109 Commits (1aaa828b63f8c4528f3632f52d8576761c9f0dc1)

Author	SHA1	Message	Date
Eric Leblond	1aaa828b63	pcap: set snaplen to MTU if available. ... Main objective of this patch is to use a dynamic snaplen to avoid to truncate packet at the currently fixed snaplen. It set snaplen to MTU length if the MTU can be retrieved. If not, it does not set the snaplen which results in using a 65535 snaplen. libpcap is trying to use mmaped capture and setup the ring by using buffer_size as the total memory. It also use "rounded" snaplen as frame size. So if we set snaplen to MTU when available we are optimal regarding the building of the ring.	14 years ago
Eric Leblond	8d0260b27e	Add atomic counter for iface drop.	14 years ago
Eric Leblond	7854c84972	pcap: add capture counters in stats.log. ... This patch adds three counters to stats.log: capture.kernel_packets | RxPcapwlan0 | 4218 capture.kernel_drops | RxPcapwlan0 | 0 capture.kernel_ifdrops | RxPcapwlan0 | 0 This patch meant to fix bug #625.	14 years ago
Victor Julien	829238e49c	OpenBSD 5.2 build fixes, Unit test fix.	14 years ago
Anoop Saldanha	b33986c887	Add a packet src for every packet generated inside suricata.	14 years ago
Eric Leblond	e176be6fcc	Use unlikely for error treatment. ... When handling error case on SCMallog, SCCalloc or SCStrdup we are in an unlikely case. This patch adds the unlikely() expression to indicate this to gcc. This patch has been obtained via coccinelle. The transformation is the following: @istested@ identifier x; statement S1; identifier func =~ "(SCMalloc|SCStrdup|SCCalloc)"; @@ x = func(...) ... when != x - if (x == NULL) S1 + if (unlikely(x == NULL)) S1	14 years ago
Eric Leblond	c4f9d0e0e1	Fix invalid usage of operator.	14 years ago
Victor Julien	cbeb8a86b7	pcap: fix compilation on old libpcap	14 years ago
Eric Leblond	eaea832a4e	pcap: handle failure of packet treatment ... If the loop is breaked, this means we've got a treatment error. We don't need to reconnect but we must exit with correct status.	14 years ago
Anoop Saldanha	34581ce902	rx TMs shouldn't return TM_ECODE_FAILED if engine is in shutdown mode + minor cleanup	14 years ago
Eric Leblond	0227a87fcb	cleaning: fix warning when building with clang. ... clang was issuing some warnings related to unused return in function. This patch adds some needed error treatment and ignore the rest of the warnings by adding a cast to void.	14 years ago
Anoop Saldanha	bc6cf43840	#482 - use decode_flag for all decode TMs. Use the flag as a way to retrieve decode TMs from ThreadVars	14 years ago
Victor Julien	3181b492f4	pcap: lock pcap_compile and pcap_setfilter calls as they are not thread safe. Fixes issues with bpf filters and multiple interfaces.	14 years ago
Victor Julien	e3f66c52ec	pcap: fix double free issue with bpf filter and multiple interfaces.	14 years ago
Eric Leblond	91f42b6f41	pcap: fix "work by luck" code.	14 years ago
Victor Julien	11bdf4838f	Various improvements to error handling found by Coverity.	15 years ago
Victor Julien	cdba2f50d1	Various fixes and improvements based on feedback by Coverity analyzer.	15 years ago
Victor Julien	c4b34e6ef7	Fix various minor clang/scan-build warnings.	15 years ago
Victor Julien	64f717c880	Set 'livedev' in pcap acquisition module for older libpcap version as well. Fixes a segv.	15 years ago
Victor Julien	d24b3a0e50	Clean up csum detection output, misc fixes.	15 years ago
Eric Leblond	0399a06f4f	pcap: fix typo	15 years ago
Eric Leblond	db5ca0f3a4	pcap: add auto mode support	15 years ago
Eric Leblond	1d1271fd38	pcap: add support for checksum verif mode ... This patch adds support for checksum verification mode. Auto mode is not yet supported.	15 years ago
Victor Julien	6d8aa6829d	Remove unused variable.	15 years ago
Eric Leblond	0d7f25580d	pcap: improve error handling. ... Treat TmThreadsSlotProcessPkt return.	15 years ago
Anoop Saldanha	d68f182ebd	introduce SCPerfSyncCounters/SCPerfSyncCounters macro to synchronize counters	15 years ago
Anoop Saldanha	f7b1972263	update broken stats.log. Use pktacqloop funcs in pcap-file, pfring, pcap-live, af-pkt to sync counters - bug #343	15 years ago
Eric Leblond	45d5c3ca59	runmode: introduce configuration dereferencing. ... A devide configuration can be used by multiple threads. It is thus necessary to wait that all threads stop using the configuration before freeing it. This patch introduces an atomic counter and a free function which has to be called by each thread when it will not use anymore the structure. If the configuration is not used anymore, it is freed by the free function.	15 years ago
Eric Leblond	d3d99ffa13	Fix coding style and use SC* function. ... This patch fixes the coding style and uses Suricata function instead of plain lic version.	15 years ago
Eric Leblond	d3d8beb337	pcap: factorize runmode ... This patch factorizes auto and autofp runmodes for pcap.	15 years ago
Anoop Saldanha	3f1c4efceb	Add new flags var to tm module. TMs can now set flags to identify special properties. Also use these to identify receive TMs	15 years ago
Eric Leblond	de1d002ea6	Return OK when leaving cleanly.	15 years ago
Eric Leblond	2631e5f14f	pcap: get rid of old API.	15 years ago
Eric Leblond	effa295489	pcap: add "single" runmode ... This patch adds support for the "single" mode to the pcap live mode.	15 years ago
Eric Leblond	871b21892a	factorize pcap live device function ... They are not specific to pcap and could thus be used in other module.	15 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	15 years ago
William	61fe05b220	Fix for silly pcap counters mistake made by me. ps_recv includes dropped packets.	15 years ago
Eric Leblond	586aae0ff3	Indentation fix on source-pcap.	15 years ago
Victor Julien	8654469133	Fixing libpcap 0.x.x specific code, take 2.	16 years ago
Victor Julien	c72e5f0ebb	Fix compilation of pcap reopen code for older libpcap code.	16 years ago
Victor Julien	076d77cd80	Add strncpy and strncat to banned function list as we have better replacements: strlcpy and strlcat.	16 years ago
Eric Leblond	fb36c0af12	pcap: do not leave if interface goes down ... This patch changes suricata behaviour to support interface like ppp. Prior to this patch, a suricata listening to an interface was leaving when the interface goes down. This patch modifies the behaviour to automatically reconnect. Suricata retries to open the interface every 0,5s until it succeeds.	16 years ago
Eric Leblond	dd038c1906	Modify files to avoid direct pckt payload access ... This patch implements the needed modification of payload access in a Packet structure to support the abstraction introduced by the extended data system.	16 years ago
Victor Julien	878d3d87db	Add (experimental) support for using multiple pcap devices to acquire packets from. Just passing multiple -i <dev> options on the commandline will activate this. Windows not yet supported.	16 years ago
Victor Julien	4cacb1e970	Disable adding to unregistered mbit/s counter.	16 years ago
Victor Julien	6519a86ec7	Move packet pool to ringbuffer, update packet pool api and ringbuffer api. Remove memset usage from PACKET_RECYCLE, add proper cleanup macros.	16 years ago
Victor Julien	dce323b1f4	Fix SCondWait -> SCCondWait typo.	16 years ago
Pablo Rincon	8cc525c939	UDP support at AppLayer message handling	16 years ago
Victor Julien	329742c10e	Small ip to pcap dev cleanup.	16 years ago
Victor Julien	e3fc53ecb9	Fix a corner case where the pcap receive modules could alloc packets at line rate until memory was depleted.	16 years ago