Do not trim the FCS, pcaps converted to ERF will have have an FCS.

diff --git a/src/source-erf-dag.c b/src/source-erf-dag.c
index f7f268088ddac0f259a94c938c3b83cf8cef0eb2..04aab9367e2cfaa335a25a7ee5f62dbaf2a405a2 100644 (file)
--- a/src/source-erf-dag.c
+++ b/src/source-erf-dag.c
@@ -483,7 +483,7 @@ static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec)
         SCReturnInt(TM_ECODE_FAILED);
     }
 
-    SET_PKT_LEN(p, wlen - 4);   /* Trim the FCS... */
+    SET_PKT_LEN(p, wlen);
     p->datalink = LINKTYPE_ETHERNET;
 
     /* Take into account for link type Ethernet ETH frame starts

diff --git a/src/source-erf-file.c b/src/source-erf-file.c
index c17d1081168567f89dd851b0182cd2d0b33fb974..8e8b23aa05f4887d0a6bcd273207d7435cd3a218 100644 (file)
--- a/src/source-erf-file.c
+++ b/src/source-erf-file.c
@@ -186,7 +186,7 @@ static inline TmEcode ReadErfRecord(ThreadVars *tv, Packet *p, void *data)
         SCReturnInt(TM_ECODE_FAILED);
     }
 
-    GET_PKT_LEN(p) = wlen - 4; /* Trim the FCS... */
+    GET_PKT_LEN(p) = wlen;
     p->datalink = LINKTYPE_ETHERNET;
 
     /* Convert ERF time to timeval - from libpcap. */