Writing to files stops after 3.7GB

[igvk]

I use latest netsniff-ng under Linux (kernel 4.2.3, 64-bit).
The following command line is used:
netsniff-ng -i bond0 -s -S 16GiB -o ~/sniff -F 500MiB -f 'host 1.2.3.4'

Writing to file stops after about 3.7GB, and here is the statistics after exiting:
7141894 packets incoming (72008616 unread on exit)
14314860 packets passed filter
64835650 packets failed filter (out of space)
81.9144% packet droprate
10937 sec, 831974 usec in total

This looks lke some kind of bug that prevents writing to file after some size, and then all the packets are considered dropped.

[tklauser]

Thanks for your report. This looks very similar to #128.

Does the bug still occur if you use a ring size smaller than 5GiB?

[igvk]

I checked with ring size 4GiB, and the problem does not exist.

[tklauser]

Did the original bug occur on a 32bit or a 64bit system?

On 32bit it might be related to an integer overflow in the ring size (which I'm about to fix).

[tklauser]

Never mind. Sorry, didn't read your message careful enough.

[borkmann]

Thanks for the report, @igvk! Is this always happening at about 3.7GB or rather randomly after a certain amount of time? In other words, how deterministically reproducible is this bug when using -S 16GiB?

[igvk]

For me, it happened all 3 or 4 times that I tried at almost the same sum of generated file sizes.
It doesn't seem to depend on time, because the traffic was different.
I ran strace on netsniff-ng, and it showed nothing, and all the files were closed.
If you are unable to reproduce it, I may try to do some more testing - please tell me what to check or what to debug.