{"record":{"id":"2574c03998848cb9","repo":"probelabs/goreplay","slug":"filters-out-of-range-0-d","errorCode":null,"errorMessage":"filters out of range 0-%d","messagePattern":"filters out of range 0-(.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/capture/sock_linux.go","lineNumber":226,"sourceCode":"func (sock *SockRaw) GetSnapLen() int {\n\tsock.mu.Lock()\n\tdefer sock.mu.Unlock()\n\treturn sock.snaplen\n}\n\n// SetBPFFilter compiles and sets a BPF filter for the socket handle.\nfunc (sock *SockRaw) SetBPFFilter(expr string) error {\n\tsock.mu.Lock()\n\tdefer sock.mu.Unlock()\n\tif expr == \"\" {\n\t\treturn unix.SetsockoptInt(sock.fd, unix.SOL_SOCKET, unix.SO_DETACH_FILTER, 0)\n\t}\n\tfilter, err := pcap.CompileBPFFilter(layers.LinkTypeEthernet, sock.snaplen, expr)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif len(filter) > int(^uint16(0)) {\n\t\treturn fmt.Errorf(\"filters out of range 0-%d\", ^uint16(0))\n\t}\n\tif len(filter) == 0 {\n\t\treturn unix.SetsockoptInt(sock.fd, unix.SOL_SOCKET, unix.SO_DETACH_FILTER, 0)\n\t}\n\tfprog := &unix.SockFprog{\n\t\tLen:    uint16(len(filter)),\n\t\tFilter: &(*(*[]unix.SockFilter)(unsafe.Pointer(&filter)))[0],\n\t}\n\treturn unix.SetsockoptSockFprog(sock.fd, unix.SOL_SOCKET, unix.SO_ATTACH_FILTER, fprog)\n}\n\n// SetPromiscuous sets promiscuous mode to the required value. for better result capture on all interfaces instead.\n// If it is enabled, traffic not destined for the interface will also be captured.\nfunc (sock *SockRaw) SetPromiscuous(b bool) error {\n\tsock.mu.Lock()\n\tdefer sock.mu.Unlock()\n\tmreq := unix.PacketMreq{\n\t\tIfindex: int32(sock.ifindex),","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/probelabs/goreplay/blob/251e45abd242886bb64ff2b2dc98789556b56330/internal/capture/sock_linux.go#L208-L244","documentation":"SetBPFFilter refuses to attach when pcap.CompileBPFFilter returns more instructions than fit in a uint16 (the kernel sock_fprog filter count limit), so the expression is too complex for a classic BPF attachment.","triggerScenarios":"Thrown at internal/capture/sock_linux.go:226 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Simplify the BPF expression (fewer/shorter clauses, use CIDR notation)","Split filtering across a simpler kernel filter plus user-space filtering","Check for generated/loop-built filters that accidentally duplicate clauses"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"251e45abd242886bb64ff2b2dc98789556b56330","analyzedAt":"2026-09-02T16:44:11.369Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}