Project

General

Profile

Actions
Copy link

Bug #310

closed

Fix thread exit stats for pcap (unsigned int overflow)

Added by Mike Pomraning about 13 years ago. Updated about 13 years ago.

Status:
Closed
Priority:
Low
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

The attached patch corrects source-pcap.c:ReceivePcapThreadExitStats() report of percent packet loss. This small fix may have already reached you via Will Metcalf.

The percentage computation is effectively: (float)dropped / (float)(dropped + received)

However, the dropped + received addition can overflow -- they are each @u_int@s, which are 32-bit unsigned ints on my system.

How to reproduce: blast a few more than 4294967295 packets total at a pcap-listening suricata, and watch the % dropped computation. If you've dropped enough, you might see packet loss > 100%.

Files

suricata-1.1beta2-b3f7e6a-pcap-drop-pct.patch (665 Bytes) suricata-1.1beta2-b3f7e6a-pcap-drop-pct.patch Mike Pomraning, 08/08/2011 04:36 PM
Actions
Copy link

Also available in: Atom PDF