]> git.ipfire.org Git - thirdparty/suricata.git/commit
pcap: 32bit counters can wrap-around
authorRoland Fischer <roli@gugus.ca>
Thu, 28 May 2020 05:58:00 +0000 (01:58 -0400)
committerVictor Julien <victor@inliniac.net>
Wed, 15 Jul 2020 04:51:22 +0000 (06:51 +0200)
commit9f1efa3c10291acf5fead882d7ca0568c3d66019
tree2ce646055739f9048ac533ce6d1507c1bc4cf360
parent67e7be633c68ae8a1d85a9197f23ddb6e2124bf6
pcap: 32bit counters can wrap-around

Fixes issue 2845.

pcap_stats is based on 32bit counters and given a big enough throughput
will overflow them. This was reported by people using Myricom cards which
should only be a happenstance. The problem exists for all pcap-based
interfaces.

Let's use internal 64bit counters that drag along the pcap_stats and
handle pcap_stats wrap-around as we update the 64bit stats "often enough"
before the pcap_stats can wrap around twice.
src/source-pcap.c
src/tests/source-pcap.c [new file with mode: 0644]