From 65ae4d732a34dd98a0f91ddd24b6e114a8c7f98d Mon Sep 17 00:00:00 2001
From: Jon Siwek <jsiwek@corelight.com>
Date: Thu, 11 Jun 2020 15:01:06 -0700
Subject: [PATCH] Compare pcap_next_ex() result to PCAP_ERROR/PCAP_ERROR_BREAK

---
 src/iosource/pcap/Source.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc
index e064181d58..897cea0f25 100644
--- a/src/iosource/pcap/Source.cc
+++ b/src/iosource/pcap/Source.cc
@@ -202,12 +202,12 @@ bool PcapSource::ExtractNextPacket(Packet* pkt)
 	int res = pcap_next_ex(pd, &header, &data);
 
 	switch ( res ) {
-	case -2:
+	case PCAP_ERROR_BREAK: // -2
 		// Exhausted pcap file, no more packets to read.
 		assert(! props.is_live);
 		Close();
 		return false;
-	case -1:
+	case PCAP_ERROR: // -1
 		// Error occurred while reading the packet.
 		if ( props.is_live )
 			reporter->Error("failed to read a packet from %s: %s",