pcap: add warning about GRO and LRO usage

Use the new GetIfaceOffloading function to display a warning message
if pcap capture is used on Linux with GRO or LRO activated. This is
helpful for kernel after 2.6.31 were pcap will use mmaped capture.
TPACKET_V2 is used and this limit the size of the packet resulting
in truncated packets when merged packets are received.

diff --git a/src/source-pcap.c b/src/source-pcap.c
index caf27ca3cdfb18c2e137c8e7590ed5a701b1fa60..2d2f03657357c7c8ed3522840238af32c4830290 100644 (file)
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -506,6 +506,16 @@ TmEcode ReceivePcapThreadInit(ThreadVars *tv, void *initdata, void **data) {
         SCMutexUnlock(&pcap_bpf_compile_lock);
     }
 
+    /* Making it conditional to Linux even if GetIfaceOffloading return 0
+     * for non Linux. */
+#ifdef HAVE_LINUX_ETHTOOL_H
+    if (GetIfaceOffloading(pcapconfig->iface) == 1) {
+        SCLogWarning(SC_ERR_PCAP_CREATE,
+                "Using Pcap capture with GRO or LRO activated can lead to "
+                "capture problems.");
+    }
+#endif /* HAVE_LINUX_ETHTOOL_H */
+
     ptv->datalink = pcap_datalink(ptv->pcap_handle);
 
     pcapconfig->DerefFunc(pcapconfig);