wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-12-24 13:52:02 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #50 from wader/pcap-ignore-snaplen

Browse Source 
pcap: Don't fail if incl_len > spanlen
This commit is contained in:
Mattias Wadman 2022-01-03 21:32:01 +01:00 committed by GitHub
commit a8620d2cc0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
format/pcap/pcap.go
View File

@ -53,7 +53,7 @@ func decodePcap(d *decode.D, in interface{}) interface{} {
d.FieldU16("version_minor")
d.FieldS32("thiszone")
d.FieldU32("sigfigs")
spanLen := d.FieldU32("snaplen")
d.FieldU32("snaplen")
linkType := int(d.FieldU32("network", format.LinkTypeMap))
fd := flowsdecoder.New()
@ -66,9 +66,14 @@ func decodePcap(d *decode.D, in interface{}) interface{} {
inclLen := d.FieldU32("incl_len")
origLen := d.FieldU32("orig_len")
if inclLen > spanLen {
d.Errorf("incl_len %d > snaplen %d", inclLen, spanLen)
}
// "incl_len: the number of bytes of packet data actually captured and saved in the file. This value should never become larger than orig_len or the snaplen value of the global header"
// "orig_len: the length of the packet as it appeared on the network when it was captured. If incl_len and orig_len differ, the actually saved packet size was limited by snaplen."
// TODO: incl_len seems to be larger than snaplen in real pcap files
// if inclLen > snapLen {
// d.Errorf("incl_len %d > snaplen %d", inclLen, snapLen)
// }
if inclLen > origLen {
d.Errorf("incl_len %d > orig_len %d", inclLen, origLen)
}