diff --git a/conanfile.txt b/conanfile.txt index c4fc956e6..dc69654b9 100644 --- a/conanfile.txt +++ b/conanfile.txt @@ -14,6 +14,7 @@ catch2/2.13.4 [options] corrade:with_pluginmanager=True +pcapplusplus:immediate_mode=True [generators] cmake diff --git a/src/inputs/pcap/PcapInputStream.cpp b/src/inputs/pcap/PcapInputStream.cpp index 702b98c08..5a7a01def 100644 --- a/src/inputs/pcap/PcapInputStream.cpp +++ b/src/inputs/pcap/PcapInputStream.cpp @@ -15,6 +15,7 @@ #include #include #include +#include #pragma GCC diagnostic pop #include #include @@ -66,7 +67,8 @@ PcapInputStream::PcapInputStream(const std::string &name) , _tcp_reassembly(_tcp_message_ready_cb, this, _tcp_connection_start_cb, - _tcp_connection_end_cb) + _tcp_connection_end_cb, + {true, 5, 500, 50}) { } @@ -91,6 +93,10 @@ void PcapInputStream::start() return; } + if (config_exists("debug")) { + pcpp::LoggerPP::getInstance().setAllModlesToLogLevel(pcpp::LoggerPP::LogLevel::Debug); + } + // live capture assert(config_exists("iface")); assert(config_exists("bpf")); @@ -320,7 +326,14 @@ void PcapInputStream::_open_libpcap_iface(const std::string &bpfFilter) NOTE: the packet buffer timeout cannot be used to cause calls that read packets to return within a limited period of time, because, on some platforms, the packet buffer timeout isn't supported, and, on other platforms, the timer doesn't start until at least one packet arrives. This means that the packet buffer timeout should NOT be used, for example, in an interactive application to allow the packet capture loop to ``poll'' for user input periodically, as there's no guarantee that a call reading packets will return after the timeout expires even if no packets have arrived. The packet buffer timeout is set with pcap_set_timeout(). */ - config.packetBufferTimeoutMs = 100; + config.packetBufferTimeoutMs = 10; + /* + * @param[in] snapshotLength Snapshot length for capturing packets. Default value is 0 which means use the default value. + * A snapshot length of 262144 should be big enough for maximum-size Linux loopback packets (65549) and some USB packets + * captured with USBPcap (> 131072, < 262144). A snapshot length of 65535 should be sufficient, on most if not all networks, + * to capture all the data available from the packet. + */ + config.snapshotLength = 1000; // try to open device if (!_pcapDevice->open(config)) { @@ -416,4 +429,4 @@ void PcapInputStream::parse_host_spec() } } -} \ No newline at end of file +}