# Suricata 8.0.0 seems to not read pcap files correctly from stdin

**URL:** https://forum.suricata.io/t/suricata-8-0-0-seems-to-not-read-pcap-files-correctly-from-stdin/6016
**Category:** Developers
**Tags:** bug
**Created:** [September 15, 2025, 12:08pm UTC](https://forum.suricata.io/t/suricata-8-0-0-seems-to-not-read-pcap-files-correctly-from-stdin/6016 "2025-09-15T12:08:49Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![wesley.vanderree](https://avatars.discourse-cdn.com/v4/letter/w/858c86/32.png) [@wesley.vanderree](https://forum.suricata.io/u/wesley.vanderree)
#### Post date: [September 15, 2025, 12:08pm UTC](https://forum.suricata.io/t/suricata-8-0-0-seems-to-not-read-pcap-files-correctly-from-stdin/6016/1 "2025-09-15T12:08:50Z")

</div>

Hi Guys,

I’m experiencing some issues when running reading pcaps from stdin. I’m quite sure this was possible in Suricata 7.0.8 and stopped working in Suricata 8.

I have seen at least the following errors in the logs: (2 different pcaps..)

1. [1339269 - W#01] 2025-09-15 11:53:39 Error: pcap: failed to get first packet timestamp. pcap\_next\_ex(): -1
2. [1339611 - W#01] 2025-09-15 11:58:12 Error: pcap: error code -1 invalid packet capture length 745042785, bigger than snaplen of 65535 for /dev/stdin

I have a gut feeling it has something to do with the implementation of the “HAVE\_SETVBUF” patches that are implemented in suricata 8. but I cannot put my finger on the exact issue.

To reproduce you can easily run suricata on any stdin stream:

tcpdump -nr test.pcap -w - | /usr/bin/suricata -r /dev/stdin

Hope this makes more sense for you guys than it did for me, and it can be fixed in a future Suricata release.

Kind regards,

Wesley