Skip to content

decode/sll2: Support PCAPs encoded with Linux SLL ver 2 #13308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

jlucovsky
Copy link
Contributor

Support Linux Cooked mode v2 -- DLT 276

Link to ticket: https://redmine.openinfosecfoundation.org/issues/

Describe changes:

  • Add SLL2 linktype
  • Recognize and decode SLL2 frames.

Provide values to any of the below to override the defaults.

  • To use a Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2523
SU_REPO=
SU_BRANCH=

Support Linux Cooked mode v2 -- DLT 276
@jlucovsky jlucovsky requested review from victorjulien and a team as code owners May 24, 2025 15:31
@suricata-qa
Copy link

ERROR:
ERROR: buid failure for build_fetch QA build

ERROR: QA failed on build_fetch.

Pipeline 26209

Copy link

codecov bot commented May 24, 2025

Codecov Report

Attention: Patch coverage is 72.72727% with 6 lines in your changes missing coverage. Please review.

Project coverage is 83.42%. Comparing base (b4095bf) to head (f7048c8).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #13308      +/-   ##
==========================================
+ Coverage   83.41%   83.42%   +0.01%     
==========================================
  Files         995      997       +2     
  Lines      272813   272835      +22     
==========================================
+ Hits       227558   227617      +59     
+ Misses      45255    45218      -37     
Flag Coverage Δ
fuzzcorpus 62.06% <4.54%> (+0.02%) ⬆️
livemode 18.94% <4.54%> (-0.01%) ⬇️
pcap 44.90% <72.72%> (-0.02%) ⬇️
suricata-verify 65.01% <72.72%> (+0.02%) ⬆️
unittests 59.25% <0.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@@ -5762,6 +5762,15 @@
}
}
},
"sll2": {
"type": "object",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Perhaps we should add description as well.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will do.

@jlucovsky
Copy link
Contributor Author

Continued in #13320

@jlucovsky jlucovsky closed this May 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants