From: Eric Leblond <eric@regit.org>
Date: Wed, 20 Nov 2013 10:47:28 +0000 (+0100)
Subject: pcap: add warning about GRO and LRO usage
X-Git-Tag: suricata-2.0beta2~135
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=286258df86dcd710ab9f9b843154f7c450662e5d;p=thirdparty%2Fsuricata.git

pcap: add warning about GRO and LRO usage

Use the new GetIfaceOffloading function to display a warning message
if pcap capture is used on Linux with GRO or LRO activated. This is
helpful for kernel after 2.6.31 were pcap will use mmaped capture.
TPACKET_V2 is used and this limit the size of the packet resulting
in truncated packets when merged packets are received.
---

diff --git a/src/source-pcap.c b/src/source-pcap.c
index caf27ca3cd..2d2f036573 100644
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -506,6 +506,16 @@ TmEcode ReceivePcapThreadInit(ThreadVars *tv, void *initdata, void **data) {
         SCMutexUnlock(&pcap_bpf_compile_lock);
     }
 
+    /* Making it conditional to Linux even if GetIfaceOffloading return 0
+     * for non Linux. */
+#ifdef HAVE_LINUX_ETHTOOL_H
+    if (GetIfaceOffloading(pcapconfig->iface) == 1) {
+        SCLogWarning(SC_ERR_PCAP_CREATE,
+                "Using Pcap capture with GRO or LRO activated can lead to "
+                "capture problems.");
+    }
+#endif /* HAVE_LINUX_ETHTOOL_H */
+
     ptv->datalink = pcap_datalink(ptv->pcap_handle);
 
     pcapconfig->DerefFunc(pcapconfig);