Hello,

when I try to load the pf_ring.ko Kernelmodule I receive the following error.

root@linaro-nano:/lib/modules/3.18.0-00257-g034e7cb/kernel/net# ls
bridge  pf_ring
root@linaro-nano:/lib/modules/3.18.0-00257-g034e7cb/kernel/net# modprobe pf_ring
[ 1944.840226] pf_ring: version magic '3.18.0-00257-g034e7cb mod_unload ARMv5 p2v8 ' should be '3.18.0-00257-g034e7cb SMP mod_unload ARMv7 p2v8 '
modprobe: ERROR: could not insert 'pf_ring': Exec format error

I nearly tried everything to fix the version magic from kernel compilation side. Could it be a problem with the pf_ring Kernelmodule Makefile?

[idf@node2 examples]$ make
gcc -march=corei7 -mtune=corei7 -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins -I../lib -I../libpcap -Ithird-party -D HAVE_ZERO -D ENABLE_BPF -D HAVE_LIBNUMA -O2 pfcount.o ../libpcap/libpcap.a ../lib/libpfring.a ../libpcap/libpcap.a ../lib/libpfring.a -lpthread -lrt -lnuma -lrt -o pfcount
../libpcap/libpcap.a(grammar.o): In function pcap_parse': /mnt/gluster/Downloads/PF_RING/userland/libpcap/y.tab.c:2183: undefined reference topcap_lex'
collect2: error: ld returned 1 exit status
make: *** [pfcount] Error 1
[idf@node2 examples]$

Hello!

Please fix zcount code looks like you need add i variable definition on line 219.

make
gcc -O2 -Wall -march=corei7 -mtune=corei7  -I../lib -I../../kernel -c zcount.c -o zcount.o
zcount.c: In function ‘packet_consumer_thread’:
zcount.c:238:9: error: ‘n’ undeclared (first use in this function)
     if((n = pfring_zc_recv_pkt_burst(zq, buffers, BURST_LEN, wait_for_packet)) > 0) {
         ^
zcount.c:238:9: note: each undeclared identifier is reported only once for each function it appears in
zcount.c:241:14: error: ‘i’ undeclared (first use in this function)
         for (i = 0; i < n; i++) 
              ^
Makefile:31: recipe for target 'zcount.o' failed
make: *** [zcount.o] Error 1

hey guys, saw that 6.1.1 rpms were pushed to the centos repo, are you going to update github source to 6.1.1 as well?

please update the igb and e1000e drivers there are some issues on debian. i updated them here:
https://github.com/brammittendorff/PF_RING/tree/master/drivers/DNA

Hello, folks!

PF_RING ZC do not clean hugemem pages after ZC enabled application shutdown.

First run:

./fastnetmon
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150325 for eth4 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
# We're now working in demo mode with packet capture and          
# transmission limited to 5 minutes
#########################################################################
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150325 for eth4 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################

Hit CTR+C

Second run, error:

./fastnetmon
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150325 for eth4 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
# We're now working in demo mode with packet capture and          
# transmission limited to 5 minutes
#########################################################################
 *** error retrieving hugepages info ***

Memory:

ls -la /dev/hugepages/
total 128M
drwxr-xr-x  2 root root    0 May 13 11:52 .
drwxr-xr-x 19 root root 3.3K May 13 11:47 ..
-rwxr-xr-x  1 root root 128M May 13 11:52 pfring_zc_0

Remove wasted file:

rm -f /dev/hugepages/pfring_zc_0 

And run again - success:

./fastnetmon
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150325 for eth4 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
# We're now working in demo mode with packet capture and          
# transmission limited to 5 minutes
#########################################################################
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150325 for eth4 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################

Hello!

Env: Debian 8 3.16 inside KVM VM. NIC: 82599. ixgbe driver. I tried to run my application with ZC api and specified interface as: zc: eth5. PF_RING 6.0.3.

After run my kernel go away:

PF_RING (vanilla) version 6.0.2 causes a kernel panic when capturing live data on Linux. The panic happened when using it with kernel version 3.13.11.4.

The kernel panic seems not to be related to any particular operation (i.e., inserting the kernel module, removing the module or bringing a network interface up or down), it just happens out of the blue.

Release notes of PF_RING 6.0.3 give no indication that a new release fixes the issue.

.

It looks to me quite basic for filtering I/S to provide simple user-space APIs to count the miss/match packets.
For more info, please refer to: http://www.gossamer-threads.com/lists/ntop/misc/40149

I thought this might be a duplicate of #28 but this is on 6.0.3 and happens even if I remove the pf_ring kernel module. Wether I use bro (which I compiled against the RPM-provided libpcap) or tcpdump (from the CentOS repos), the dynamic linker pushes them through /usr/local/lib/libpcap.so.1.6.2. When I rename that shared lib, tcpdump uses the system libpcap and it works just fine, whether the module is loaded or not.

I've tried running 6.1.1 on this kernel, which doesn't crash, but I get terrible packet loss when going through libpcap, but that is a different issue (that I'll file when I get a chance to run it to ground).

So the culprit seems to be libpcap 1.6.2. I'd like to stick to PF_RING 6.0.3 if I can for stability and performance. I'm happy to provide more info or dig into crash dumps more if needed.

System Info (from crash tool)

This GDB was configured as "x86_64-unknown-linux-gnu"...

      KERNEL: /usr/lib/debug/lib/modules/3.10.0-229.el7.x86_64/vmlinux
    DUMPFILE: /var/crash/127.0.0.1-2015.10.20-22:22:58/vmcore  [PARTIAL DUMP]
        CPUS: 24
        DATE: Tue Oct 20 22:22:51 2015
      UPTIME: 00:16:49
LOAD AVERAGE: 0.00, 0.01, 0.04
       TASKS: 355
    NODENAME: reciever2
     RELEASE: 3.10.0-229.el7.x86_64
     VERSION: #1 SMP Fri Mar 6 11:36:42 UTC 2015
     MACHINE: x86_64  (2300 Mhz)
      MEMORY: 128 GB
       PANIC: ""
         PID: 35
     COMMAND: "rcuos/0"
        TASK: ffff8810297a8b60  [THREAD_INFO: ffff8810297b4000]
         CPU: 1
       STATE: TASK_RUNNING (PANIC)

dmesg

[  691.218347] [PF_RING] Module unloaded
[  843.251621] [PF_RING] Welcome to PF_RING 6.0.3 ($Revision: 6.0.3-stable:8994076d9761315040ed29a0d5825cb74c20c078$)
               (C) 2004-14 ntop.org
[  843.251654] [PF_RING] registered /proc/net/pf_ring/
[  843.251656] NET: Registered protocol family 27
[  843.251666] [PF_RING] Min # ring slots 4096
[  843.251667] [PF_RING] Slot version     16
[  843.251668] [PF_RING] Capture TX       Yes [RX+TX]
[  843.251669] [PF_RING] IP Defragment    No
[  843.251670] [PF_RING] Initialized correctly
[ 1008.709269] device eno3 entered promiscuous mode
[ 1008.727969] general protection fault: 0000 [#1] SMP
[ 1008.727998] Modules linked in: pf_ring(OF) xt_conntrack ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype iptable_filter ip_tables nf_nat nf_conntrack bridge stp llc dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio loop intel_powerclamp coretemp iTCO_wdt iTCO_vendor_support intel_rapl kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd sb_edac ses edac_core serio_raw pcspkr mei_me enclosure mei lpc_ich i2c_i801 mfd_core ipmi_si ipmi_msghandler ioatdma ntb shpchp wmi xfs libcrc32c sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt drm_kms_helper ttm isci igb drm ixgbe(OF) vxlan libsas ahci ip_tunnel ptp libahci scsi_transport_sas
[ 1008.728336]  pps_core dca libata i2c_algo_bit aacraid i2c_core dm_mirror dm_region_hash dm_log dm_mod [last unloaded: pf_ring]
[ 1008.728386] CPU: 1 PID: 35 Comm: rcuos/0 Tainted: GF          O--------------   3.10.0-229.el7.x86_64 #1
[ 1008.728421] Hardware name: Supermicro X9DRW-3LN4F+/X9DRW-3TF+/X9DRW-3LN4F+/X9DRW-3TF+, BIOS 3.0a 02/06/2014
[ 1008.728458] task: ffff8810297a8b60 ti: ffff8810297b4000 task.ti: ffff8810297b4000
[ 1008.728485] RIP: 0010:[<ffffffff8106a802>]  [<ffffffff8106a802>] bpf_jit_free+0x22/0x50
[ 1008.728520] RSP: 0018:ffff8810297b7df0  EFLAGS: 00010203
[ 1008.728541] RAX: 0000000fffffffe0 RBX: ffff882014f90280 RCX: dead000000200200
[ 1008.728567] RDX: 636e753a755f6465 RSI: 0000000000000283 RDI: 0000000000001400
[ 1008.728594] RBP: ffff8810297b7e08 R08: ffff8810297b7e80 R09: 0000000000000008
[ 1008.728620] R10: 0000000000000004 R11: 0000000000000005 R12: 0000000000000000
[ 1008.728646] R13: 0000000000000000 R14: 0000000000000000 R15: ffff882014f90290
[ 1008.728673] FS:  0000000000000000(0000) GS:ffff88103fc20000(0000) knlGS:0000000000000000
[ 1008.728703] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1008.728724] CR2: 00007fa4edc8a000 CR3: 000000000190a000 CR4: 00000000000407e0
[ 1008.728751] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1008.728777] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 1008.728803] Stack:
[ 1008.728813]  ffff8810297b7e08 ffffffff81510406 ffff882014f90290 ffff8810297b7ec0
[ 1008.728847]  ffffffff81113239 ffff8810297a8b60 ffff8810297a8b60 ffff88103fc0df50
[ 1008.728880]  ffff8810297b7e80 ffff8810297a8b60 ffff88103fc0df28 ffff88103fc0df38
[ 1008.728913] Call Trace:
[ 1008.728928]  [<ffffffff81510406>] ? sk_filter_release_rcu+0x16/0x30
[ 1008.728955]  [<ffffffff81113239>] rcu_nocb_kthread+0x229/0x370
[ 1008.728979]  [<ffffffff81098350>] ? wake_up_bit+0x30/0x30
[ 1008.729002]  [<ffffffff81113010>] ? rcu_start_gp+0x40/0x40
[ 1008.729023]  [<ffffffff8109739f>] kthread+0xcf/0xe0
[ 1008.729044]  [<ffffffff810972d0>] ? kthread_create_on_node+0x140/0x140
[ 1008.729071]  [<ffffffff8161497c>] ret_from_fork+0x7c/0xb0
[ 1008.729092]  [<ffffffff810972d0>] ? kthread_create_on_node+0x140/0x140
[ 1008.729117] Code: 84 e9 94 fa ff ff 0f 1f 00 66 66 66 66 90 48 8b 57 08 48 81 fa b0 07 51 81 74 37 48 b8 e0 ff ff ff 0f 00 00 00 55 bf 00 14 00 00 <48> 89 02 48 8d 42 08 48 8b 35 58 74 9b 00 48 89 e5 48 c7 42 18
[ 1008.729246] RIP  [<ffffffff8106a802>] bpf_jit_free+0x22/0x50
[ 1008.729270]  RSP <ffff8810297b7df0>

Backtrace

PID: 35     TASK: ffff8810297a8b60  CPU: 1   COMMAND: "rcuos/0"
 #0 [ffff8810297b7b90] machine_kexec at ffffffff8104c681
 #1 [ffff8810297b7be8] crash_kexec at ffffffff810e2222
 #2 [ffff8810297b7cb8] oops_end at ffffffff8160d188
 #3 [ffff8810297b7ce0] die at ffffffff810173eb
 #4 [ffff8810297b7d10] do_general_protection at ffffffff8160ca8e
 #5 [ffff8810297b7d40] general_protection at ffffffff8160c3a8
    [exception RIP: bpf_jit_free+34]
    RIP: ffffffff8106a802  RSP: ffff8810297b7df0  RFLAGS: 00010203
    RAX: 0000000fffffffe0  RBX: ffff882014f90280  RCX: dead000000200200
    RDX: 636e753a755f6465  RSI: 0000000000000283  RDI: 0000000000001400
    RBP: ffff8810297b7e08   R8: ffff8810297b7e80   R9: 0000000000000008
    R10: 0000000000000004  R11: 0000000000000005  R12: 0000000000000000
    R13: 0000000000000000  R14: 0000000000000000  R15: ffff882014f90290
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #6 [ffff8810297b7df8] sk_filter_release_rcu at ffffffff81510406
 #7 [ffff8810297b7e10] rcu_nocb_kthread at ffffffff81113239
 #8 [ffff8810297b7ec8] kthread at ffffffff8109739f
 #9 [ffff8810297b7f50] ret_from_fork at ffffffff8161497c

Hi,

tried to install pf_ring w/ 2 Intel 82571EB giga nics on ubuntu 14.04 server.
following README.FRIST, i can successfully load pf_ring modules, but when i complie e1000e driver(in folder "/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src"), i got error when enter "make" command. error log below.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
mark@PfRing-1:~/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$ make
make -C /lib/modules/3.19.0-30-generic/build SUBDIRS=/home/mark/PF_RING/PF_RING/drivers/ZC/intel/e1000e/e1000e-3.0.4.1-zc/src modules
make[1]: Entering directory /usr/src/linux-headers-3.19.0-30-generic' CC [M] /home/mark/PF_RING/PF_RING/drivers/ZC/intel/e1000e/e1000e-3.0.4.1-zc/src/netdev.o In file included from ./arch/x86/include/asm/apic.h:5:0, from ./arch/x86/include/asm/smp.h:12, from ./arch/x86/include/asm/mmzone_64.h:10, from ./arch/x86/include/asm/mmzone.h:4, from include/linux/mmzone.h:912, from include/linux/gfp.h:5, from include/linux/kmod.h:22, from include/linux/module.h:13, from /home/mark/PF_RING/PF_RING/drivers/ZC/intel/e1000e/e1000e-3.0.4.1-zc/src/netdev.c:25: /home/mark/PF_RING/PF_RING/drivers/ZC/intel/e1000e/e1000e-3.0.4.1-zc/src/netdev.c:8586:21: error: 'e1000e_pm_runtime_suspend' undeclared here (not in a function) SET_RUNTIME_PM_OPS(e1000e_pm_runtime_suspend, e1000e_pm_runtime_resume, ^ include/linux/pm.h:347:21: note: in definition of macro 'SET_RUNTIME_PM_OPS' .runtime_suspend = suspend_fn, \ ^ /home/mark/PF_RING/PF_RING/drivers/ZC/intel/e1000e/e1000e-3.0.4.1-zc/src/netdev.c:8586:48: error: 'e1000e_pm_runtime_resume' undeclared here (not in a function) SET_RUNTIME_PM_OPS(e1000e_pm_runtime_suspend, e1000e_pm_runtime_resume, ^ include/linux/pm.h:348:20: note: in definition of macro 'SET_RUNTIME_PM_OPS' .runtime_resume = resume_fn, \ ^ /home/mark/PF_RING/PF_RING/drivers/ZC/intel/e1000e/e1000e-3.0.4.1-zc/src/netdev.c:8587:7: error: 'e1000e_pm_runtime_idle' undeclared here (not in a function) e1000e_pm_runtime_idle) ^ include/linux/pm.h:349:18: note: in definition of macro 'SET_RUNTIME_PM_OPS' .runtime_idle = idle_fn, ^ make[2]: *** [/home/mark/PF_RING/PF_RING/drivers/ZC/intel/e1000e/e1000e-3.0.4.1-zc/src/netdev.o] Error 1 make[1]: *** [_module_/home/mark/PF_RING/PF_RING/drivers/ZC/intel/e1000e/e1000e-3.0.4.1-zc/src] Error 2 make[1]: Leaving directory/usr/src/linux-headers-3.19.0-30-generic'
make: *** [default] Error 2

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[verify status:]

mark@PfRing-1:~/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$ ethtool -i eth1
driver: e1000e
version: 3.2.4.2-NAPI
firmware-version: 5.11-2
bus-info: 0000:0b:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no

mark@PfRing-1:/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$ ethtool -i eth2
driver: e1000e
version: 3.2.4.2-NAPI
firmware-version: 5.11-2
bus-info: 0000:0b:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no
mark@PfRing-1:/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$
mark@PfRing-1:/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$
mark@PfRing-1:/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$
mark@PfRing-1:~/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$

mark@PfRing-1:lsmod|grep pf
pf_ring 712704 0

mark@PfRing-1:/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$
mark@PfRing-1:/PF_RING/PF_RING/drivers/PF_RING_aware/intel/e1000e/e1000e-3.0.4.1-zc/src$ cd /proc/net/pf_ring/
mark@PfRing-1:/proc/net/pf_ring$ ls
dev info plugins_info stats
mark@PfRing-1:/proc/net/pf_ring$ more info
PF_RING Version : 6.1.1 (dev:dc0e2f14547baf3ab5b29d2c10347a40d541e442)
Total rings : 0

Standard (non DNA/ZC) Options
Ring slots : 4096
Slot version : 16
Capture TX : Yes [RX+TX]
IP Defragment : No
Socket Mode : Standard
Total plugins : 0
Cluster Fragment Queue : 0
Cluster Fragment Discard : 0
mark@PfRing-1:/proc/net/pf_ring$ cd dev
mark@PfRing-1:/proc/net/pf_ring/dev$ ls
eth0 eth1 eth2
mark@PfRing-1:/proc/net/pf_ring/dev$ cat eth1/info
Name: eth1
Index: 9
Address: 00:26:55:DF:2C:8C
Polling Mode: NAPI
Type: Ethernet
Family: Standard NIC

Bound Sockets: 0

Max # TX Queues: 1

Used RX Queues: 1

mark@PfRing-1:/proc/net/pf_ring/dev$ cat eth2/info
Name: eth2
Index: 10
Address: 00:26:55:DF:2C:8D
Polling Mode: NAPI
Type: Ethernet
Family: Standard NIC

Bound Sockets: 0

Max # TX Queues: 1

Used RX Queues: 1

can anyone kindly tell how to fix it?

Thanks
mark

Hello, folks!

I have problems with GIT version of PF_RING. I have ixgbe and Debian Jessie with 3.16 kernel.

I installed PF_RING, build libs and modules and run driver with ./load_module and everything worker perfectly.

But my tool bound to single CPU core:

1  [|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||100.0%]     Tasks: 37, 98 thr, 71 kthr; 2 running
  2  [||                                                           1.9%]     Load average: 2.36 2.07 1.72 
  3  [|||                                                          3.4%]     Uptime: 00:35:50
  4  [|                                                            0.9%]
  Mem[||||                                                  688/32205MB]
  Swp[                                                         0/8190MB]

So, I switched:insmod ./ixgbe.ko RSS=1,1,1, To:``insmod ./ixgbe.ko RSS=4,4,4,4`

And call ./load_module again. After this changes I can't saw any traffic on this interface.

And zcount show following:

./zcount -i zc:eth4 -c 0
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150325 for eth4 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
# We're now working in demo mode with packet capture and          
# transmission limited to 5 minutes
#########################################################################
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150325 for eth4 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
=========================
Absolute Stats: 0 pkts (14'832'738 drops) - 0 bytes
=========================

=========================
Absolute Stats: 0 pkts (29'662'683 drops) - 0 bytes
Actual Stats: 0.00 pps (14'828'803.18 drops) - 0.00 Gbps
=========================

=========================
Absolute Stats: 0 pkts (44'493'780 drops) - 0 bytes
Actual Stats: 0.00 pps (14'828'931.97 drops) - 0.00 Gbps
=========================

=========================
Absolute Stats: 0 pkts (59'324'327 drops) - 0 bytes
Actual Stats: 0.00 pps (14'829'612.73 drops) - 0.00 Gbps
=========================

=========================
Absolute Stats: 0 pkts (74'157'039 drops) - 0 bytes
Actual Stats: 0.00 pps (14'830'754.34 drops) - 0.00 Gbps

Btw, my toolkit internal stats show something similar:

PF_RING ZC in queue statistics
Received:       0
Sent:           0
Dropped:        1209057743
Dropped:        0.00 %

Code:

       int stats_res = pfring_zc_stats(inzq[0], &stats);

        if (stats_res) {
            logger<<log4cpp::Priority::ERROR<<"Can't get PF_RING ZC stats for in queue";
        } else {
            double dropped_percent = 0;

            if (stats.recv + stats.sent > 0) {    
                dropped_percent = (double)stats.drop / ((double)stats.recv + (double)stats.sent) * 100;
            }

            output_buffer<<"\n";
            output_buffer<<"PF_RING ZC in queue statistics\n";
            output_buffer<<"Received:\t"<<stats.recv<<"\n";
            output_buffer<<"Sent:\t\t"<<stats.sent<<"\n";
            output_buffer<<"Dropped:\t"<<stats.drop<<"\n";
            output_buffer<<"Dropped:\t"<<std::fixed << std::setprecision(2)<<dropped_percent<<" %\n";
        }

It would be great if zsend, like pfsend, could be configured to send a pcap file. I would prefer this file to be sent recursively or at least, be able to configure how many times it could be sent (with the possibility to be infinitely sent).

Thanks and best regards

PS: Sorry, I don't know how to tag/label this issue as an Enhancement or Feature Request or something similar

Modern accelerated NICs include a feature called packet slicing. Even though commodity NICs do not support it, it is necessary to add support for slicing so that PF_RING-based apps can benefit from it. The API call should take (at least) a parameter that specifies at what level slicing will take place (L3, L4....)

I am ddwrt user and some time ago ddwrt developers drop using l7 filters and started using nDPI with iptables (for marking-matching traffic for QoS and Access Restriction purposes). I am not developer nor the network guru. Just simple SOHO user with very basic understanding of routers.
ddwrt has big community and now we have problem because some nDPI protocols (filters) do not work. ddwrt devs says it is not ddwrt problem. Youtube, Steam do not work... my finfings about this problem are here in bug report on ddwrt TRAC http://svn.dd-wrt.com/ticket/4117#comment:7
If I can provide more informations I would be happy, just to solve this issue. Thx for your work on nDPI it is already great!

I try a zc cluster with tho network cards: one with ixgbe driver and one with e1000e. I receive a traffic from 10G interface and send them into 3 1G interfaces. I balance user load by cores, but system interrupts still in first core:

%Cpu0  : 46,3 us,  0,3 sy,  0,0 ni,  0,0 id,  0,0 wa,  0,0 hi, 53,3 si,  0,0 st
%Cpu1  : 66,4 us,  3,5 sy,  0,0 ni, 30,1 id,  0,0 wa,  0,0 hi,  0,0 si,  0,0 st
%Cpu2  : 65,2 us,  5,1 sy,  0,0 ni, 29,7 id,  0,0 wa,  0,0 hi,  0,0 si,  0,0 st
%Cpu3  : 65,8 us,  3,8 sy,  0,0 ni, 30,5 id,  0,0 wa,  0,0 hi,  0,0 si,  0,0 st

Is a way to balance a system interrupts by cores too?

Hello, folks!

I'm working on cross-distribution PF_RING packaging and I want to use custom pcap and libnuma instead bundled with distribution. But I can't find any options in PF_RING library configure system which allow this for me.

Are you interested in this option?

[ 257.126292] [PF_RING] Welcome to PF_RING 6.1.1 ($Revision: dev:c294956bff608bbdddd2a00810ad37f538df6dea$)
(C) 2004-14 ntop.org
[ 257.126304] [PF_RING] registered /proc/net/pf_ring/
[ 257.126305] NET: Registered protocol family 27
[ 257.126314] [PF_RING] Min # ring slots 4096
[ 257.126314] [PF_RING] Slot version 16
[ 257.126315] [PF_RING] Capture TX Yes [RX+TX]
[ 257.126316] [PF_RING] IP Defragment No
[ 257.126316] [PF_RING] Initialized correctly
[ 257.140850] device p1p1 entered promiscuous mode
[ 257.151117] BUG: unable to handle kernel NULL pointer dereference at 000000000000000e
[ 257.151152] IP: [] file_free_rcu+0x11/0x40
[ 257.151178] PGD 0
[ 257.151188] Oops: 0002 [#1] SMP
[ 257.151202] Modules linked in: pf_ring(OF) 8021q garp stp mrp llc ext4 mbcache jbd2 intel_powerclamp coretemp iTCO_wdt iTCO_vendor_support dcdbas ipmi_devintf intel_rapl kvm_intel kvm crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd pcspkr sb_edac edac_core lpc_ich mei_me mfd_core mei shpchp ipmi_si wmi ipmi_msghandler acpi_power_meter binfmt_misc xfs libcrc32c sd_mod crc_t10dif crct10dif_common mgag200 syscopyarea sysfillrect sysimgblt drm_kms_helper ttm igb ixgbe drm mdio i2c_algo_bit ptp i2c_core pps_core megaraid_sas dca dm_mirror dm_region_hash dm_log dm_mod
[ 257.151448] CPU: 1 PID: 0 Comm: swapper/1 Tainted: GF O-------------- 3.10.0-229.el7.x86_64 #1
[ 257.151476] Hardware name: Dell Inc. PowerEdge R730xd/0599V5, BIOS 1.2.10 03/09/2015
[ 257.151499] task: ffff8810287316c0 ti: ffff881028758000 task.ti: ffff881028758000
[ 257.151521] RIP: 0010:[] [] file_free_rcu+0x11/0x40
[ 257.151547] RSP: 0018:ffff88203ec036f0 EFLAGS: 00010286
[ 257.151563] RAX: ffff881ff5a13800 RBX: ffff88201ed16d00 RCX: 0000000000000000
[ 257.151584] RDX: 000000000000000e RSI: ffff881ff5a13820 RDI: 000000000000000e
[ 257.151604] RBP: ffff88203ec036f8 R08: 000000000000000e R09: 0000000000000002
[ 257.151625] R10: 0000000000000001 R11: ffff88201ed16d00 R12: 000000000000000e
[ 257.151645] R13: 000000000000002e R14: ffff881ff2c6e1ce R15: ffff8820225b0800
[ 257.151666] FS: 0000000000000000(0000) GS:ffff88203ec00000(0000) knlGS:0000000000000000
[ 257.151689] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 257.151706] CR2: 000000000000000e CR3: 000000000190a000 CR4: 00000000001407e0
[ 257.151727] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 257.151747] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 257.151768] Stack:
[ 257.151776] ffff88201ed16d00 ffff88203ec03740 ffffffffa063ece2 ffff88203ec03740
[ 257.151805] ffffffff810a2494 ffff8820225b0800 ffff88203ec03b50 000000000000000e
[ 257.151836] ffff88201ed16d00 ffff88203ec037b0 ffff88203ec03a20 ffffffffa063f13e
[ 257.151868] Call Trace:
[ 257.151878]
[ 257.151886]
[ 257.151897] [] bpf_filter_skb+0x52/0xe0 [pf_ring]
[ 257.151917] [] ? __wake_up+0x44/0x50
[ 257.151936] [] add_skb_to_ring.isra.42+0x3ce/0x10e0 [pf_ring]
[ 257.151959] [] ? parse_raw_pkt.part.27+0x6a1/0xa60 [pf_ring]
[ 257.151983] [] ? serial8250_unregister_port+0x21/0xa0
[ 257.152005] [] skb_ring_handler+0xd1f/0x1eb0 [pf_ring]
[ 257.152030] [] ? credit_entropy_bits.part.12+0x164/0x1c0
[ 257.152052] [] ? add_interrupt_randomness+0x184/0x1b0
[ 257.152073] [] ? add_interrupt_randomness+0x50/0x1b0
[ 257.152095] [] ? packet_rcv+0x5/0x90 [pf_ring]
[ 257.152115] [] ? add_interrupt_randomness+0x50/0x1b0
[ 257.152138] [] ? __getnstimeofday+0xd/0xd0
[ 257.152158] [] packet_rcv+0x51/0x90 [pf_ring]
[ 257.152827] [] __netif_receive_skb_core+0x380/0x870
[ 257.153483] [] __netif_receive_skb+0x18/0x60
[ 257.154137] [] netif_receive_skb+0x40/0xd0
[ 257.154790] [] napi_gro_receive+0x80/0xb0
[ 257.155432] [] ixgbe_clean_rx_irq+0x7ac/0xb30 [ixgbe]
[ 257.156062] [] ixgbe_poll+0x4bb/0x930 [ixgbe]
[ 257.156688] [] ? timerqueue_add+0x60/0xb0
[ 257.157316] [] ? enqueue_hrtimer+0x25/0x80
[ 257.157927] [] net_rx_action+0x152/0x240
[ 257.158521] [] __do_softirq+0xf7/0x290
[ 257.159097] [] call_softirq+0x1c/0x30
[ 257.159651] [] do_softirq+0x55/0x90
[ 257.160182] [] irq_exit+0x115/0x120
[ 257.160694] [] do_IRQ+0x58/0xf0
[ 257.161194] [] common_interrupt+0x6d/0x6d
[ 257.161679]
[ 257.161686]
[ 257.162159] [] ? cpuidle_enter_state+0x52/0xc0
[ 257.162634] [] ? cpuidle_enter_state+0x48/0xc0
[ 257.163100] [] cpuidle_idle_call+0xc5/0x200
[ 257.163560] [] arch_cpu_idle+0xe/0x30
[ 257.164019] [] cpu_startup_entry+0xf5/0x290
[ 257.164481] [] start_secondary+0x1ba/0x230
[ 257.164936] Code: c6 70 86 1c 81 e8 b0 b4 f4 ff 5b 5d c3 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb 48 8b 7f 70 ff 0f 0f 94 c2 84 d2 74 05 e8 f0 59 ed ff 48 8b 3d 89 01 86
[ 257.165984] RIP [] file_free_rcu+0x11/0x40
[ 257.166472] RSP
[ 257.166947] CR2: 000000000000000e

Hi.

I'm trying to get p0f v3 (http://lcamtuf.coredump.cx/p0f3/) running with PF_RING.

I'm using stock centos 7 x86_64 kernel (3.10.0-229.7.2.el7.x86_64) with PF_RING installed from packages found at http://www.nmon.net/packages/rpm7/x86_64/PF_RING/.

Upon starting I can see PF_RING module getting loaded:

[    8.644538] [PF_RING] Welcome to PF_RING 6.1.1 ($Revision: :$)
(C) 2004-14 ntop.org
[    8.644571] [PF_RING] registered /proc/net/pf_ring/
[    8.644576] NET: Registered protocol family 27
[    8.644587] [PF_RING] Min # ring slots 4096
[    8.644591] [PF_RING] Slot version     16
[    8.644596] [PF_RING] Capture TX       Yes [RX+TX]
[    8.644600] [PF_RING] IP Defragment    No
[    8.644603] [PF_RING] Initialized correctly

Examples from https://github.com/ntop/PF_RING/tree/dev/userland/examples work just fine. But when I start p0f it just hangs up whole PC. Nothing helps but hard reset.

I've tried to use lockup watchdog (with softlockup_panic=1 parameter) - but no luck. Machine just hangs and that's it.

Is it possible that this is a bug in PF_RING code?

It would be sweet if the documentation can be updated to point to this github location instead of svn.
It is strictly not an issue for the github code but I'm putting it up here since they are intertwined
(API description and the actual API)

Example: http://www.ntop.org/pf_ring/learning-the-pf_ring-api/

As we moved to GIT, the doc/svn2changelog.py tool must be adapted

I'm trying to install pf-ring on mac os x yosemite 10.10.4. Doing what's written here: http://www.ntop.org/get-started/download/
so:

git clone https://github.com/ntop/PF_RING.git
cd PF_RING/kernel

so far so good, bu when doing "make" getting this:

$ make
make -C /lib/modules/14.4.0/build SUBDIRS=/usr/local/src/PF_RING/kernel EXTRA_CFLAGS='-I/usr/local/src/PF_RING/kernel -DGIT_REV="\"dev:b2a8f8a93b226e74428424e91a2ea3bd3148123d\""' modules
make[1]: *** /lib/modules/14.4.0/build: No such file or directory.  Stop.
Makefile:38: recipe for target 'all' failed
make: *** [all] Error 2

Maybe some dependencies absent?
What's the problem and how to solve it? Please help!
Thank you!

Hello. I need to read a traffic from set of ingress interfaces, process it, and send it to egress set of interfaces. Please tell me, must I create 2 clusters (for ingress and for egress interfaces), or I need to use one common cluster and include all interfaces to this single cluster? Do you have an example for this issue?

When I use igb driver with 1G card and work with interface in zc mode, I still can to show a traffic stats by ifstat or snmp.
But when I use 10G card and use ixgbe driver, ifstat shows nothing. How to show traffic counters in such issue? In both cases I load a drivers by load_driver.sh.

I apologize for my lack of C programming / build chain knowledge, but
I'm unable to successfully use the built libpcap.so.1.6.2 library,
included in the pf_ring source, after commit:
d31def0

In case it matters, my use case for pf_ring is having it load balance
network traffic, across many snort instances. I'm running fully
updated RHEL 6.7, using an Intel 82599ES network card, and attempting
to configure pf_ring in zc mode. This setup has been working for the
last several months.

Here is the relevant snippet of the script I'm using to build pf_ring
and it's components.

cd $BUILD_ROOT_DIR/pf_ring
cd kernel
echo -e "\n\nStarting Build of pf_ring kernerl \n\n" >>$BUILD_LOG
make clean >>$BUILD_LOG
make >>$BUILD_LOG
sudo make install >>$BUILD_LOG

cd ../userland/lib
echo -e "\n\nStarting Build of pf_ring userland/lib \n\n">>$BUILD_LOG
./configure >>$BUILD_LOG
make clean >>$BUILD_LOG
make >>$BUILD_LOG
sudo make install >>$BUILD_LOG

cd ../libpcap
echo -e "\n\nStarting Build of pf_ring userland/libpcap \n\n">>$BUILD_LOG
./configure >>$BUILD_LOG
make clean >>$BUILD_LOG
make >>$BUILD_LOG
sudo make install >>$BUILD_LOG

The rest of the script builds the ixgbe zero copy driver, the snort
daq, the pf_ring daq zero copy module, and finally snort itself.

Results when building with pf_ring commit:
217e304

ldd /usr/local/lib/libpcap.so.1.6.2
linux-vdso.so.1 => (0x00007ffd6f2a8000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007ff0c4680000)
librt.so.1 => /lib64/librt.so.1 (0x00007ff0c4478000)
libnl.so.1 => /lib64/libnl.so.1 (0x00007ff0c4225000)
libc.so.6 => /lib64/libc.so.6 (0x00007ff0c3e91000)
/lib64/ld-linux-x86-64.so.2 (0x000000381cc00000)
libm.so.6 => /lib64/libm.so.6 (0x00007ff0c3c0d000)

snort runs / works as expected

Results when building with pf_ring commit:
d31def0

[root@fsb-07 ~]# ldd /usr/local/lib/libpcap.so.1.6.2
linux-vdso.so.1 => (0x00007ffecb520000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fa70d895000)
librt.so.1 => /lib64/librt.so.1 (0x00007fa70d68d000)
libnl.so.1 => /lib64/libnl.so.1 (0x00007fa70d43a000)
../lib/libpfring.so => not found
libc.so.6 => /lib64/libc.so.6 (0x00007fa70d0a6000)
/lib64/ld-linux-x86-64.so.2 (0x000000381cc00000)
libm.so.6 => /lib64/libm.so.6 (0x00007fa70ce21000)

snort: snort: error while loading shared libraries:
../lib/libpfring.so: cannot open shared object file: No such file or
directory

I add three lines in PF_RING/userland/examples/pfcount.c ,
433a434,437

struct timeval t1;
gettimeofday(&t1,NULL);

printf("%lld\n",(t1.tv_sec * 1000000000 + t1.tv_usec * 1000 - h->extended_hdr.timestamp_ns));

[root@localhost examples]# ./pfcount -i em2
Using PF_RING v.6.1.1
Capturing from em2 [44:A8:42:31:3B:28][ifIndex: 3]

Device RX channels: 1

Polling threads: 1

Dumping statistics on /proc/net/pf_ring/stats/36299-em2.2520
500340635
500355255
500360237
500366553
499201428
499202098
475305377
458176629
399656541
399653852
399657571
399661611
399064164
399056550
399062153
399065029
398885092
398891961
398896016
398900322
398301733
398299895
398303553
398145113
398147104
398151421
398159677
397150607
397151639
351792754
351794079
351808270
351815341
272232361
252847136
235235064
234910699
222151294
222153391
221939112
221941617
201571278
201570273
201575232
201581217
51274212
51275790
51280720
48558517
22264212
22267572
144075
150007
160231
170486
182779
174478
180512
187831
195027
200132
179247
186034
170355
177255
146370
153270
135375
#140321

Absolute Stats: [69 pkts rcvd][0 pkts dropped]
Total Pkts=69/Dropped=0.0 %
#69 pkts - 13'816 bytes

some pf_ring info :

[root@localhost examples]# cat /proc/net/pf_ring/info
PF_RING Version : 6.1.1 (dev:686efccb01dc7eaab815d555a82d2e79232bd890)
Total rings : 0

Standard (non DNA/ZC) Options
Ring slots : 4096
Slot version : 16
Capture TX : Yes [RX+TX]
IP Defragment : No
Socket Mode : Standard
Total plugins : 0
Cluster Fragment Queue : 0
Cluster Fragment Discard : 0

[root@localhost examples]# uname -a
Linux localhost.localdomain 3.10.0-229.el7.x86_64 #1 SMP Fri Mar 6 11:36:42 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

ethtool -i em2

[root@localhost examples]# ethtool -i em2
driver: tg3
version: 3.137
firmware-version: FFV7.10.59 bc 5720-v1.36
bus-info: 0000:01:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no

[root@localhost ~]# cat /etc/redhat-release
Derived from Red Hat Enterprise Linux 7.1 (Source)

[root@localhost ~]# ifconfig em2
em2: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
inet 192.168.1.205 netmask 255.255.255.0 broadcast 192.168.1.255
inet6 fe80::46a8:42ff:fe31:3b28 prefixlen 64 scopeid 0x20
ether 44:a8:42:31:3b:28 txqueuelen 1000 (Ethernet)
RX packets 4290658658 bytes 2215627625127 (2.0 TiB)
RX errors 1 dropped 412 overruns 0 frame 1
TX packets 808995272 bytes 52018489641 (48.4 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 38

[root@localhost ~]# ethtool -a em2
Pause parameters for em2:
Autonegotiate: off
RX: off
TX: off

[root@localhost ~]# ethtool -k em2
Features for em2:
rx-checksumming: on
tx-checksumming: on
tx-checksum-ipv4: on
tx-checksum-ip-generic: off [fixed]
tx-checksum-ipv6: on
tx-checksum-fcoe-crc: off [fixed]
tx-checksum-sctp: off [fixed]
scatter-gather: on
tx-scatter-gather: on
tx-scatter-gather-fraglist: off [fixed]
tcp-segmentation-offload: on
tx-tcp-segmentation: on
tx-tcp-ecn-segmentation: on
tx-tcp6-segmentation: on
udp-fragmentation-offload: off [fixed]
generic-segmentation-offload: on
generic-receive-offload: off
large-receive-offload: off [fixed]
rx-vlan-offload: on [fixed]
tx-vlan-offload: on [fixed]
ntuple-filters: off [fixed]
receive-hashing: off [fixed]
highdma: on
rx-vlan-filter: off [fixed]
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
netns-local: off [fixed]
tx-gso-robust: off [fixed]
tx-fcoe-segmentation: off [fixed]
tx-gre-segmentation: off [fixed]
tx-ipip-segmentation: off [fixed]
tx-sit-segmentation: off [fixed]
tx-udp_tnl-segmentation: off [fixed]
tx-mpls-segmentation: off [fixed]
fcoe-mtu: off [fixed]
tx-nocache-copy: on
loopback: off [fixed]
rx-fcs: off [fixed]
rx-all: off [fixed]
tx-vlan-stag-hw-insert: off [fixed]
rx-vlan-stag-hw-parse: off [fixed]
rx-vlan-stag-filter: off [fixed]
busy-poll: off [fixed]

I have a development environment which is running on ESX vSphere. The VM in question is running redhat 6 on a kernel 2.6.32-504.12.2.el6.x86_64.

We are running docker in this environment and have found that pf_ring seems to be causing a kernel panic. It happens when we request docker to create about 15 containers at the same time.

We are using version 5.6.1 of pf_ring but I have seen the same problem in 6.0.2

Pid: 15, comm: netns Tainted: G W --------------- 2.6.32-504.12.2.el6.x86_64 #1 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform
RIP: 0010:[] [] remove_proc_entry+0x7c/0x1b0
RSP: 0018:ffff88043a2f5c00 EFLAGS: 00010282
RAX: 0000000000000004 RBX: 0001000000000000 RCX: 0000000000000000
RDX: ffff8803e2372a10 RSI: 000000000000002f RDI: ffffffffa0506f18
RBP: ffff88043a2f5c50 R08: 0000000000000004 R09: 0000000000000000
R10: 000000000000000f R11: 000000000000000f R12: ffffffffa0506f18
R13: ffffffffa0506f18 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88002c300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00007f0e0f23c000 CR3: 0000000001a85000 CR4: 00000000000407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process netns (pid: 15, threadinfo ffff88043a2f4000, task ffff88043a278040)
Stack:
0000000000000018 ffff88043a2f5c60 ffff88043a2f5c20 ffff8803e23729c0
ffffffff00000018 ffffffffa0506f18 ffff8803e23729c0 ffff880046806c40
ffff880046806c78 00000000ffffffec ffff88043a2f5c70 ffffffffa04f284f
Call Trace:
[] remove_device_from_ring_list+0xff/0x130 [pf_ring]
[] ring_notifier+0x12f/0x310 [pf_ring]
[] notifier_call_chain+0x55/0x80
[] raw_notifier_call_chain+0x16/0x20
[] call_netdevice_notifiers+0x1b/0x20
[] rollback_registered_many+0x154/0x280
[] rollback_registered+0x38/0x50
[] ? default_wake_function+0x0/0x20
[] unregister_netdevice_queue+0x58/0xa0
[] unregister_netdevice+0x10/0x20
[] veth_dellink+0x25/0x50 [veth]
[] default_device_exit+0x9a/0x100
[] ? wakeme_after_rcu+0x0/0x20
[] ? cleanup_net+0x0/0xa0
[] cleanup_net+0x6e/0xa0
[] worker_thread+0x170/0x2a0
[] ? autoremove_wake_function+0x0/0x40
[] ? worker_thread+0x0/0x2a0
[] kthread+0x9e/0xc0
[] child_rip+0xa/0x20
[] ? kthread+0x0/0xc0
[] ? child_rip+0x0/0x20

The exact disassembly at the IP is
/usr/src/debug/kernel-2.6.32-504.12.2.el6/linux-2.6.32-504.12.2.el6.x86_64/fs/proc/generic.c: 31
0xffffffff811ffe9c <remove_proc_entry+124>: movzwl 0x4(%rbx),%ecx

which points at a de-referencing of a pointer which is contained in a linked list.

It looks like this is happening when a device is being unregistered.

<4>[PF_RING] packet_notifier(22) [eth0][1]
<4>[PF_RING] packet_notifier(eth0): unhandled message [msg=22][pfring_ptr=(null)]
<4>[PF_RING] packet_notifier(9) [veth4a07dc5][1]
<4>[PF_RING] packet_notifier(veth4a07dc5): unhandled message [msg=9][pfring_ptr=ffffffffa0507ee0]
<6>docker0: port 2(veth4a07dc5) entering disabled state
<4>[PF_RING] packet_notifier(2) [veth4a07dc5][1]
<6>device veth4a07dc5 left promiscuous mode
<6>docker0: port 2(veth4a07dc5) entering disabled state
<4>[PF_RING] packet_notifier(11) [docker0][1]
<4>[PF_RING] packet_notifier(docker0): unhandled message [msg=11][pfring_ptr=ffffffffa0507ee0]
<4>[PF_RING] packet_notifier(6) [veth4a07dc5][1]
<4>[PF_RING] packet_notifier(veth4a07dc5) [UNREGISTER][pfring_ptr=ffffffffa0507ee0]
[pfring_ptr=ffff8803e2320200]
<4>[PF_RING] packet_notifier(22) [veth4a07dc5][1]
<4>[PF_RING] packet_notifier(veth4a07dc5): unhandled message [msg=22][pfring_ptr=(null)]
<4>[PF_RING] packet_notifier(9) [lo][772]
<4>[PF_RING] packet_notifier(lo): skipping non ethernet device
<4>[PF_RING] packet_notifier(2) [lo][772]
<4>[PF_RING] packet_notifier(lo): skipping non ethernet device
<4>[PF_RING] packet_notifier(6) [lo][772]
<4>[PF_RING] packet_notifier(lo): skipping non ethernet device
<4>[PF_RING] packet_notifier(22) [lo][772]
<4>[PF_RING] packet_notifier(lo): skipping non ethernet device
<6>docker0: port 3(veth701d196) entering forwarding state
<4>[PF_RING] packet_notifier(9) [eth0][1]
<4>[PF_RING] packet_notifier(eth0): unhandled message [msg=9][pfring_ptr=ffffffffa0507ee0]
<4>[PF_RING] packet_notifier(2) [eth0][1]
<4>[PF_RING] packet_notifier(6) [eth0][1]
<4>[PF_RING] packet_notifier(eth0) [UNREGISTER][pfring_ptr=ffffffffa0507ee0]
<4>general protection fault: 0000 [#1] SMP

Do you have any advice?

Thanks

Im getting the following error installing in CentOS 7 + kernel 4.2.3-elrepo:

DKMS make.log for pfring-6.1.1 for kernel 4.2.3-1.el7.elrepo.x86_64 (x86_64)
Ter Out  6 15:05:57 BRT 2015
********** WARNING WARNING WARNING **********
*
* Compiling PF_RING as root might lead you to compile errors
* Please compile PF_RING as unpriviliged user
*
*********************************************
make -C /lib/modules/4.2.3-1.el7.elrepo.x86_64/build SUBDIRS=/var/lib/dkms/pfring/6.1.1/build EXTRA_CFLAGS='-I/var/lib/dkms/pfring/6.1.1/build -DGIT_REV="\"dev:f3689fc0b1c6fb29827d2cb35ba710ec21e114ea\""' modules
make[1]: Entrando no diretório `/usr/src/kernels/4.2.3-1.el7.elrepo.x86_64'
  CC [M]  /var/lib/dkms/pfring/6.1.1/build/pf_ring.o
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_sock_destruct’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:945:9: note: in expansion of macro ‘ring_sk’
   pfr = ring_sk(sk);
         ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_alloc_mem’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:1730:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_insert’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:1827:34: note: in expansion of macro ‘ring_sk’
   pfr = (struct pf_ring_socket *)ring_sk(sk);
                                  ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_remove’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:1847:42: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr_to_delete = ring_sk(sk_to_delete);
                                          ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:1860:11: note: in expansion of macro ‘ring_sk’
     pfr = ring_sk(sk);
           ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘unregister_plugin’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:4282:13: note: in expansion of macro ‘ring_sk’
       pfr = ring_sk(sk);
             ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘skb_ring_handler’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:4607:13: note: in expansion of macro ‘ring_sk’
       pfr = ring_sk(sk);
             ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:4697:14: note: in expansion of macro ‘ring_sk’
        pfr = ring_sk(skElement);
              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_create’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:4885:3: error: too few arguments to function ‘sk_alloc’
   sk = sk_alloc(net, PF_INET, GFP_KERNEL, &ring_proto);
   ^
In file included from include/linux/tcp.h:22:0,
                 from include/linux/ipv6.h:69,
                 from /var/lib/dkms/pfring/6.1.1/build/pf_ring.c:93:
include/net/sock.h:1515:14: note: declared here
 struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:4898:3: note: in expansion of macro ‘ring_sk’
   ring_sk(sk) = ring_sk_datatype(kmalloc(sizeof(*pfr), GFP_KERNEL));
   ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:4900:14: note: in expansion of macro ‘ring_sk’
   if(!(pfr = ring_sk(sk)))
              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:4944:9: note: in expansion of macro ‘ring_sk’
   kfree(ring_sk(sk));
         ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_release’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:5840:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:5970:3: note: in expansion of macro ‘ring_sk’
   ring_sk(sk) = NULL;
   ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘packet_ring_bind’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:6030:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_mmap’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:6230:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_recvmsg’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:6484:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sock->sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_sendmsg’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:6537:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sock->sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_poll’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:6673:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sock->sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘add_sock_to_cluster_list’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:424:58: note: in definition of macro ‘ring_sk_datatype’
 #define ring_sk_datatype(__sk) ((struct pf_ring_socket *)__sk)
                                                          ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:6776:20: note: in expansion of macro ‘ring_sk’
   ring_sk_datatype(ring_sk(sock))->cluster_id = el->cluster.cluster_id;
                    ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘set_master_ring’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:6866:11: note: in expansion of macro ‘ring_sk’
     pfr = ring_sk(sk);
           ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_setsockopt’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:7504:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sock->sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘ring_getsockopt’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:8401:32: note: in expansion of macro ‘ring_sk’
   struct pf_ring_socket *pfr = ring_sk(sock->sk);
                                ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: At top level:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:9114:3: warning: initialization from incompatible pointer type [enabled by default]
   .recvmsg = ring_recvmsg,
   ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:9114:3: warning: (near initialization for ‘ring_ops.recvmsg’) [enabled by default]
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:9115:3: warning: initialization from incompatible pointer type [enabled by default]
   .sendmsg = ring_sendmsg,
   ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:9115:3: warning: (near initialization for ‘ring_ops.sendmsg’) [enabled by default]
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘remove_device_from_ring_list’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:9180:8: note: in expansion of macro ‘ring_sk’
  pfr = ring_sk(sk);
        ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c: In function ‘pf_ring_inject_packet_to_ring’:
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:425:30: error: ‘struct sock’ has no member named ‘sk_protinfo’
 #define ring_sk(__sk) ((__sk)->sk_protinfo)
                              ^
/var/lib/dkms/pfring/6.1.1/build/pf_ring.c:9307:13: note: in expansion of macro ‘ring_sk’
       pfr = ring_sk( sk);
             ^
make[2]: ** [/var/lib/dkms/pfring/6.1.1/build/pf_ring.o] Erro 1
make[1]: ** [_module_/var/lib/dkms/pfring/6.1.1/build] Erro 2
make[1]: Saindo do diretório `/usr/src/kernels/4.2.3-1.el7.elrepo.x86_64'
make: ** [all] Erro 2

Hello,

I am running an ARM board (DE1-SoC) and compiled PF_RING in version 6.0.3 on it. While compiling the ../userland/examples I got error messages such as "undefined reference to `pfring_recv' ". I could solve that by editing the Makefile and change this line
LIBS = ${LIBPCAP} ${LIBPFRING} ${LIBPCAP} -lpthread -lrt -lrt
to
LIBS = ${LIBPCAP} ${LIBPFRING} ${LIBPCAP} -lpthread -lpfring -lrt.

Now I receive the following errors (shown below) while compiling. The problem is the static inline ticks getticks(void) function of pfutils.c. I know this function is specified for x68_64 and amd64 architectures but is there also an ARM implementation that you know of? I like to use the pfsend program but if I comment "asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));" out I receive a segmentation fault while running the compiled pfsend. I also found some piece of code that I implemented that doesn`t result in any error but pfsend also shows the segmentation fault.

Has someone an answer to get pfsend working?

static inline ticks getticks(void)
{
u_int32_t r = 0;
asm volatile("mrc p15, 0, %0, c9, c13, 0" : "=r"(r) );
return r;
}

./pfsend -i eth0 -n 0

[ 1584.745357] 7fc0: 000762e0 00000014 00008134 00000122 0006d37c 0006d4c8 00000000 0006dc60
[ 1584.753500] 7fe0: bebf6690 bebf6684 0002a8e3 b6f372dc 400d0030 00000003 00000000 00000000
[ 1584.761660] [](ring_sendmsg [pf_ring]) from
[ 1584.770072] from
[ 1584.777448] from
[ 1584.785074] Code: e24cb004 e52de004 e8bd4000 e1a06002 (e5922000)
[ 1584.791188] ---[ end trace 842d2bdb38ad7866 ]---
Segmentation fault

In file included from pfsend.c:44:0:
pfsend.c: In function ‘main’:
pfutils.c:266:3: error: impossible constraint in ‘asm’
asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));
^
pfutils.c:266:3: error: impossible constraint in ‘asm’
asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));
^
pfutils.c:266:3: error: impossible constraint in ‘asm’
asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));
^
pfutils.c:266:3: error: impossible constraint in ‘asm’
asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));
^
pfutils.c:266:3: error: impossible constraint in ‘asm’
asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));
^
pfutils.c:266:3: error: impossible constraint in ‘asm’
asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));
^
pfutils.c:266:3: error: impossible constraint in ‘asm’
asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));
^
pfutils.c:266:3: error: impossible constraint in ‘asm’
asm volatile ("rdtsc" : "=a"(lo), "=d"(hi));
^
Makefile:54: recipe for target 'pfsend.o' failed
make: *** [pfsend.o] Error 1

Hello, folks!

I'm playing with parser code and have question about while loop here:

I know about vlan frames and nested vlan tags (QnQ) but I haven't idea about triple nested vlan tags. And in this case while loop is useless and could be replaced with if condition.

What do you think about it?

I'm asking this because loop and condition variable are not equal in case if performance evaluation and loops much times harder to predict for CPU.

I use e1000e driver. Incoming traffic on interface is about 100Mbps.
First, run zcount without zc:

# ./zcount -c1 -i eth9
....
=========================
Absolute Stats: 43'038 pkts (0 drops) - 25'622'234 bytes
Actual Stats: 20'646.93 pps (0.00 drops) - 0.10 Gbps
=========================

Looks ok.
Next, run zcount in zc mode:

# ./zcount -c1 -i zc:eth9
....
=========================
Absolute Stats: 43'335 pkts (0 drops) - 3'810'350 bytes
Actual Stats: 22'122.77 pps (0.00 drops) - 0.02 Gbps
=========================

In second case there are only 0.02Gbps, although real incoming traffic stay 100Mbps.
PPS in both cases are equals. So, I think that in zc mode driver parse packets incorrect.

Additional info:

# ethtool -i eth9
driver: e1000e
version: 3.0.4.1-NAPI
firmware-version: 5.10-2
bus-info: 0000:07:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no

# cat /proc/net/pf_ring/info
PF_RING Version          : 6.1.1 (dev:66b9ee499e33298f638a1117bc5ef806167bbe5a)
Total rings              : 0

Standard (non DNA/ZC) Options
Ring slots               : 4096
Slot version             : 16
Capture TX               : Yes [RX+TX]
IP Defragment            : No
Socket Mode              : Standard
Total plugins            : 0
Cluster Fragment Queue   : 0
Cluster Fragment Discard : 0

When using PF_RING and listening in ZC mode (so no packet reach the kernel) and packets that are injected via stack:ethX into the kernel the pfring listening on zc:ethX will receive those packets.

Depending on the application this may result in infinite loops.

E.g.:
Your tool listens on zc:eth1 and in case there is something that absolutely hast to get into the kernel uses stack:eth1 to push it there then it will receive the same packet it just pushed on zc:eth1 as well, repeat :)

One could easily solve this by (ab)using the sb_buff cb field when creating an skb that is to be locally injected and checking for said field in the packet function hook (packet_rcv).

I patched this locally, if you feel that this is not the way injected packets should be handled I can submit a patch.

When Napatech libraries are installed under /opt/napatech3,
pf_ring should link *.so from /opt/napatech3/lib instead of those
currently installed under /usr/local/lib by *.deb and /usr/lib64 by
*.rpm packages.

2 notice in debian 8:
1- root@Linux:~# apt-cache show pfring
Package: pfring
Priority: optional
Section: free
Installed-Size: 6970
Maintainer: Luca Deri [email protected]
Architecture: amd64
Version: 6.1.1-360
Depends: linux-image-3.16.0-4-amd64, linux-headers-3.16.0-4-amd64, pfring-dkms
Filename: x64/./pfring_6.1.1-360_amd64.deb
Size: 600214
MD5sum: 5ed5a5a3414b968b802529e3ee34cbb0
SHA1: fc6dd6f956b6b38bdbffe361513ae0cc6297fc5c
SHA256: a395bb0f711066bdbf6173a17908e752fd2bb8d1fc552506ae5eaa6f06b38579
SHA512: 2896254cc77ff6f2e8f530141328d81a0358226fae5a082773853d22f61f02981287e8b23b51fedf7c25bdc718f2bf8adf2a7ea8e4b5107b40dcd781bad49ec4
Description: PF_RING (http://www.ntop.org/pf_ring/)
Description-md5: d2bddd78fd0ccfc52efb0cdaee91b219

Question: why this path depends to linux-image-3.16.0-4-amd64, linux-headers-3.16.0-4-amd64??
in ubuntu olny depend to pfring-dkms and that's OK. but in debian if change debian kernel is problem with linux-image-3.16.0-4-amd64, linux-headers-3.16.0-4-amd64.

uname -a :
Linux Linux 3.16.0-4+imq-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u5.1 (2015-11-17) x86_64 GNU/Linux

2- I try to install pfring-drivers-zc-dkms :
root@Linux:~# apt-get install pfring-drivers-zc-dkms
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Unable to locate package pfring-drivers-zc-dkms

I'm attempting to compile Suricata on RHEL7 with pf_ring (stable, 6.1.1 rpm) support (for use with ZC), but I'm getting the following error at compile time:

./configure --prefix=/usr --sysconfdir=/etc --enable-pfring --with-libpfring-includes=/usr/local/include --with-libpfring-libraries=/usr/local/lib --with-libnspr-includes=/usr/include/nspr4/ --with-libnspr-libraries=/usr/lib64/ --with-libcap_ng-libraries=/usr/lib64/
...
checking for pfring_open in -lpfring... no
checking for pfring_stats in -lpfring... no

ERROR! --enable-pfring was passed but the library was not found or version is >4, go get it

from http://www.ntop.org/PF_RING.html

I found reference to this issue somewhere else and they suggested adding the following before running ./configure: "LIBS="-lrt -lnuma"

Adding that statement allows configure to get past the pf_ring check, but appears to cause other library checks to fail later on.

Dear Luca,

There is a CGO binding for pf_ring(https://godoc.org/github.com/google/gopacket/pfring), because huge overhead( CGO call vs Go call ~= 500x) to call from Go to C functions by CGO, the binding package is no for high speed packet programming.

BTW: CGO overhead test code: http://play.golang.org/p/GXTwp6Ybot

Best regard,

uname -r
3.16.0-4-amd64

cat /etc/issue
Debian GNU/Linux 8

/home/bram/PF_RING-6.0.3/drivers/DNA/ixgbe-3.21.2-DNA/src/ixgbe_main.c: At top level:
/home/bram/PF_RING-6.0.3/drivers/DNA/ixgbe-3.21.2-DNA/src/ixgbe_main.c:9353:2: error: unknown field ândo_set_vf_tx_rateâ specified in initializer
.ndo_set_vf_tx_rate = ixgbe_ndo_set_vf_bw,
^

This happens even when i try PF_RING-6.1.1
http://www.nmon.net/packages/ubuntu/14.04/all/ixgbe-dna/

• email me for ssh root at [email protected]

zcount always display 0 pkts.
i ran on redhat 6.3 (kernel 2.6.32-279.el6.x86_64) with i40e.

Hello!

Have a stable reproducer. Start vanilla PF_RING for "any" from Git on OpenVZ server and kill it:

evo0.fv.ee:  CR2: 00000000000000a0
evo0.fv.ee:   RSP <ffff881045afbca8>
evo0.fv.ee:  [<ffffffffa0a56080>] ring_getsockopt+0x5a0/0xdf0 [pf_ring]
evo0.fv.ee: ff
evo0.fv.ee:  RIP
evo0.fv.ee: 8c
evo0.fv.ee: fd
evo0.fv.ee: ff
evo0.fv.ee: ff
evo0.fv.ee: e9
evo0.fv.ee: 68
evo0.fv.ee: fe
evo0.fv.ee: c2
evo0.fv.ee: 88
evo0.fv.ee: 85
evo0.fv.ee: d1
evo0.fv.ee: 0f
evo0.fv.ee: 46
evo0.fv.ee: 00
evo0.fv.ee: 00
evo0.fv.ee: 39
evo0.fv.ee: 92
evo0.fv.ee: a0
evo0.fv.ee: 00
evo0.fv.ee: c8
evo0.fv.ee: <8b>
evo0.fv.ee: e0
evo0.fv.ee: 0f
evo0.fv.ee: b6
evo0.fv.ee: 8b
evo0.fv.ee: 52
evo0.fv.ee: 43
evo0.fv.ee: 02
evo0.fv.ee: 48
evo0.fv.ee: 28
evo0.fv.ee: 0f
evo0.fv.ee: b6
evo0.fv.ee: 48
evo0.fv.ee: 8b
evo0.fv.ee: 52
evo0.fv.ee: ff
evo0.fv.ee: ff
evo0.fv.ee: e9
evo0.fv.ee: 8e
evo0.fv.ee: fe
evo0.fv.ee: ee
evo0.fv.ee: 80
evo0.fv.ee: 28
evo0.fv.ee: 48
evo0.fv.ee: 83
evo0.fv.ee: 48
evo0.fv.ee: 8b
evo0.fv.ee: 72
evo0.fv.ee: ff
evo0.fv.ee: ff
evo0.fv.ee: e9
evo0.fv.ee: c3
evo0.fv.ee: fb
evo0.fv.ee: ff
evo0.fv.ee: ff
evo0.fv.ee: 12
evo0.fv.ee: fb
evo0.fv.ee: 0f
evo0.fv.ee: 85
evo0.fv.ee: 48
evo0.fv.ee: 85
evo0.fv.ee: c0
evo0.fv.ee:  Code:
evo0.fv.ee: e0
evo0.fv.ee:   [<ffffffff8100b1a2>] system_call_fastpath+0x16/0x1b
evo0.fv.ee:   [<ffffffff8145b2c5>] sys_getsockopt+0x65/0xc0
evo0.fv.ee:   [<ffffffffa0093008>] ? ext4_file_write+0x58/0x190 [ext4]
evo0.fv.ee:   [<ffffffff8114239a>] ? generic_file_aio_write+0xba/0x100
evo0.fv.ee:   [<ffffffff811b819e>] ? __sb_end_write+0x3e/0x90
evo0.fv.ee:   [<ffffffff811422c5>] ? __generic_file_aio_write+0x85/0xa0
evo0.fv.ee:   [<ffffffff81472575>] ? __dev_get_by_name+0x25/0xd0
evo0.fv.ee:   [<ffffffff81142045>] ? __generic_file_write_iter+0x225/0x420
evo0.fv.ee:  Call Trace:
evo0.fv.ee:  000000000000003a
evo0.fv.ee:  ffff88101c220a80
evo0.fv.ee:  ffff880392048cd0
evo0.fv.ee:  <d>
evo0.fv.ee:  000000000000003a
evo0.fv.ee:  00000000000049f3
evo0.fv.ee:  ffffea002c0f2a80
evo0.fv.ee:  ffff8805e5388fc0
evo0.fv.ee:  <d>
evo0.fv.ee:  0000000000000000
evo0.fv.ee:  ffff880392048cd0
evo0.fv.ee:  000000000000060d
evo0.fv.ee:  000000000000003a
evo0.fv.ee:  Stack:
evo0.fv.ee:   ffff88101c220a80
evo0.fv.ee:  Process fastnetmon (pid: 880814, veid: 0, threadinfo ffff881045afa000, task ffff8805e5388fc0)
evo0.fv.ee:  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
evo0.fv.ee:  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
evo0.fv.ee:  CR2: 00000000000000a0 CR3: 0000000ff286f000 CR4: 00000000001407e0
evo0.fv.ee:  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
evo0.fv.ee:  FS:  00007f5e90c0d700(0000) GS:ffff8800689c0000(0000) knlGS:0000000000000000
evo0.fv.ee:  R13: 00007f5e90c0cbe8 R14: 00007f5e90c0cbef R15: 0000000000000004
evo0.fv.ee:  R10: 00007f5e90c0cbef R11: 0000000000000246 R12: 00000000000000ae
evo0.fv.ee:  RBP: ffff881045afbf28 R08: 00007f5e90c0cbe8 R09: 203237342c35343a
evo0.fv.ee:  RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88101d866980
evo0.fv.ee:  RAX: 0000000000000000 RBX: ffff88100623d800 RCX: 0000000000000000
evo0.fv.ee:  RSP: 0018:ffff881045afbca8  EFLAGS: 00010246
evo0.fv.ee:  [<ffffffffa0a56080>] ring_getsockopt+0x5a0/0xdf0 [pf_ring]
evo0.fv.ee:  RIP: 0010:[<ffffffffa0a56080>]
evo0.fv.ee:  Supermicro X9SRD-F
evo0.fv.ee: /X9SRD-F
evo0.fv.ee:  Pid: 880814, comm: fastnetmon veid: 0 Tainted: P           ---------------    2.6.32-042stab111.11 #1 042stab111_11
evo0.fv.ee:  dm_mod
evo0.fv.ee:  [last unloaded: pf_ring]
evo0.fv.ee:  dm_mirror
evo0.fv.ee:  dm_region_hash
evo0.fv.ee:  dm_log
evo0.fv.ee:  ahci
evo0.fv.ee:  wmi
evo0.fv.ee:  sd_mod
evo0.fv.ee:  crc_t10dif
evo0.fv.ee:  mbcache
evo0.fv.ee:  raid1
evo0.fv.ee:  shpchp
evo0.fv.ee:  ext4
evo0.fv.ee:  jbd2
evo0.fv.ee:  lpc_ich
evo0.fv.ee:  mfd_core
evo0.fv.ee:  i2c_i801
evo0.fv.ee:  i2c_core
evo0.fv.ee:  sb_edac
evo0.fv.ee:  edac_core
evo0.fv.ee:  ptp
evo0.fv.ee:  pps_core
evo0.fv.ee:  dca
evo0.fv.ee:  i2c_algo_bit
evo0.fv.ee:  iTCO_vendor_support
evo0.fv.ee:  igb
evo0.fv.ee:  iTCO_wdt
evo0.fv.ee:  acpi_pad
evo0.fv.ee:  serio_raw
evo0.fv.ee:  ipmi_msghandler
evo0.fv.ee:  sg
evo0.fv.ee:  nf_defrag_ipv4
evo0.fv.ee:  tun
evo0.fv.ee:  ipmi_si
evo0.fv.ee:  nf_conntrack_ipv4
evo0.fv.ee:  nf_conntrack
evo0.fv.ee:  nf_nat
evo0.fv.ee:  ip_tables
evo0.fv.ee:  fuse
evo0.fv.ee:  iptable_nat
evo0.fv.ee:  slhc
evo0.fv.ee:  crc_ccitt
evo0.fv.ee:  zlib_deflate
evo0.fv.ee:  ppp_async
evo0.fv.ee:  ppp_generic
evo0.fv.ee:  ppp_mppe
evo0.fv.ee:  ppp_deflate
evo0.fv.ee:  arc4
evo0.fv.ee:  ecb
evo0.fv.ee:  esp4
evo0.fv.ee:  af_key
evo0.fv.ee:  esp6
evo0.fv.ee:  ipv6
evo0.fv.ee:  pppox
evo0.fv.ee:  xfrm6_mode_tunnel
evo0.fv.ee:  xfrm4_mode_tunnel
evo0.fv.ee:  xfrm4_mode_transport
evo0.fv.ee:  pppol2tp
evo0.fv.ee:  ipt_LOG
evo0.fv.ee:  xfrm_ipcomp
evo0.fv.ee:  nf_defrag_ipv6
evo0.fv.ee:  xt_state
evo0.fv.ee:  xt_owner
evo0.fv.ee:  nf_conntrack_ipv6
evo0.fv.ee:  xt_connlimit
evo0.fv.ee:  ipt_REDIRECT
evo0.fv.ee:  iptable_raw
evo0.fv.ee:  iptable_mangle
evo0.fv.ee:  ipt_MASQUERADE
evo0.fv.ee:  nfs_acl
evo0.fv.ee:  sunrpc
evo0.fv.ee:  fscache
evo0.fv.ee:  auth_rpcgss
evo0.fv.ee:  nfs
evo0.fv.ee:  lockd
evo0.fv.ee:  vzmon
evo0.fv.ee:  vzdev
evo0.fv.ee:  vzrst
evo0.fv.ee:  vzcpt
evo0.fv.ee:  nf_conntrack_ftp
evo0.fv.ee:  xt_recent
evo0.fv.ee:  ipip
evo0.fv.ee:  tunnel4
evo0.fv.ee: (U)
evo0.fv.ee:  zunicode(P)
evo0.fv.ee: (U)
evo0.fv.ee: (U)
evo0.fv.ee:  zavl(P)
evo0.fv.ee:  znvpair(P)
evo0.fv.ee: (U)
evo0.fv.ee:  spl
evo0.fv.ee: (U)
evo0.fv.ee: (U)
evo0.fv.ee:  zcommon(P)
evo0.fv.ee:  ip6table_filter
evo0.fv.ee:  ip6_tables
evo0.fv.ee:  zfs(P)
evo0.fv.ee:  iptable_filter
evo0.fv.ee:  vznetdev
evo0.fv.ee:  bonding
evo0.fv.ee:  garp
evo0.fv.ee:  stp
evo0.fv.ee:  llc
evo0.fv.ee:  configfs
evo0.fv.ee:  8021q
evo0.fv.ee:  vzevent
evo0.fv.ee:  netconsole
evo0.fv.ee:  ip6t_REJECT
evo0.fv.ee:  ip6table_mangle
evo0.fv.ee:  vziolimit
evo0.fv.ee:  vzdquota
evo0.fv.ee:  ploop
evo0.fv.ee:  simfs
evo0.fv.ee:  pfmt_raw
evo0.fv.ee:  pfmt_ploop1
evo0.fv.ee:  pio_nfs
evo0.fv.ee:  pio_direct
evo0.fv.ee:  vzethdev
evo0.fv.ee:  pio_kaio
evo0.fv.ee:  ipt_REJECT
evo0.fv.ee:  xt_conntrack
evo0.fv.ee:  xt_multiport
evo0.fv.ee:  coretemp
evo0.fv.ee:  xt_TCPMSS
evo0.fv.ee:  freq_table
evo0.fv.ee:  mperf
evo0.fv.ee:  cpufreq_ondemand
evo0.fv.ee:  acpi_cpufreq
evo0.fv.ee:  cls_u32
evo0.fv.ee:  sch_htb
evo0.fv.ee:  kcare
evo0.fv.ee: (U)
evo0.fv.ee:  sch_sfq
evo0.fv.ee:  pf_ring
evo0.fv.ee: (U)
evo0.fv.ee:  Modules linked in:
evo0.fv.ee:  CPU 7
evo0.fv.ee:  last sysfs file: /sys/devices/system/node/node0/meminfo
evo0.fv.ee:  Oops: 0000 [#1]
evo0.fv.ee: SMP
evo0.fv.ee: PMD 0
evo0.fv.ee:  PGD f5d22b067
evo0.fv.ee: PUD 105f347067
evo0.fv.ee:  [<ffffffffa0a56080>] ring_getsockopt+0x5a0/0xdf0 [pf_ring]
evo0.fv.ee:  IP:
evo0.fv.ee: NULL pointer dereference
evo0.fv.ee:  at 00000000000000a0
evo0.fv.ee:  BUG: unable to handle kernel

Kernel version: 2.6.32-042stab111.11

For some reason, if I either omit the RSS value, or set it to anything other than 1, PF_RING will drop all packets. Is this to be expected? What would cause that behavior? It seems counter-intuitive that a single RX queue would perform better than multiple RX queues. It's as if the PF_RING library has internally deadlocked in its worker thread.

Does one have to do anything differently in userland to properly use multiple RX queues? What's the benefit/cost tradeoffs to having a single vs. multiple RX queues?

Thanks!

I have recently upgraded to Linux kernel 4.0 and PF_RING no longer works for me. Since, I have intel e1000e based ethernet controller so I have made a private patch for the same.
Do let me know if you are planning to launch a separate branch for kernel 4.0 and I can contribute my e1000e patch there.

Hello, folks!

I have multiple virtual functions with ixgbe.

I have changed following lines in load_driver.sh:

-insmod ./ixgbe.ko RSS=1,1,1,1
+insmod ./ixgbe.ko RSS=1,1,1,1 max_vfs=2,2

Thus, I tuned virtual functions and set mac's for they:

ip link set eth6 vf 0 mac 90:e2:ba:55:aa:bb
ip link set eth6 vf 1 mac 90:e2:ba:55:bb:cc

And apply changes:

rmmod ixgbevf
modprobe ixgbevf

Thus, I have single physical NIC and two virtual NIC's:

21: eth6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 90:e2:ba:4a:d8:e8 brd ff:ff:ff:ff:ff:ff
    vf 0 MAC 90:e2:ba:55:aa:bb, spoof checking on, link-state auto
    vf 1 MAC 90:e2:ba:55:bb:cc, spoof checking on, link-state auto
29: eth10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 90:e2:ba:55:aa:bb brd ff:ff:ff:ff:ff:ff
30: eth11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
    link/ether 90:e2:ba:55:bb:cc brd ff:ff:ff:ff:ff:ff

And I have enabled all NICs:

ifconfig eth6 up
ifconfig eth10 up
ifconfig eth11 up

And all nic's become ready:

root@filteredclient /usr/src/PF_RING-6.0.3/userland/examples_zc # ethtool eth10
Settings for eth10:
    Supported ports: [ ]
    Supported link modes:   10000baseT/Full 
    Supported pause frame use: No
    Supports auto-negotiation: No
    Advertised link modes:  Not reported
    Advertised pause frame use: No
    Advertised auto-negotiation: No
    Speed: 10000Mb/s
    Duplex: Full
    Port: Other
    PHYAD: 0
    Transceiver: Unknown!
    Auto-negotiation: off
    Current message level: 0x00000007 (7)
                   drv probe link
    Link detected: yes
root@filteredclient /usr/src/PF_RING-6.0.3/userland/examples_zc # ethtool eth11
Settings for eth11:
    Supported ports: [ ]
    Supported link modes:   10000baseT/Full 
    Supported pause frame use: No
    Supports auto-negotiation: No
    Advertised link modes:  Not reported
    Advertised pause frame use: No
    Advertised auto-negotiation: No
    Speed: 10000Mb/s
    Duplex: Full
    Port: Other
    PHYAD: 0
    Transceiver: Unknown!
    Auto-negotiation: off
    Current message level: 0x00000007 (7)
                   drv probe link
    Link detected: yes
root@filteredclient /usr/src/PF_RING-6.0.3/userland/examples_zc # ethtool eth6
Settings for eth6:
    Supported ports: [ FIBRE ]
    Supported link modes:   1000baseT/Full 
                            10000baseT/Full 
    Supported pause frame use: No
    Supports auto-negotiation: Yes
    Advertised link modes:  1000baseT/Full 
                            10000baseT/Full 
    Advertised pause frame use: Symmetric
    Advertised auto-negotiation: Yes
    Speed: 10000Mb/s
    Duplex: Full
    Port: FIBRE
    PHYAD: 0
    Transceiver: external
    Auto-negotiation: on
    Supports Wake-on: d
    Wake-on: d
    Current message level: 0x00000007 (7)
                   drv probe link
    Link detected: yes

Well! I could run PF_RING ZC.

It works perfectly for physical interface:

./zcount -c 0 -i zc:eth6
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150330 for eth6 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
# We're now working in demo mode with packet capture and          
# transmission limited to 5 minutes
#########################################################################
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150330 for eth6 [Intel 10 Gbit ixgbe 82599-based]
# ERROR: Please get one at http://shop.ntop.org/.
#########################################################################
=========================
Absolute Stats: 0 pkts (0 drops) - 0 bytes
=========================

^CLeaving...
=========================
Absolute Stats: 0 pkts (0 drops) - 0 bytes
Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps
=========================

=========================
Absolute Stats: 0 pkts (0 drops) - 0 bytes
Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

But for virtual functions it did not work at all:

./zcount -c 0 -i zc:eth10
pfring_zc_open_device error [Socket operation on non-socket] Please check that zc:eth10 is up and not already used

root@filteredclient /usr/src/PF_RING-6.0.3/userland/examples_zc # ./zcount -c 0 -i zc:eth11
pfring_zc_open_device error [Socket operation on non-socket] Please check that zc:eth11 is up and not already used

Could you add support for PF_RING which run on top of virtual functions?

With the latest CentOS 6.x kernel, none of the DNA drivers compile anymore.

I've been trying PF_RING ZC the last few days and have the issue where stack injection does not seem to work.

git: 1f0bbaee4602a867cd27e8c7b4d32bcd57247346
driver: ixgbe-3.22.3-zc
distro: debian 8 jessie
uname -a: Linux dev 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1 (2015-05-24) x86_64 GNU/Linux

I've also tried this on Ubuntu 12.04 and Ubuntu 14.04.

I installed using roughly:

git clone https://github.com/ntop/PF_RING.git
cd PF_RING/
make
cd drivers/ZC/intel/ixgbe/ixgbe-3.22.3-zc/src
make
./load_driver.sh

I first tried the zbounce example to emulate a normal Linux stack which did not seem to work:

zbounce -i zc:eth0 -o stack:eth0 -c 1 -b

And then I wanted to see if the stack:eth0 interface was actually working so I tried:

zsend -i stack:eth0 -p 50000 -c 1

I had bmon open at the time to look at the bandwidth usage on the interface and I did not see any traffic increase at all. I thought it was PF_RING ZC so I tried to no avail:

pfsend -i stack:eth0 -p 50000

The zc:devX seems to work and the just devX seems to work as well. It's just stack:devX that isn't working.

I'm not sure if I'm doing something wrong, misunderstanding, or this is an actual bug.

EDIT: I also tried 6.0.3 stable and that did not work either.

Hi,
we have this issue with current linux distributions (i.e. debian jessie, centos 7).
That is wireshark gui totally hangs the moment you start a capture. Even though the capture seems to be running in the background you are forced to kill wireshark process otherwise you are stuck.
This issue is not occurring in case you start a capture via terminal programs like tcpdump or tshark.

The issue is identical on both linux distributions I have tried to replicate the situation: debian jessie and centos 7

I have installed pf_ring from git following the following procedure:

cd PF_RING/kernel
make
sudo make install
cd ../userland
make
cd lib
sudo make install
cd ../libpcap
sudo make install
cd ../tcpdump
./configure
make
sudo make install

After that I have compiled wireshark this way:

./configure --with-gtk2=yes --with-pcap=/usr/local/lib
make
sudo make install

I hope you can help

Bye,
Fabrizio

A line in the Ubuntu Makefile contains a hard coded reference to libpcap-1.1.1.

cd $(PF_RING_HOME)/userland/libpcap; ./configure; make; cp libpcap* $(HERE)/debian/usr/local/lib/; cd $(HERE)/debian/usr/local/lib/; ln -sf libpcap.so.1.1.1 libpcap.so

At least in my build environment (Debian Wheezy) this isn't correct and I end up with a broken symlink:

drwxr-xr-x root/root         0 2015-05-12 14:55 ./usr/local/lib/
-rw-r--r-- root/root    607240 2015-05-12 14:55 ./usr/local/lib/libpcap.so.1.6.2
lrwxrwxrwx root/root         0 2015-05-12 14:55 ./usr/local/lib/libpcap.so -> libpcap.so.1.1.1

Hello!

I have used parser from PF_RING library in my application. Today I executed tests on new hardware (SandyBridge i7 3820) and found 90% slowdown of whole application.

After some research I found root of problem with perf:

%Cpu(s): 97.1 us,  2.0 sy,  0.0 ni,  0.3 id,  0.0 wa,  0.0 hi,  0.5 si,  0.0 st

Samples: 131K of event 'cycles', Event count (approx.): 98538179479
  89.21%  [vdso]               [.] __vdso_gettimeofday
   4.06%  fastnetmon           [.] process_packet(simple_packet&)
   2.08%  [kernel]             [k] read_hpet
   1.70%  fastnetmon           [.] fastnetmon_parse_pkt
   0.69%  fastnetmon           [.] patricia_search_best2
   0.30%  fastnetmon           [.] consume_pkt(unsigned char*, int)
   0.12%  fastnetmon           [.] get_packet_direction(unsigned int, unsigned int, unsigned long&)
   0.09%  fastnetmon           [.] comp_with_mask
   0.06%  [kernel]             [k] irq_entries_start
   0.06%  [kernel]             [k] _raw_spin_lock_irqsave
   0.05%  [kernel]             [k] ixgbe_poll

After some time of looking this call I found it in pfring packet parser. https://github.com/ntop/PF_RING/blob/dev/userland/lib/pfring_utils.c#L441

After disabling timestamp my toolkit got significant speedup.

Before:

Incoming traffic        1730996 pps    792 mbps      0 flows
10.10.10.221            1731456 pps    792 mbps      0 flows

After:

Incoming traffic        12656548 pps   5793 mbps      0 flows
10.10.10.221            11179102 pps   5117 mbps      0 flows

Nice time to think about replace of this weird slow function :)

Thank you!

Hello, folks!

I hit another bug with Ubuntu 14.04 with 3.16 kernel with PF_RING 6.0.3.

I could share whole messages log here: https://www.dropbox.com/s/la1kb2mcdpdo9v9/test_lab_kern_fault_customer.log?dl=0

Is it possible to check the validity of the license for a specified interface, without starting the capture?

Eg pfring_zc_check_license could take an interface as an argument, and to return whether it is valid and whether it expires.
This would be useful for quickly checking each interface from a script/program, without having to start the whole capture program (eg if another ZC program has bound to the interface)