From a8c08f70fae55a8ddc894dabc064fed5c4541a78 Mon Sep 17 00:00:00 2001 From: Pavel Siska Date: Thu, 6 Feb 2025 15:42:02 +0100 Subject: [PATCH] Parser - Fix packet parsing issue when --with-pcap is enabled Ensure correct packet parsing for input modules like dpdk, dpdk-ring, and nfb when compiled with --with-pcap. Previously, the parser relied on opt->datalink, which these inputs do not set, leading to incorrect layer detection. Now, it correctly defaults to Ethernet when necessary. --- input/parser.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/input/parser.cpp b/input/parser.cpp index 61b696cbf..1b6fd23a6 100644 --- a/input/parser.cpp +++ b/input/parser.cpp @@ -683,25 +683,29 @@ void parse_packet(parser_opt_t *opt, ParserStats& stats, struct timeval ts, cons uint32_t l3_hdr_offset = 0; uint32_t l4_hdr_offset = 0; try { - #ifdef WITH_PCAP - if (opt->datalink == DLT_EN10MB) { +#ifdef WITH_PCAP + if (!opt->datalink || opt->datalink == DLT_EN10MB) { data_offset = parse_eth_hdr(data, caplen, pkt); } else if (opt->datalink == DLT_LINUX_SLL) { data_offset = parse_sll(data, caplen, pkt); - # ifdef DLT_LINUX_SLL2 +# ifdef DLT_LINUX_SLL2 } else if (opt->datalink == DLT_LINUX_SLL2) { data_offset = parse_sll2(data, caplen, pkt); - # endif /* DLT_LINUX_SLL2 */ +# endif /* DLT_LINUX_SLL2 */ } else if (opt->datalink == DLT_RAW) { if ((data[0] & 0xF0) == 0x40) { pkt->ethertype = ETH_P_IP; } else if ((data[0] & 0xF0) == 0x60) { pkt->ethertype = ETH_P_IPV6; } + } else { + stats.unknown_packets++; + DEBUG_MSG("Unknown datalink type %u\n", opt->datalink); + return; } - #else +#else data_offset = parse_eth_hdr(data, caplen, pkt); - #endif /* WITH_PCAP */ +#endif /* WITH_PCAP */ if (pkt->ethertype == ETH_P_TRILL) { data_offset += parse_trill(data + data_offset, caplen - data_offset, pkt);