata == NULL) {
421 SCLogInfo(
"running in 'auto' checksum mode. Detection of interface "
425 char errbuf[PCAP_ERRBUF_SIZE];
428 if (strlen(errbuf)) {
430 "pcap handler for %s, error %s",
431 (
char *)pcapconfig->
iface, errbuf);
434 "pcap handler for %s",
435 (
char *)pcapconfig->
iface);
442 if (pcapconfig->
snaplen == 0) {
451 if (pcap_set_snaplen_r != 0) {
465 if (pcap_set_promisc_r != 0) {
475 if (pcap_set_timeout_r != 0) {
483 #ifdef HAVE_PCAP_SET_BUFF
486 SCLogInfo(
"going to use pcap buffer size of %" PRId32,
489 int pcap_set_buffer_size_r = pcap_set_buffer_size(ptv->
pcap_handle,
491 if (pcap_set_buffer_size_r != 0) {
493 "pcap buffer size, error %s",
503 int pcap_activate_r = pcap_activate(ptv->
pcap_handle);
504 if (pcap_activate_r != 0) {
506 "pcap handler, error %s",
567 static void ReceivePcapThreadExitStats(
ThreadVars *
tv,
void *data)
571 struct pcap_stat pcap_s;
596 SCLogInfo(
"(%s) Pcap Total:%" PRIu64
" Recv:%" PRIu64
" Drop:%" PRIu64
655 char errbuf[PCAP_ERRBUF_SIZE];
656 pcap_if_t *alldevsp = NULL;
658 struct addrinfo ai_hints;
659 struct addrinfo *ai_list = NULL;
661 memset(&ai_hints, 0,
sizeof(ai_hints));
662 ai_hints.ai_family = AF_UNSPEC;
663 ai_hints.ai_flags = AI_NUMERICHOST;
666 if (getaddrinfo(pcap_dev, NULL, &ai_hints, &ai_list) != 0) {
670 if (pcap_findalldevs(&alldevsp, errbuf)) {
671 freeaddrinfo(ai_list);
675 for (pcap_if_t *devsp = alldevsp; devsp ; devsp = devsp->next) {
676 for (pcap_addr_t *ip = devsp->addresses; ip ; ip = ip->next) {
678 if (ai_list->ai_family != ip->addr->sa_family) {
682 if (ip->addr->sa_family == AF_INET) {
683 if (memcmp(&((
struct sockaddr_in*)ai_list->ai_addr)->sin_addr,
684 &((
struct sockaddr_in*)ip->addr)->sin_addr,
685 sizeof(
struct in_addr)))
689 }
else if (ip->addr->sa_family == AF_INET6) {
690 if (memcmp(&((
struct sockaddr_in6*)ai_list->ai_addr)->sin6_addr,
691 &((
struct sockaddr_in6*)ip->addr)->sin6_addr,
692 sizeof(
struct in6_addr)))
700 freeaddrinfo(ai_list);
702 memset(pcap_dev, 0,
len);
705 pcap_freealldevs(alldevsp);
710 freeaddrinfo(ai_list);
712 pcap_freealldevs(alldevsp);
724 static void SourcePcapRegisterTests(
void)
726 SourcePcapRegisterStatsTests();
uint16_t capture_kernel_ifdrops
struct bpf_program filter
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
#define SC_ATOMIC_SET(name, val)
Set the value for the atomic variable.
void TmThreadsSetFlag(ThreadVars *tv, uint32_t flag)
Set a thread flag.
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
#define CHECKSUM_SAMPLE_COUNT
#define StatsSyncCountersIfSignalled(tv)
@ CHECKSUM_VALIDATION_DISABLE
#define SCMUTEX_INITIALIZER
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
int ChecksumAutoModeCheck(uint64_t thread_count, uint64_t iface_count, uint64_t iface_fail)
Check if the number of invalid checksums indicate checksum offloading in place.
TmEcode(* PktAcqLoop)(ThreadVars *, void *, void *)
size_t strlcpy(char *dst, const char *src, size_t siz)
void PcapTranslateIPToDevice(char *pcap_dev, size_t len)
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
int GetIfaceMaxPacketSize(const char *pcap_dev)
output max packet size for a link
#define PKT_SET_SRC(p, src_val)
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
@ CHECKSUM_VALIDATION_AUTO
TmEcode(* PktAcqBreakLoop)(ThreadVars *, void *)
uint16_t capture_kernel_packets
#define SCMutexUnlock(mut)
LiveDevice * LiveGetDevice(const char *name)
Get a pointer to the device at idx.
#define PCAP_RECONNECT_TIMEOUT
Per thread variable structure.
#define SCTIME_FROM_TIMEVAL(tv)
TmEcode(* Func)(ThreadVars *, Packet *, void *)
struct PcapThreadVars_ PcapThreadVars
Structure to hold thread specific variables.
uint16_t capture_kernel_drops
void PacketPoolWait(void)
#define TM_FLAG_DECODE_TM
void(* DerefFunc)(void *)
TmModule tmm_modules[TMM_SIZE]
void(* RegisterTests)(void)
#define PKT_IGNORE_CHECKSUM
struct LiveDevice_ * livedev
int GetIfaceOffloading(const char *dev, int csum, int other)
output offloading status of the link
int DisableIfaceOffloading(LiveDevice *dev, int csum, int other)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define TM_FLAG_RECEIVE_TM
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
64bit pcap stats counters.
char iface[PCAP_IFACE_NAME_LENGTH]
void(* ThreadExitPrintStats)(ThreadVars *, void *)
void TmModuleDecodePcapRegister(void)
Registration Function for DecodePcap.
#define SCLogError(...)
Macro used to log ERROR messages.
void DatalinkSetGlobalType(int datalink)
Structure to hold thread specific data for all decode modules.
void TmModuleReceivePcapRegister(void)
Registration Function for ReceivePcap.
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
ChecksumValidationMode checksum_mode
struct TmSlot_ * slot_next
struct PcapStats64_ PcapStats64
64bit pcap stats counters.
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Structure to hold thread specific variables.
ChecksumValidationMode checksum_mode
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
volatile uint8_t suricata_ctl_flags