Segmentation fault socket_pcap.c Captagent 6.4.1

[Integration-IT]

Hi teams,

version:

6.4.1-25-g57f840c

crash:

Core was generated by `/usr/local/captagent/sbin/captagent'.
Program terminated with signal SIGSEGV, Segmentation fault.

callback_proto at socket_pcap.c:563
...
ethaddr = 0x81 <error: Cannot access memory at address 0x81>
mplsaddr = 0x1045 <error: Cannot access memory at address 0x1045>
...

Probably related #271

[kYroL01]

Hi @Integration-IT Thanks for reporting it.
Does this traffic have a tunnel ?
Any additional information is important.
Thank you

[Integration-IT]

Hi @kYroL01 ,

Since socket_pcap.xml, param dev, changed from "any" to real "INTERFACE NAME", no more crash.

[kYroL01]

Hi @Integration-IT That's something to keep in mind.
As a general rule, I always suggest to put the real interface name when it's possible, especially because now, for any the Linux cooked layer (aka SLL) of 16 bytes is not unique anymore, but there's also the Linux cooked layer II (aka SLL2) of 20 bytes.
Unfortunately the libpcap still has some issues with this decoding, so I will have to add it manually in the future.

Thank you!