From ea020e2be6d959769681b14525232be4c9f4923a Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Fri, 7 Sep 2012 10:22:38 -0600 Subject: [PATCH] Do not trim the FCS, pcaps converted to ERF will have have an FCS. --- src/source-erf-dag.c | 2 +- src/source-erf-file.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/source-erf-dag.c b/src/source-erf-dag.c index f7f268088d..04aab9367e 100644 --- a/src/source-erf-dag.c +++ b/src/source-erf-dag.c @@ -483,7 +483,7 @@ static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec) SCReturnInt(TM_ECODE_FAILED); } - SET_PKT_LEN(p, wlen - 4); /* Trim the FCS... */ + SET_PKT_LEN(p, wlen); p->datalink = LINKTYPE_ETHERNET; /* Take into account for link type Ethernet ETH frame starts diff --git a/src/source-erf-file.c b/src/source-erf-file.c index c17d108116..8e8b23aa05 100644 --- a/src/source-erf-file.c +++ b/src/source-erf-file.c @@ -186,7 +186,7 @@ static inline TmEcode ReadErfRecord(ThreadVars *tv, Packet *p, void *data) SCReturnInt(TM_ECODE_FAILED); } - GET_PKT_LEN(p) = wlen - 4; /* Trim the FCS... */ + GET_PKT_LEN(p) = wlen; p->datalink = LINKTYPE_ETHERNET; /* Convert ERF time to timeval - from libpcap. */