netsniff-ng Writing to files stops after 3.7GB

I use latest netsniff-ng under Linux (kernel 4.2.3, 64-bit). The following command line is used: netsniff-ng -i bond0 -s -S 16GiB -o ~/sniff -F 500MiB -f 'host 1.2.3.4'

Writing to file stops after about 3.7GB, and here is the statistics after exiting: 7141894 packets incoming (72008616 unread on exit) 14314860 packets passed filter 64835650 packets failed filter (out of space) 81.9144% packet droprate 10937 sec, 831974 usec in total

This looks lke some kind of bug that prevents writing to file after some size, and then all the packets are considered dropped.

Oct 28 '15 11:10 igvk

Thanks for your report. This looks very similar to #128.

Does the bug still occur if you use a ring size smaller than 5GiB?

Oct 28 '15 12:10 tklauser

I checked with ring size 4GiB, and the problem does not exist.

Oct 28 '15 14:10 igvk

Did the original bug occur on a 32bit or a 64bit system?

On 32bit it might be related to an integer overflow in the ring size (which I'm about to fix).

Oct 29 '15 15:10 tklauser

Never mind. Sorry, didn't read your message careful enough.

Oct 29 '15 15:10 tklauser

Thanks for the report, @igvk! Is this always happening at about 3.7GB or rather randomly after a certain amount of time? In other words, how deterministically reproducible is this bug when using -S 16GiB?

Oct 29 '15 17:10 borkmann

For me, it happened all 3 or 4 times that I tried at almost the same sum of generated file sizes. It doesn't seem to depend on time, because the traffic was different. I ran strace on netsniff-ng, and it showed nothing, and all the files were closed. If you are unable to reproduce it, I may try to do some more testing - please tell me what to check or what to debug.

Oct 29 '15 20:10 igvk

Such problems are almost always connected to uint64_t.

Mar 29 '20 13:03 ValZapod