dpdk: recognize net_pcap driver and stop after no packets are rx_bursted

[Copilot]

DPDK with net_pcap driver remained stuck in RX loop after PCAP file exhaustion, requiring timeout workarounds. This implements automatic EOF detection and graceful per-interface shutdown.

Implementation

Driver Detection

• Store driver name from dev_info->driver_name during config load
• Auto-enable PCAP file mode for net_pcap, configurable via pcap-file-mode: true/false

EOF Detection

• Track consecutive zero-packet polls per thread (pcap_file_mode_zero_poll_count)
• Exit receive loop after 100 consecutive rte_eth_rx_burst() calls returning 0 packets
• Modified RXPacketCountHeuristic() to return -1 on EOF, triggering clean loop exit

Per-Interface Behavior

• Each interface tracks and exits independently
• Flow tables and state preserved until process shutdown
• No impact on non-PCAP interfaces (physical NICs, net_null, etc.)

Configuration

dpdk:
  eal-params:
    vdev: 'net_pcap0,rx_pcap=/path/to/capture.pcap'
  interfaces:
    - interface: net_pcap0
      # pcap-file-mode auto-detected for net_pcap driver
      # or explicitly set: pcap-file-mode: true

Files Changed

Core (56 lines):

• src/source-dpdk.{h,c} - EOF detection in receive loop
• src/runmode-dpdk.{h,c} - Config parsing and driver detection

Documentation (612 lines):

• doc/userguide/capture-hardware/dpdk.rst - User-facing PCAP file mode section
• doc/dpdk-pcap-{implementation,test-cases}.md - Technical details and test procedures

Test Configs (163 lines):

• Single PCAP: .github/workflows/dpdk/suricata-pcap-single.yaml
• Multiple PCAPs: .github/workflows/dpdk/suricata-pcap-multiple.yaml
• Mixed types: .github/workflows/dpdk/suricata-pcap-mixed.yaml

Notes

• Threshold of 100 polls balances quick EOF detection vs avoiding false positives from packet gaps
• Disable for streaming PCAPs: pcap-file-mode: false
• Backward compatible - no changes required for existing configs
• CodeQL: 0 vulnerabilities

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.