bammv / sguil

Sguil client for NSM
GNU General Public License v3.0
213 stars 74 forks source link

Fix pcap handling for datalink type RAW #11

Closed inliniac closed 10 years ago

inliniac commented 10 years ago

If the pcaps are of datalink type RAW, the tcpdump command fails: tcpdump: no VLAN support for data link type 12

This error is not caught by the 'catch' in the pipe open though, so to detect this this patch just checks for the expected file to exist. If it doesn't, it's assumed that tcpdump returned error and it will retry without vlan in the bpf string.