From: Jason Ish <jason.ish@endace.com>
Date: Fri, 7 Sep 2012 16:22:38 +0000 (-0600)
Subject: Do not trim the FCS, pcaps converted to ERF will have have an FCS.
X-Git-Tag: suricata-1.4beta2~91
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ea020e2be6d959769681b14525232be4c9f4923a;p=thirdparty%2Fsuricata.git

Do not trim the FCS, pcaps converted to ERF will have have an FCS.
---

diff --git a/src/source-erf-dag.c b/src/source-erf-dag.c
index f7f268088d..04aab9367e 100644
--- a/src/source-erf-dag.c
+++ b/src/source-erf-dag.c
@@ -483,7 +483,7 @@ static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec)
         SCReturnInt(TM_ECODE_FAILED);
     }
 
-    SET_PKT_LEN(p, wlen - 4);   /* Trim the FCS... */
+    SET_PKT_LEN(p, wlen);
     p->datalink = LINKTYPE_ETHERNET;
 
     /* Take into account for link type Ethernet ETH frame starts
diff --git a/src/source-erf-file.c b/src/source-erf-file.c
index c17d108116..8e8b23aa05 100644
--- a/src/source-erf-file.c
+++ b/src/source-erf-file.c
@@ -186,7 +186,7 @@ static inline TmEcode ReadErfRecord(ThreadVars *tv, Packet *p, void *data)
         SCReturnInt(TM_ECODE_FAILED);
     }
 
-    GET_PKT_LEN(p) = wlen - 4; /* Trim the FCS... */
+    GET_PKT_LEN(p) = wlen;
     p->datalink = LINKTYPE_ETHERNET;
 
     /* Convert ERF time to timeval - from libpcap. */