inliniac/suricata — pull request #63 by jasonish (2012-09-07 17:18:17+00:00)
Title: Do not trim the FCS, pcaps converted to ERF will have have an FCS.

Victor, we discussed this some time ago, that Suricata would not have any issues with some trailing data after the IP packet, but I never did provide the required patch. Anyways, this is required to handle ERF files that were converted from pcaps.