[Oisf-devel] [PATCH 2/2] Auto discovery of default packet size

[Eric Leblond]

If default-packet-size is not set, it is possible in some case to
guess a correct value.

If PCAP or PF_RING are used we are linked to a "physical" interface.
Thus, it is possible to get information about the link MTU and
hardware header size. This give us the ability to auto discover a
decent default-packet-size.
If suricata is running under a different running-mode, it will
default to 1514.
---
 src/suricata.c |   15 +++++++++++++--
 1 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/suricata.c b/src/suricata.c
index 272fd86..16ca311 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -45,6 +45,7 @@
 #include "util-cpu.h"
 #include "util-action.h"
 #include "util-pidfile.h"
+#include "util-ioctl.h"
 
 #include "detect-parse.h"
 #include "detect-engine.h"
@@ -787,8 +788,18 @@ int main(int argc, char **argv)
 
     /* Pull the default packet size from the config, if not found fall
      * back on a sane default. */
-    if (ConfGetInt("default-packet-size", &default_packet_size) != 1)
-        default_packet_size = DEFAULT_PACKET_SIZE;
+    if (ConfGetInt("default-packet-size", &default_packet_size) != 1) {
+        switch (run_mode) {
+            case MODE_PCAP_DEV:
+            case MODE_PFRING:
+                /* find payload for interface and use it */
+                default_packet_size = GetIfaceMaxPayloadSize(pcap_dev);
+                if (default_packet_size)
+                    break;
+            default:
+                default_packet_size = DEFAULT_PACKET_SIZE;
+        }
+    }
     SCLogDebug("Default packet size set to %"PRIiMAX, default_packet_size);
 
     /* Since our config is now loaded we can finish configurating the
-- 
1.7.2.3