Do not trim the FCS, pcaps converted to ERF will have have an FCS.

13 years ago · ea020e2be6
parent 4a1a008009
commit ea020e2be6
2 changed files with 2 additions and 2 deletions
--- a/src/source-erf-dag.c
+++ b/src/source-erf-dag.c
@ -483,7 +483,7 @@ static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec)
        SCReturnInt(TM_ECODE_FAILED);
    }

-    SET_PKT_LEN(p, wlen - 4);   /* Trim the FCS... */
+    SET_PKT_LEN(p, wlen);
    p->datalink = LINKTYPE_ETHERNET;

    /* Take into account for link type Ethernet ETH frame starts
--- a/src/source-erf-file.c
+++ b/src/source-erf-file.c
@ -186,7 +186,7 @@ static inline TmEcode ReadErfRecord(ThreadVars *tv, Packet *p, void *data)
        SCReturnInt(TM_ECODE_FAILED);
    }

-    GET_PKT_LEN(p) = wlen - 4; /* Trim the FCS... */
+    GET_PKT_LEN(p) = wlen;
    p->datalink = LINKTYPE_ETHERNET;

    /* Convert ERF time to timeval - from libpcap. */