probelabs/goreplay · error

snapshot length error: %q, interface: %q

Error message

snapshot length error: %q, interface: %q

What it means

PcapHandle computes a snapshot length (default 64KiB+200 when unset) and applies it with inactive.SetSnapLen. Failure is wrapped as "snapshot length error: <err>, interface: <name>". This means libpcap rejected the requested snaplen on the not-yet-activated handle.

Source

Thrown at internal/capture/capture.go:448

	var snap int

	if !l.config.Snaplen {
		infs, _ := net.Interfaces()
		for _, i := range infs {
			if i.Name == ifi.Name {
				snap = i.MTU + 200
			}
		}
	}

	if snap == 0 {
		snap = 64<<10 + 200
	}

	err = inactive.SetSnapLen(snap)
	if err != nil {
		return nil, fmt.Errorf("snapshot length error: %q, interface: %q", err, ifi.Name)
	}
	if l.config.BufferSize > 0 {
		err = inactive.SetBufferSize(int(l.config.BufferSize))
		if err != nil {
			return nil, fmt.Errorf("handle buffer size error: %q, interface: %q", err, ifi.Name)
		}
	}
	if l.config.BufferTimeout == 0 {
		l.config.BufferTimeout = 2000 * time.Millisecond
	}
	err = inactive.SetTimeout(l.config.BufferTimeout)
	if err != nil {
		return nil, fmt.Errorf("handle buffer timeout error: %q, interface: %q", err, ifi.Name)
	}
	handle, err = inactive.Activate()
	if err != nil {
		return nil, fmt.Errorf("PCAP Activate device error: %q, interface: %q", err, ifi.Name)
	}

View on GitHub (pinned to 251e45abd2)

Solutions

1. Validate the snaplen is a positive, sane value (e.g. 1..262144) before calling PcapHandle
2. Use the default (64<<10 + 200) by leaving snap unset unless you need truncation
3. Clamp the configured snaplen to the interface MTU or a maximum of 65535
4. Log the computed snap value to confirm what is being passed

Example fix

// before
snap := cfg.Snaplen // could be -1 from bad config
err = inactive.SetSnapLen(snap)
// after
if snap < 1 || snap > 65535 { snap = 64<<10 + 200 }
err = inactive.SetSnapLen(snap)

if cfg.Snaplen != 0 && (cfg.Snaplen < 1 || cfg.Snaplen > 65535) {
    return fmt.Errorf("snaplen %d out of range 1..65535", cfg.Snaplen)
}

if err != nil && strings.Contains(err.Error(), "snapshot length error") {
    log.Warnf("snaplen rejected, using default: %v", err)
    cfg.Snaplen = 0
    handle, err = l.PcapHandle(ifi)
}

When it happens

Trigger: Calling PcapHandle after l.config.Snaplen-derived value is invalid (e.g. negative, absurdly large, or zero path mishandled) so SetSnapLen fails on the inactive handle.

Common situations: Config supplying a negative or enormous snaplen from a YAML/env value; unit confusion (bits vs bytes); platform limits on snaplen; snaplen unset edge cases in custom builds.

Related errors

• inactive handle error: %q, interface: %q
• %q: supported timestamps: %q, interface: %q
• promiscuous mode error: %q, interface: %q
• handle buffer timeout error: %q, interface: %q
• monitor mode error: %q, interface: %q

AI-assisted analysis of probelabs/goreplay@251e45abd2 (2026-09-02). Data as JSON: /api/errors/c7e48c540fa96368. Report an issue: GitHub.