diff options
author | Jan Andres <jandres@gmx.net> | 2010-09-06 12:47:46 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2010-09-06 12:47:46 +0200 |
commit | baa8426db400f37bc62eb77e7d4ebf87b84b0a87 (patch) | |
tree | 007be03e765b6edd5d8a4e7ea1f916f78bc906c0 /output/pcap/Makefile.am | |
parent | c8830681b465638e0d6698fe82773d025bb9396b (diff) |
pcap: fix packet length handling
Currently, the PCAP output plugin uses ip.totlen to determine both the
"len" and "caplen" pcap header fields, as well as the amount of packet
data written to the file. There are two issues with this:
- For obvious reasons it doesn't work for IPv6.
- AFAICT, in case of an incompletely captured packet (--nflog-range)
it will attempt to write out the whole packet, not just the part
captured.
This patch changes the behavior to:
- Use raw.pktlen to set the "caplen" field, and the amount of data
written.
- Determine the "len" (original length) field from ip.totlen or
ip6.payload_len if possible, default to the same value as "caplen"
otherwise.
Signed-off-by: Jan Andres <jandres@gmx.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'output/pcap/Makefile.am')
0 files changed, 0 insertions, 0 deletions