diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek index 277bab9cc0..b5a629d9ad 100644 --- a/scripts/base/init-bare.zeek +++ b/scripts/base/init-bare.zeek @@ -4989,12 +4989,10 @@ export { ## of ``127.0.0.1`` or ``[::1]`` are used by loopback interfaces. is_loopback: bool; - extended_flags: bool &default=F; - # If the "extended_flags" field is set to T, then these next two - # flags will have valid settings. Otherwise, the following - # two fields are explicitly false. - is_up: bool &default=F; - is_running: bool &default=F; + ## Whether the device is up. Not set when that info is unavailable. + is_up: bool &optional; + ## Whether the device is running. Not set when that info is unavailable. + is_running: bool &optional; }; type Interfaces: set[Pcap::Interface]; diff --git a/src/iosource/pcap/pcap.bif b/src/iosource/pcap/pcap.bif index 089c77779b..b694330bc7 100644 --- a/src/iosource/pcap/pcap.bif +++ b/src/iosource/pcap/pcap.bif @@ -111,11 +111,17 @@ function findalldevs%(%): Pcap::Interfaces pcap_if_t *alldevs, *d; char errbuf[PCAP_ERRBUF_SIZE]; - int ret = pcap_findalldevs(&alldevs, errbuf); - static auto ifaces_type = id::find_type("Pcap::Interfaces"); auto pcap_interfaces = make_intrusive(ifaces_type); + int ret = pcap_findalldevs(&alldevs, errbuf); + if ( ret == PCAP_ERROR ) + { + emit_builtin_error(util::fmt("Error calling pcap_findalldevs: %s", errbuf)); + // Return an empty set in case of failure. + return pcap_interfaces; + } + static auto iface_type = id::find_type("Pcap::Interface"); for ( d=alldevs; d; d=d->next ) { @@ -142,9 +148,9 @@ function findalldevs%(%): Pcap::Interfaces r->Assign(2, addrs->ToSetVal()); r->Assign(3, val_mgr->Bool(d->flags & PCAP_IF_LOOPBACK)); #ifdef PCAP_IF_UP - r->Assign(4, val_mgr->True()); // <-- "extended" vals set. - r->Assign(5, val_mgr->Bool(d->flags & PCAP_IF_UP)); - r->Assign(6, val_mgr->Bool(d->flags & PCAP_IF_RUNNING)); + // These didn't become available until libpcap 1.6.1 + r->Assign(4, val_mgr->Bool(d->flags & PCAP_IF_UP)); + r->Assign(5, val_mgr->Bool(d->flags & PCAP_IF_RUNNING)); #endif pcap_interfaces->Assign(std::move(r), nullptr);