High-speed packet processing framework

Overview

pfring ntop

PF_RING™

Build Status

Introduction

PF_RING™ is a Linux kernel module and user-space framework that allows you to process packets at high-rates while providing you a consistent API for packet processing applications.

Who needs PF_RING™?

Basically everyone who has to handle many packets per second. The term ‘many’ changes according to the hardware you use for traffic analysis. It can range from 80k pkt/sec on a 1,2GHz ARM to more than 20M pkt/sec per core on a low-end 2,5GHz Xeon. PF_RING™ not only enables you to capture packets faster, it also captures packets more efficiently preserving CPU cycles.

Documentation

If you want to learn more about PF_RING™ please visit the User's Guide and the API Documentation.

Details

For more information about PF_RING™ and other ntop technologies, please visit http://ntop.org

License

PF_RING™ kernel module and drivers are distributed under the GNU GPLv2 license, LGPLv2.1 for the user-space PF_RING library, and are available in source code format.

Comments
  • i40e 2.2.4 causes kernel panic

    i40e 2.2.4 causes kernel panic

    Upgrading to PF_RING 7.0.0 with the new i40e 2.2.4 causes a kernel panic for us on CentOS 6 kernel. The vanilla i40e 2.2.4 driver does not cause this issue. Here are two kernel dumps. The i40e 1.5.18 driver works in libpfring 6.7.0.

    Pid: 10278, comm: modprobe Not tainted 2.6.32-696.13.2.el6.x86_64 #1 Dell Inc. PowerEdge R910/0JRJM9 RIP: 0010:[] [] i40e_vsi_map_rings_to_vectors+0xf3/0x280 [i40e_zc] RSP: 0018:ffff880861a53908 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88106dedcc00 RCX: ffff88106dedcc00 RDX: ffff88106de0ed40 RSI: 0000000000000010 RDI: ffff88104e0b2000 RBP: ffff880861a53968 R08: 000000000003ae77 R09: 0000000000000000 R10: 0000000000000080 R11: 0000000000000001 R12: ffff88104e0b2000 R13: ffff88106e665f00 R14: 00010102464c457f R15: 0000000000000010 FS: 00007fd3655b4700(0000) GS:ffff88089c440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007fee9e121000 CR3: 00000010425ed000 CR4: 00000000000007e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process modprobe (pid: 10278, threadinfo ffff880861a50000, task ffff8805f8c8f520) Stack: ffff88104e0b2000 ffff88104e0b2000 ffff881063754000 00000020202ca020 0000001000000010 0000000100000010 ffff880861a53968 ffff88104e0b2000 ffff881063754000 ffff881063754000 ffff88104e0b2028 ffff880861a53998 Call Trace: [] i40e_vsi_setup+0x543/0x880 [i40e_zc] [] ? i40e_aq_set_switch_config+0x9d/0xd0 [i40e_zc] [] i40e_setup_pf_switch+0x47f/0x5d0 [i40e_zc] [] i40e_probe+0xd8a/0x17e8 [i40e_zc] [] ? schedule+0x3ee/0xb70 [] ? idr_get_empty_slot+0x110/0x2c0 [] ? number+0x2ee/0x320 [] ? idr_get_empty_slot+0x110/0x2c0 [] ? find_inode+0x4e/0x90 [] ? sysfs_ilookup_test+0x0/0x20 [] ? iput+0x30/0x70 [] ? sysfs_addrm_finish+0x4e/0x270 [] ? __sysfs_add_one+0x7e/0xc0 [] ? sysfs_add_one+0x2c/0xd0 [] local_pci_probe+0x17/0x20 [] pci_device_probe+0x101/0x120 [] ? driver_sysfs_add+0x62/0x90 [] driver_probe_device+0xaa/0x3a0 [] __driver_attach+0xab/0xb0 [] ? __driver_attach+0x0/0xb0 [] bus_for_each_dev+0x64/0x90 [] driver_attach+0x1e/0x20 [] bus_add_driver+0x1e8/0x2b0 [] driver_register+0x5f/0xe0 [] ? i40e_init_module+0x0/0xa3 [i40e_zc] [] __pci_register_driver+0x56/0xd0 [] ? debugfs_create_dir+0x1b/0x20 udev: renamed network interface eth10 to eth16 [] ? i40e_init_module+0x0/0xa3 [i40e_zc] [] i40e_init_module+0xa1/0xa3 [i40e_zc] [] do_one_initcall+0xc0/0x280 [] sys_init_module+0xe1/0x250 [] system_call_fastpath+0x16/0x1b Code: 00 49 89 9d a8 00 00 00 48 8b 83 18 01 00 00 49 89 45 00 66 83 83 30 01 00 00 01 4d 85 f6 4c 89 ab 18 01 00 00 0f 84 05 01 00 00 <49> 89 9e a8 00 00 00 48 8b 83 f0 00 00 00 41 83 c7 01 49 89 06 RIP [] i40e_vsi_map_rings_to_vectors+0xf3/0x280 [i40e_zc] RSP
    ---[ end trace c4414a8eb6ab10b9 ]--- Kernel panic - not syncing: Fatal exception Pid: 10278, comm: modprobe Tainted: G D -- ------------ 2.6.32-696.13.2.el6.x86_64 #1 Call Trace: [] ? panic+0xa7/0x179 [] ? oops_end+0xe4/0x100 [] ? die+0x5b/0x90 [] ? do_general_protection+0x152/0x160 [] ? general_protection+0x25/0x30 [] ? i40e_vsi_map_rings_to_vectors+0xf3/0x280 [i40e_zc] [] ? i40e_vsi_setup+0x543/0x880 [i40e_zc] [] ? i40e_aq_set_switch_config+0x9d/0xd0 [i40e_zc] [] ? i40e_setup_pf_switch+0x47f/0x5d0 [i40e_zc] [] ? i40e_probe+0xd8a/0x17e8 [i40e_zc] [] ? schedule+0x3ee/0xb70 [] ? idr_get_empty_slot+0x110/0x2c0 [] ? number+0x2ee/0x320 [] ? idr_get_empty_slot+0x110/0x2c0 [] ? find_inode+0x4e/0x90 [] ? sysfs_ilookup_test+0x0/0x20 [] ? iput+0x30/0x70 [] ? sysfs_addrm_finish+0x4e/0x270 [] ? __sysfs_add_one+0x7e/0xc0 [] ? sysfs_add_one+0x2c/0xd0 [] ? local_pci_probe+0x17/0x20 [] ? pci_device_probe+0x101/0x120 [] ? driver_sysfs_add+0x62/0x90 [] ? driver_probe_device+0xaa/0x3a0 [] ? __driver_attach+0xab/0xb0 [] ? __driver_attach+0x0/0xb0 [] ? bus_for_each_dev+0x64/0x90 [] ? driver_attach+0x1e/0x20 [] ? bus_add_driver+0x1e8/0x2b0 [] ? driver_register+0x5f/0xe0 [] ? i40e_init_module+0x0/0xa3 [i40e_zc] [] ? __pci_register_driver+0x56/0xd0 [] ? debugfs_create_dir+0x1b/0x20 [] ? i40e_init_module+0x0/0xa3 [i40e_zc] [] ? i40e_init_module+0xa1/0xa3 [i40e_zc] [] ? do_one_initcall+0xc0/0x280 [] ? sys_init_module+0xe1/0x250 [] ? system_call_fastpath+0x16/0x1b

    And the second dump.

    BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 IP: [] i40e_vsi_map_rings_to_vectors+0xf3/0x280 [i40e_zc] PGD 10716fc067 PUD 1063b61067 PMD 0 Oops: 0002 [#1] SMP
    last sysfs file: /sys/devices/pci0000:00/0000:00:07.0/0000:04:00.0/net/eth10/type CPU 21 Modules linked in: i40e_zc(+)(U) ixgbe_zc(U) pf_ring(U) vxlan netconsole configfs autofs4 bnx2fc fcoe libfcoe libfc 8021q scsi_transport_fc garp stp scsi_tg t llc ipmi_devintf power_meter acpi_ipmi ipmi_si ipmi_msghandler iTCO_wdt iTCO_vendor_support dcdbas serio_raw lpc_ich mfd_core sg i7core_edac edac_core ext 4 jbd2 mbcache sr_mod cdrom sd_mod crc_t10dif pata_acpi ata_generic ata_piix igb dca i2c_algo_bit i2c_core bnx2x ptp pps_core libcrc32c crc32c_intel be2iscs i bnx2i cnic uio cxgb4i iw_cxgb4 iw_cm cxgb4 cxgb3i libcxgbi iw_cxgb3 ib_core ib_addr ipv6 cxgb3 mdio libiscsi_tcp mpt2sas qla4xxx scsi_transport_sas raid_c lass iscsi_boot_sysfs libiscsi bnx2 scsi_transport_iscsi wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ixgbe]

    Pid: 6259, comm: modprobe Not tainted 2.6.32-696.13.2.el6.x86_64 #1 Dell Inc. PowerEdge R910/0JRJM9 RIP: 0010:[] [] i40e_vsi_map_rings_to_vectors+0xf3/0x280 [i40e_zc] RSP: 0018:ffff88085ad9f908 EFLAGS: 00010292 RAX: 0000000000000034 RBX: ffff88106e591000 RCX: 0000000000004df1 RDX: 0000000000000000 RSI: 0000000000000046 RDI: 0000000000000246 RBP: ffff88085ad9f968 R08: 000000000002a73e R09: 0000000000000000 R10: 0000000000000080 R11: 0000000000000001 R12: ffff88106e499000 R13: ffff8810708e7b00 R14: 0000000000000000 R15: 0000000000000010 udev: renamed network interface eth10 to eth16 FS: 00007f8f3620d700(0000) GS:ffff88089c540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00000000000000a8 CR3: 0000001063cbe000 CR4: 00000000000007e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process modprobe (pid: 6259, threadinfo ffff88085ad9c000, task ffff88085cd16040) Stack: ffff88106e499000 0000000000000080 ffff881000000000 000000205728d020 0000001000000010 0000000100000010 ffff88085ad9f968 ffff88106e499000 ffff88106e632000 ffff88106e632000 ffff88106e499028 ffff88085ad9f998 Call Trace: [] i40e_vsi_setup+0x543/0x880 [i40e_zc] [] ? i40e_aq_set_switch_config+0x9d/0xd0 [i40e_zc] [] i40e_setup_pf_switch+0x47f/0x5d0 [i40e_zc] [] i40e_probe+0xd8a/0x17e8 [i40e_zc] [] ? __alloc_pages_nodemask+0x129/0x950 [] ? idr_get_empty_slot+0x110/0x2c0 [] ? number+0x2ee/0x320 [] ? idr_get_empty_slot+0x110/0x2c0 [] ? find_inode+0x4e/0x90 [] ? sysfs_ilookup_test+0x0/0x20 [] ? iput+0x30/0x70 [] ? sysfs_addrm_finish+0x4e/0x270 [] ? __sysfs_add_one+0x7e/0xc0 [] ? sysfs_add_one+0x2c/0xd0 [] local_pci_probe+0x17/0x20 [] pci_device_probe+0x101/0x120 [] ? driver_sysfs_add+0x62/0x90 [] driver_probe_device+0xaa/0x3a0 [] __driver_attach+0xab/0xb0 [] ? __driver_attach+0x0/0xb0 [] bus_for_each_dev+0x64/0x90 [] driver_attach+0x1e/0x20 [] bus_add_driver+0x1e8/0x2b0 [] driver_register+0x5f/0xe0 [] ? i40e_init_module+0x0/0xa3 [i40e_zc] [] __pci_register_driver+0x56/0xd0 [] ? debugfs_create_dir+0x1b/0x20 [] ? i40e_init_module+0x0/0xa3 [i40e_zc] [] i40e_init_module+0xa1/0xa3 [i40e_zc] [] do_one_initcall+0xc0/0x280 [] sys_init_module+0xe1/0x250 [] system_call_fastpath+0x16/0x1b Code: 00 49 89 9d a8 00 00 00 48 8b 83 18 01 00 00 49 89 45 00 66 83 83 30 01 00 00 01 4d 85 f6 4c 89 ab 18 01 00 00 0f 84 05 01 00 00 <49> 89 9e a8 00 00 00 48 8b 83 f0 00 00 00 41 83 c7 01 49 89 06 RIP [] i40e_vsi_map_rings_to_vectors+0xf3/0x280 [i40e_zc] RSP
    CR2: 00000000000000a8
    ---[ end trace 70024f26b6d6bbcb ]--- Kernel panic - not syncing: Fatal exception Pid: 6259, comm: modprobe Tainted: G D -- ------------ 2.6.32-696.13.2.el6.x86_64 #1 Call Trace: [] ? panic+0xa7/0x179 [] ? oops_end+0xe4/0x100 [] ? no_context+0xfb/0x260 [] ? check_preempt_curr+0x7c/0x90 [] ? __bad_area_nosemaphore+0x125/0x1e0 [] ? bad_area+0x4e/0x60 [] ? __do_page_fault+0x473/0x500 [] ? do_page_fault+0x3e/0xa0 [] ? page_fault+0x25/0x30 [] ? i40e_vsi_map_rings_to_vectors+0xf3/0x280 [i40e_zc] [] ? i40e_vsi_map_rings_to_vectors+0x235/0x280 [i40e_zc] [] ? i40e_vsi_setup+0x543/0x880 [i40e_zc] [] ? i40e_aq_set_switch_config+0x9d/0xd0 [i40e_zc] [] ? i40e_setup_pf_switch+0x47f/0x5d0 [i40e_zc] [] ? i40e_probe+0xd8a/0x17e8 [i40e_zc] [] ? __alloc_pages_nodemask+0x129/0x950 [] ? idr_get_empty_slot+0x110/0x2c0 [] ? number+0x2ee/0x320 [] ? idr_get_empty_slot+0x110/0x2c0 [] ? find_inode+0x4e/0x90 [] ? sysfs_ilookup_test+0x0/0x20 [] ? iput+0x30/0x70 [] ? sysfs_addrm_finish+0x4e/0x270 [] ? __sysfs_add_one+0x7e/0xc0 [] ? sysfs_add_one+0x2c/0xd0 [] ? local_pci_probe+0x17/0x20 [] ? pci_device_probe+0x101/0x120 [] ? driver_sysfs_add+0x62/0x90 [] ? driver_probe_device+0xaa/0x3a0 [] ? __driver_attach+0xab/0xb0 [] ? __driver_attach+0x0/0xb0 [] ? bus_for_each_dev+0x64/0x90 [] ? driver_attach+0x1e/0x20 [] ? bus_add_driver+0x1e8/0x2b0 [] ? driver_register+0x5f/0xe0 [] ? i40e_init_module+0x0/0xa3 [i40e_zc] [] ? __pci_register_driver+0x56/0xd0 [] ? debugfs_create_dir+0x1b/0x20 [] ? i40e_init_module+0x0/0xa3 [i40e_zc] [] ? i40e_init_module+0xa1/0xa3 [i40e_zc] [] ? do_one_initcall+0xc0/0x280 [] ? sys_init_module+0xe1/0x250 [] ? system_call_fastpath+0x16/0x1b

    opened by jeremyerb 34
  • i40e_zc driver causes kernel crash on driver reload

    i40e_zc driver causes kernel crash on driver reload

    When stopping and restarting pf_ring I occasionally get the following error:

    Mar 16 19:28:48 kernel: [ 3854.691370] ------------[ cut here ]------------ Mar 16 19:28:48 kernel: [ 3854.691388] WARNING: CPU: 12 PID: 10483 at /build/linux-lts-vivid-ZTSmDy/linux-lts-vivid-3.19.0/net/sched/sch_generic.c:303 dev_watchdog+0x24f/0x260() Mar 16 19:28:48 kernel: [ 3854.691390] NETDEV WATCHDOG: (i40e): transmit queue 0 timed out Mar 16 19:28:48 kernel: [ 3854.691391] Modules linked in: i40e_zc(OE) configfs pf_ring(OE) 8021q garp mrp stp llc bonding intel_rapl iosf_mbi x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd ast ttm drm_kms_helper joydev drm i2c_algo_bit syscopyarea sysfillrect sysimgblt sb_edac edac_core mei_me ioatdma mei shpchp lpc_ich wmi ipmi_ssif 8250_fintek lp parport acpi_power_meter mac_hid ipmi_si ipmi_devintf ipmi_msghandler xfs libcrc32c raid10 raid456 async_raid6_recov async_memcpy ixgbe async_pq async_xor async_tx ses xor enclosure hid_generic dca raid6_pq vxlan usbhid ip6_udp_tunnel raid1 udp_tunnel ahci ptp raid0 hid libahci megaraid_sas mdio pps_core multipath linear [last unloaded: i40e] Mar 16 19:28:48 kernel: [ 3854.691449] CPU: 12 PID: 10483 Comm: n2disk10gzc Tainted: G OE 3.19.0-56-generic #62~14.04.1-Ubuntu Mar 16 19:28:48 kernel: [ 3854.691450] Hardware name: Supermicro SSG-6048R-E1CR36H/X10DRH-iT, BIOS 1.1 05/15/2015 Mar 16 19:28:48 kernel: [ 3854.691452] ffffffff81b406e0 ffff887f7f103d58 ffffffff817b11bf 0000000000000000 Mar 16 19:28:48 kernel: [ 3854.691454] ffff887f7f103da8 ffff887f7f103d98 ffffffff81074e3a 0000000000000286 Mar 16 19:28:48 kernel: [ 3854.691456] 0000000000000000 ffff883f63391000 0000000000000001 ffff883f60e6aa80 Mar 16 19:28:48 kernel: [ 3854.691458] Call Trace: Mar 16 19:28:48 kernel: [ 3854.691460] [] dump_stack+0x45/0x57 Mar 16 19:28:48 kernel: [ 3854.691477] [] warn_slowpath_common+0x8a/0xc0 Mar 16 19:28:48 kernel: [ 3854.691479] [] warn_slowpath_fmt+0x46/0x50 Mar 16 19:28:48 kernel: [ 3854.691482] [] dev_watchdog+0x24f/0x260 Mar 16 19:28:48 kernel: [ 3854.691484] [] ? dev_graft_qdisc+0x80/0x80 Mar 16 19:28:48 kernel: [ 3854.691490] [] call_timer_fn+0x39/0x110 Mar 16 19:28:48 kernel: [ 3854.691492] [] ? dev_graft_qdisc+0x80/0x80 Mar 16 19:28:48 kernel: [ 3854.691495] [] run_timer_softirq+0x220/0x320 Mar 16 19:28:48 kernel: [ 3854.691501] [] ? lapic_next_deadline+0x33/0x40 Mar 16 19:28:48 kernel: [ 3854.691504] [] __do_softirq+0xe4/0x270 Mar 16 19:28:48 kernel: [ 3854.691506] [] irq_exit+0x9d/0xb0 Mar 16 19:28:48 kernel: [ 3854.691511] [] smp_apic_timer_interrupt+0x4a/0x60 Mar 16 19:28:48 kernel: [ 3854.691514] [] apic_timer_interrupt+0x6d/0x80 Mar 16 19:28:48 kernel: [ 3854.691515] Mar 16 19:28:48 kernel: [ 3854.691516] ---[ end trace d39b52156519537b ]---

    Ubuntu 14.04 LTS ii pfring 6.3.0-488 amd64 PF_RING (http://www.ntop.org/pf_ring/) [dev:e4de2809f749eaddbd678fc11466606049538a68 (Tue Mar 15 18:32:47 2016 +0100)] ii pfring-dkms 6.3.0 all PF_RING driver in DKMS format. GIT info: dev:9bff2453ee32236a01d24cbe9754887e6688556d (Fri Feb 26 18:10:22 2016 +0100) ii pfring-drivers-zc-dkms 1.2 all Virtual package for ZC drivers in DKMS format (http://www.ntop.org/pf_ring/).

    opened by JeremyAshton 34
  • BPF Filters not working

    BPF Filters not working

    With normal tcpdump :

    % tcpdump -i enp4s0 -nn -c 10 'port 22' tcpdump: WARNING: enp4s0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enp4s0, link-type EN10MB (Ethernet), capture size 65535 bytes 17:50:00.338419 IP XX.XX.XX.XX.22 > XX.XX.XX.XX.60212: Flags [.], seq 2354062218:2354063678, ack 800994694, win 2380, length 1460 17:50:00.338438 IP XX.XX.XX.XX.22 > XX.XX.XX.XX.64833: Flags [P.], seq 652703376:652703456, ack 606406036, win 5657, length 80 17:50:00.338466 IP XX.XX.XX.XX.64833 > XX.XX.XX.XX.22: Flags [.], ack 0, win 255, length 0 17:50:00.338482 IP XX.XX.XX.XX.22 > XX.XX.XX.XX.60212: Flags [.], seq 1460:8760, ack 1, win 2380, length 7300 17:50:00.339772 IP XX.XX.XX.XX.60212 > XX.XX.XX.XX.22: Flags [P.], seq 1:69, ack 32872, win 10519, length 68 17:50:00.339786 IP XX.XX.XX.XX.22 > XX.XX.XX.XX.64833: Flags [P.], seq 480:560, ack 1, win 5657, length 80 17:50:00.339789 IP XX.XX.XX.XX.64833 > XX.XX.XX.XX.22: Flags [.], ack 480, win 253, length 0 17:50:00.339953 IP XX.XX.XX.XX.22 > XX.XX.XX.XX.64833: Flags [P.], seq 560:640, ack 1, win 5657, length 80 17:50:00.340376 IP XX.XX.XX.XX.22 > XX.XX.XX.XX.64833: Flags [P.], seq 640:720, ack 1, win 5657, length 80 17:50:00.340382 IP XX.XX.XX.XX.64833 > XX.XX.XX.XX.22: Flags [.], ack 640, win 252, length 0 10 packets captured 895 packets received by filter 795 packets dropped by kernel

    With PF_RING's tcpdump :

    % /opt/pf/sbin/tcpdump -i enp4s0 -nn -c 10 'port 22'
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on enp4s0, link-type EN10MB (Ethernet), capture size 262144 bytes
    21:50:05.398683938 IP XX.XX.XX.XX.80 > XX.XX.XX.XX.53190: Flags [.], seq 3437247066:3437255826, ack 3263609792, win 513, length 8760
    21:50:05.398703325 IP XX.XX.XX.XX.443 > XX.XX.XX.XX.56136: Flags [.], seq 1570714451:1570725683, ack 3907642189, win 273, length 11232
    21:50:05.398712933 IP XX.XX.XX.XX.65125 > XX.XX.XX.XX.80: Flags [.], seq 2597100314:2597101774, ack 535663878, win 63855, length 1460
    21:50:05.398721319 IP XX.XX.XX.XX.50271 > XX.XX.XX.XX.59307: Flags [.], seq 1379174102:1379181402, ack 3144835430, win 32768, length 7300
    21:50:05.398728562 IP XX.XX.XX.XX.443 > XX.XX.XX.XX.57125: UDP, length 1453
    21:50:05.398732652 IP XX.XX.XX.XX.443 > XX.XX.XX.XX.57125: UDP, length 1453
    21:50:05.398736106 IP XX.XX.XX.XX.80 > XX.XX.XX.XX.36922: Flags [.], seq 308270661:308272109, ack 565323857, win 2050, options [nop,nop,TS val 2804111279 ecr 225559], length 1448
    21:50:05.398739251 IP XX.XX.XX.XX.59307 > XX.XX.XX.XX.50271: Flags [.], ack 4294798264, win 12285, length 0
    21:50:05.398740596 IP XX.XX.XX.XX.52813 > XX.XX.XX.XX.80: Flags [.], ack 3304701303, win 11946, options [nop,nop,TS val 1567099780 ecr 576135852,nop,nop,sack 1 {1449:60817}], length 0
    21:50:05.398743104 IP XX.XX.XX.XX.52813 > XX.XX.XX.XX.80: Flags [.], ack 1, win 11946, options [nop,nop,TS val 1567099780 ecr 576135852,nop,nop,sack 1 {1449:62265}], length 0
    10 packets captured
    10 packets received by filter
    0 packets dropped by kernel
    

    RH Ver : 3.10.0-327.13.1.el7.x86_64 PF_RING Ver :

    PF_RING Version          : 6.3.0 (dev:d568ce59908fd0021ec7910b0563db191301e61c)
    Total rings              : 1
    
    Standard (non DNA/ZC) Options
    Ring slots               : 4096
    Slot version             : 16
    Capture TX               : Yes [RX+TX]
    IP Defragment            : No
    Socket Mode              : Standard
    Total plugins            : 0
    Cluster Fragment Queue   : 0
    Cluster Fragment Discard : 0
    
    opened by jimhranicky 33
  • pfring_zc_send_pkt error processing

    pfring_zc_send_pkt error processing

    I have problem with pfring_zc_send_pkt(queue, pkt_handle, 1); For some reason (most likely eror in my code) after several days work, I get error for checking pfring_zc_send_pkt(queue, pkt_handle, 1) < 0 Packet length 1518 But strerror(errsv) equal "Success" errsv:0 errsv = errno; It not be such big problem, if it happens only once. But when it happens for all next packets I get the same problem (pfring_zc_send_pkt(queue, pkt_handle, 1) < 0) Why this can happen? 1518 (pfring_zc_pkt_buff len) it's ok? And how I must process this error? If this error happen what pf ring doing with this packet? Clear buffer? When after this error I try get new packet pfring_zc_pkt_buff_data(pkt_handle, queue) I really get new packet? Or I get the same packet? I don't understand why:

    • packet length 1518 happen
    • after first error, other packets don't sending too.
    opened by andyarus 32
  • kernel panic when parse  Ethernet frame with 802.1Q tag, but frame length only 64 bytes

    kernel panic when parse Ethernet frame with 802.1Q tag, but frame length only 64 bytes

    kernel panic log:

    [974431.832901] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffc0b749c0
    
    [974431.833999] CPU: 21 PID: 0 Comm: swapper/21 Kdump: loaded Tainted: G           OE  ------------   3.10.0-957.1.3.el7.x86_64 #1
    [974431.835340] Hardware name: Supermicro Super Server/X10DRL-LN4, BIOS 2.0a 04/28/2017
    [974431.836025] Call Trace:
    [974431.836623]  <IRQ>  [<ffffffffa8561e41>] dump_stack+0x19/0x1b
    [974431.837289]  [<ffffffffa855b550>] panic+0xe8/0x21f
    [974431.837893]  [<ffffffffc0b749c0>] ? parse_pkt.isra.29+0x2a0/0x2a0 [pf_ring]
    [974431.838483]  [<ffffffffa7e973bb>] __stack_chk_fail+0x1b/0x20
    [974431.839130]  [<ffffffffc0b749c0>] parse_pkt.isra.29+0x2a0/0x2a0 [pf_ring]
    [974431.839775]  [<ffffffffc0b7904c>] skb_ring_handler+0x76c/0x1ee0 [pf_ring]
    [974431.840465]  [<ffffffffc0b7991c>] ? skb_ring_handler+0x103c/0x1ee0 [pf_ring]
    [974431.841167]  [<ffffffffa7f4a6d5>] ? handle_irq_event_percpu+0x55/0x80
    [974431.841848]  [<ffffffffa7e2e554>] ? handle_irq+0xe4/0x1a0
    [974431.842574]  [<ffffffffc0b7a855>] packet_rcv+0x95/0xb0 [pf_ring]
    [974431.843368]  [<ffffffffa84235aa>] ? kfree_skb+0x3a/0xa0
    [974431.844102]  [<ffffffffa8438f78>] __netif_receive_skb_core+0x128/0xa10
    [974431.844792]  [<ffffffffa84b6d00>] ? udp4_gro_receive+0x130/0x2a0
    [974431.845497]  [<ffffffffa8439878>] __netif_receive_skb+0x18/0x60
    [974431.846246]  [<ffffffffa8439900>] netif_receive_skb_internal+0x40/0xc0
    [974431.847027]  [<ffffffffa843a588>] napi_gro_receive+0xd8/0x100
    [974431.847939]  [<ffffffffc04aba26>] igb_clean_rx_irq+0x356/0x800 [igb]
    [974431.848848]  [<ffffffffc04ac263>] igb_poll+0x393/0x770 [igb]
    [974431.849738]  [<ffffffffa8439f1f>] net_rx_action+0x26f/0x390
    [974431.850534]  [<ffffffffa7ea0f05>] __do_softirq+0xf5/0x280
    [974431.850538]  [<ffffffffa857832c>] call_softirq+0x1c/0x30
    [974431.850541]  [<ffffffffa7e2e675>] do_softirq+0x65/0xa0
    [974431.850543]  [<ffffffffa7ea1285>] irq_exit+0x105/0x110
    [974431.850548]  [<ffffffffa85795e6>] do_IRQ+0x56/0xf0
    [974431.850554]  [<ffffffffa856b362>] common_interrupt+0x162/0x162
    [974431.850566]  <EOI>  [<ffffffffa83ae227>] ? cpuidle_enter_state+0x57/0xd0
    [974431.850569]  [<ffffffffa83ae37e>] cpuidle_idle_call+0xde/0x230
    [974431.850573]  [<ffffffffa7e366de>] arch_cpu_idle+0xe/0xc0
    [974431.850580]  [<ffffffffa7efc49a>] cpu_startup_entry+0x14a/0x1e0
    [974431.850586]  [<ffffffffa7e57db7>] start_secondary+0x1f7/0x270
    [974431.850591]  [<ffffffffa7e000d5>] start_cpu+0x5/0x14
    

    invalid packet (remove .log suffix): one-64.pcap.log

    if i use bro with PF_RING enabled, and sniff packet from NIC , if this packet show in the traffic, kernel MUST be panic.

    My OS is: centos-7.4.1708 kernel version is: 3.10.0-957.1.3.el7.x86_64 CPU:

    [[email protected] 127.0.0.1-2019-10-23-19:36:52]# lshw -c cpu
      *-cpu:0
           description: CPU
           product: Intel(R) Xeon(R) CPU E5-2620 v4 @ 2.10GHz
           vendor: Intel Corp.
           vendor_id: GenuineIntel
           physical id: 30
           bus info: [email protected]
           version: Intel(R) Xeon(R) CPU E5-2620 v4 @ 2.10GHz
           slot: CPU1
           size: 1230MHz
           capacity: 4GHz
           width: 64 bits
           clock: 100MHz
           capabilities: lm fpu fpu_exception wp vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp x86-64 constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb cat_l3 cdp_l3 intel_ppin intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdt_a rdseed adx smap xsaveopt cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts cpufreq
           configuration: cores=8 enabledcores=8 threads=16
      *-cpu:1
           description: CPU
           product: Intel(R) Xeon(R) CPU E5-2620 v4 @ 2.10GHz
           vendor: Intel Corp.
           vendor_id: GenuineIntel
           physical id: 34
           bus info: [email protected]
           version: Intel(R) Xeon(R) CPU E5-2620 v4 @ 2.10GHz
           slot: CPU2
           size: 1200MHz
           capacity: 4GHz
           width: 64 bits
           clock: 100MHz
           capabilities: lm fpu fpu_exception wp vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp x86-64 constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb cat_l3 cdp_l3 intel_ppin intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdt_a rdseed adx smap xsaveopt cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts cpufreq
           configuration: cores=8 enabledcores=8 threads=16
    

    NIC:

    *-network:3
           description: Ethernet interface
           product: I350 Gigabit Network Connection
           vendor: Intel Corporation
           physical id: 0.3
           bus info: [email protected]:03:00.3
           logical name: eno4
           version: 01
           serial: ac:1f:6b:61:19:3f
           capacity: 1Gbit/s
           width: 32 bits
           clock: 33MHz
           capabilities: pm msi msix pciexpress bus_master cap_list ethernet physical tp 10bt 10bt-fd 100bt 100bt-fd 1000bt-fd autonegotiation
           configuration: autonegotiation=on broadcast=yes driver=igb driverversion=5.4.0-k firmware=1.63, 0x800009fa ip=192.168.0.3 latency=0 link=no multicast=yes port=twisted pair
           resources: irq:68 memory:c7100000-c711ffff ioport:6000(size=32) memory:c7180000-c7183fff memory:900c0000-900dffff memory:900e0000-900fffff
    
    opened by Ivlyth 31
  • PF_RING ZC: ixgbe virtual function support

    PF_RING ZC: ixgbe virtual function support

    Hello, folks!

    I have multiple virtual functions with ixgbe.

    I have changed following lines in load_driver.sh:

    -insmod ./ixgbe.ko RSS=1,1,1,1
    +insmod ./ixgbe.ko RSS=1,1,1,1 max_vfs=2,2
    

    Thus, I tuned virtual functions and set mac's for they:

    ip link set eth6 vf 0 mac 90:e2:ba:55:aa:bb
    ip link set eth6 vf 1 mac 90:e2:ba:55:bb:cc
    

    And apply changes:

    rmmod ixgbevf
    modprobe ixgbevf
    

    Thus, I have single physical NIC and two virtual NIC's:

    21: eth6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
        link/ether 90:e2:ba:4a:d8:e8 brd ff:ff:ff:ff:ff:ff
        vf 0 MAC 90:e2:ba:55:aa:bb, spoof checking on, link-state auto
        vf 1 MAC 90:e2:ba:55:bb:cc, spoof checking on, link-state auto
    29: eth10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
        link/ether 90:e2:ba:55:aa:bb brd ff:ff:ff:ff:ff:ff
    30: eth11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
        link/ether 90:e2:ba:55:bb:cc brd ff:ff:ff:ff:ff:ff
    

    And I have enabled all NICs:

    ifconfig eth6 up
    ifconfig eth10 up
    ifconfig eth11 up
    

    And all nic's become ready:

    [email protected] /usr/src/PF_RING-6.0.3/userland/examples_zc # ethtool eth10
    Settings for eth10:
        Supported ports: [ ]
        Supported link modes:   10000baseT/Full 
        Supported pause frame use: No
        Supports auto-negotiation: No
        Advertised link modes:  Not reported
        Advertised pause frame use: No
        Advertised auto-negotiation: No
        Speed: 10000Mb/s
        Duplex: Full
        Port: Other
        PHYAD: 0
        Transceiver: Unknown!
        Auto-negotiation: off
        Current message level: 0x00000007 (7)
                       drv probe link
        Link detected: yes
    [email protected] /usr/src/PF_RING-6.0.3/userland/examples_zc # ethtool eth11
    Settings for eth11:
        Supported ports: [ ]
        Supported link modes:   10000baseT/Full 
        Supported pause frame use: No
        Supports auto-negotiation: No
        Advertised link modes:  Not reported
        Advertised pause frame use: No
        Advertised auto-negotiation: No
        Speed: 10000Mb/s
        Duplex: Full
        Port: Other
        PHYAD: 0
        Transceiver: Unknown!
        Auto-negotiation: off
        Current message level: 0x00000007 (7)
                       drv probe link
        Link detected: yes
    [email protected] /usr/src/PF_RING-6.0.3/userland/examples_zc # ethtool eth6
    Settings for eth6:
        Supported ports: [ FIBRE ]
        Supported link modes:   1000baseT/Full 
                                10000baseT/Full 
        Supported pause frame use: No
        Supports auto-negotiation: Yes
        Advertised link modes:  1000baseT/Full 
                                10000baseT/Full 
        Advertised pause frame use: Symmetric
        Advertised auto-negotiation: Yes
        Speed: 10000Mb/s
        Duplex: Full
        Port: FIBRE
        PHYAD: 0
        Transceiver: external
        Auto-negotiation: on
        Supports Wake-on: d
        Wake-on: d
        Current message level: 0x00000007 (7)
                       drv probe link
        Link detected: yes
    

    Well! I could run PF_RING ZC.

    It works perfectly for physical interface:

    ./zcount -c 0 -i zc:eth6
    #########################################################################
    # ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150330 for eth6 [Intel 10 Gbit ixgbe 82599-based]
    # ERROR: Please get one at http://shop.ntop.org/.
    #########################################################################
    # We're now working in demo mode with packet capture and          
    # transmission limited to 5 minutes
    #########################################################################
    #########################################################################
    # ERROR: You do not seem to have a valid PF_RING ZC license 6.0.3.150330 for eth6 [Intel 10 Gbit ixgbe 82599-based]
    # ERROR: Please get one at http://shop.ntop.org/.
    #########################################################################
    =========================
    Absolute Stats: 0 pkts (0 drops) - 0 bytes
    =========================
    
    ^CLeaving...
    =========================
    Absolute Stats: 0 pkts (0 drops) - 0 bytes
    Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps
    =========================
    
    =========================
    Absolute Stats: 0 pkts (0 drops) - 0 bytes
    Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps
    

    But for virtual functions it did not work at all:

    ./zcount -c 0 -i zc:eth10
    pfring_zc_open_device error [Socket operation on non-socket] Please check that zc:eth10 is up and not already used
    
    [email protected] /usr/src/PF_RING-6.0.3/userland/examples_zc # ./zcount -c 0 -i zc:eth11
    pfring_zc_open_device error [Socket operation on non-socket] Please check that zc:eth11 is up and not already used
    

    Could you add support for PF_RING which run on top of virtual functions?

    enhancement 
    opened by pavel-odintsov 30
  • Two X710 for 80G using PF_RING ZC

    Two X710 for 80G using PF_RING ZC

    I try to use PF_RING zc and dual port X710 to receive 80G, but i saw Intel X710 datasheet says that "The total supported supported by the X710/XXV710/XL710 is 40 Gb/s, even when connected via two 40 Gb/s connections."

    Now i use two X710 NIC and PF_RING ZC to try receive 80G. So here comes the question. ./zbalance_ipc -i zc:ens4f0,zc:ens8f0 -c 99 -n 1 -m 1 -g 0 -p Is this the way to receive two different NIC flow by one process? because everytime i use zbalance_ipc, it always drop packet and total highest speed is close to 40G.

    opened by brett90063 24
  • Install issue

    Install issue

    Using CentOS 7

    get this when I make

    [[email protected] PF_RING]# cd kernel/
    [[email protected] kernel]# ls
    configure  configure.in  dkms.conf.in  linux  Makefile  Makefile.dkms.in  pf_ring.c  pfring-dkms-mkdeb  pfring-dkms-mkrpm.spec.in  README
    [[email protected] kernel]# make
    make -C /lib/modules/3.10.0-862.el7.x86_64/build SUBDIRS=/etc/yum.repos.d/PF_RING/kernel EXTRA_CFLAGS='-I/etc/yum.repos.d/PF_RING/kernel -DGIT_REV="\"dev:37125e31732ccf5fdac782e6ddc92761124485c5\"" -fno-pie' modules
    make: *** /lib/modules/3.10.0-862.el7.x86_64/build: No such file or directory.  Stop.
    make: *** [all] Error 2
    

    Any ideas?

    opened by waynemillskidals 24
  • [FB] Fatal error 37: Allocating Tx memory area failed.

    [FB] Fatal error 37: Allocating Tx memory area failed.

    We are using PF_RING 7.0.0 with Fiberblaze NIC cards. For network troubleshooting, we tend to collect pcap files with the tcpdump command provided with the package. So far we had no issues but today we received the following error:

    [email protected]:~/# /usr/local/src/PF_RING-7.0.0/userland/tcpdump/tcpdump -i fbcard:0:f/b:0 -w /var/traces/test.pcap -G 86400 -C 50 -K -n tcpdump: listening on fbcard:0:f/b:0, link-type EN10MB (Ethernet), capture size 262144 bytes [FB] Fatal error 37: Allocating Tx memory area failed.

    Could you please advise on how to overcome this issue?

    I also see that dmesg outputs the following: [2313169.749777] tcpdump: page allocation failure: order:9, mode:0x20 [2313169.749779] Pid: 7812, comm: tcpdump Tainted: PF W O 3.8.0-29-generic #42~precise1-Ubuntu [2313169.749780] Call Trace: [2313169.749787] [] warn_alloc_failed+0xf6/0x150 [2313169.749790] [] ? wakeup_kswapd+0x69/0x160 [2313169.749792] [] __alloc_pages_nodemask+0x860/0x990 [2313169.749794] [] ? wakeup_kswapd+0x69/0x160 [2313169.749798] [] alloc_pages_current+0xba/0x170 [2313169.749799] [] __get_free_pages+0xe/0x40 [2313169.749803] [] swiotlb_alloc_coherent+0x67/0x130 [2313169.749806] [] ? dma_generic_alloc_coherent+0xac/0x150 [2313169.749809] [] x86_swiotlb_alloc_coherent+0x59/0x60 [2313169.749814] [] alloc_dma_memory+0x8a/0xe0 [fbcapture] [2313169.749817] [] txAllocArea+0x66/0x300 [fbcapture] [2313169.749820] [] fb_ioctl+0xc93/0x1cc0 [fbcapture] [2313169.749824] [] ? _raw_spin_lock+0xe/0x20 [2313169.749827] [] ? remap_pte_range+0x114/0x160 [2313169.749830] [] ? remap_pfn_range+0x202/0x2e0 [2313169.749833] [] ? __rb_insert_augmented+0x9b/0x1d0 [2313169.749835] [] ? __rb_insert_augmented+0x9b/0x1d0 [2313169.749837] [] ? vma_interval_tree_insert+0x83/0x90 [2313169.749839] [] ? __vma_link_file+0x4c/0x80 [2313169.749841] [] ? vma_link+0x88/0xe0 [2313169.749843] [] ? mmap_region+0x2cd/0x630 [2313169.749845] [] ? do_mmap_pgoff+0x240/0x320 [2313169.749847] [] do_vfs_ioctl+0x8a/0x340 [2313169.749849] [] sys_ioctl+0x91/0xb0 [2313169.749851] [] system_call_fastpath+0x1a/0x1f [2313169.749852] Mem-Info: [2313169.749853] Node 0 DMA per-cpu: [2313169.749854] CPU 0: hi: 0, btch: 1 usd: 0 [2313169.749855] CPU 1: hi: 0, btch: 1 usd: 0 [2313169.749856] CPU 2: hi: 0, btch: 1 usd: 0 [2313169.749857] CPU 3: hi: 0, btch: 1 usd: 0 [2313169.749858] CPU 4: hi: 0, btch: 1 usd: 0 [2313169.749858] CPU 5: hi: 0, btch: 1 usd: 0 [2313169.749859] CPU 6: hi: 0, btch: 1 usd: 0 [2313169.749860] CPU 7: hi: 0, btch: 1 usd: 0 [2313169.749861] CPU 8: hi: 0, btch: 1 usd: 0 [2313169.749861] CPU 9: hi: 0, btch: 1 usd: 0 [2313169.749862] CPU 10: hi: 0, btch: 1 usd: 0 [2313169.749863] CPU 11: hi: 0, btch: 1 usd: 0 [2313169.749864] CPU 12: hi: 0, btch: 1 usd: 0 [2313169.749865] CPU 13: hi: 0, btch: 1 usd: 0 [2313169.749865] CPU 14: hi: 0, btch: 1 usd: 0 [2313169.749866] CPU 15: hi: 0, btch: 1 usd: 0 [2313169.749867] CPU 16: hi: 0, btch: 1 usd: 0 [2313169.749868] CPU 17: hi: 0, btch: 1 usd: 0 [2313169.749868] CPU 18: hi: 0, btch: 1 usd: 0 [2313169.749869] CPU 19: hi: 0, btch: 1 usd: 0 [2313169.749870] CPU 20: hi: 0, btch: 1 usd: 0 [2313169.749871] CPU 21: hi: 0, btch: 1 usd: 0 [2313169.749872] CPU 22: hi: 0, btch: 1 usd: 0 [2313169.749872] CPU 23: hi: 0, btch: 1 usd: 0 [2313169.749873] Node 0 DMA32 per-cpu: [2313169.749874] CPU 0: hi: 186, btch: 31 usd: 77 [2313169.749875] CPU 1: hi: 186, btch: 31 usd: 183 [2313169.749876] CPU 2: hi: 186, btch: 31 usd: 36 [2313169.749876] CPU 3: hi: 186, btch: 31 usd: 93 [2313169.749877] CPU 4: hi: 186, btch: 31 usd: 0 [2313169.749878] CPU 5: hi: 186, btch: 31 usd: 162 [2313169.749879] CPU 6: hi: 186, btch: 31 usd: 0 [2313169.749879] CPU 7: hi: 186, btch: 31 usd: 49 [2313169.749880] CPU 8: hi: 186, btch: 31 usd: 155 [2313169.749881] CPU 9: hi: 186, btch: 31 usd: 151 [2313169.749881] CPU 10: hi: 186, btch: 31 usd: 102 [2313169.749883] CPU 11: hi: 186, btch: 31 usd: 183 [2313169.749884] CPU 12: hi: 186, btch: 31 usd: 175 [2313169.749885] CPU 13: hi: 186, btch: 31 usd: 140 [2313169.749886] CPU 14: hi: 186, btch: 31 usd: 2 [2313169.749887] CPU 15: hi: 186, btch: 31 usd: 161 [2313169.749888] CPU 16: hi: 186, btch: 31 usd: 3 [2313169.749888] CPU 17: hi: 186, btch: 31 usd: 55 [2313169.749889] CPU 18: hi: 186, btch: 31 usd: 0 [2313169.749890] CPU 19: hi: 186, btch: 31 usd: 77 [2313169.749891] CPU 20: hi: 186, btch: 31 usd: 0 [2313169.749891] CPU 21: hi: 186, btch: 31 usd: 42 [2313169.749892] CPU 22: hi: 186, btch: 31 usd: 178 [2313169.749893] CPU 23: hi: 186, btch: 31 usd: 145 [2313169.749893] Node 0 Normal per-cpu: [2313169.749894] CPU 0: hi: 186, btch: 31 usd: 101 [2313169.749895] CPU 1: hi: 186, btch: 31 usd: 167 [2313169.749896] CPU 2: hi: 186, btch: 31 usd: 155 [2313169.749897] CPU 3: hi: 186, btch: 31 usd: 164 [2313169.749897] CPU 4: hi: 186, btch: 31 usd: 73 [2313169.749898] CPU 5: hi: 186, btch: 31 usd: 177 [2313169.749899] CPU 6: hi: 186, btch: 31 usd: 68 [2313169.749900] CPU 7: hi: 186, btch: 31 usd: 176 [2313169.749901] CPU 8: hi: 186, btch: 31 usd: 94 [2313169.749901] CPU 9: hi: 186, btch: 31 usd: 176 [2313169.749902] CPU 10: hi: 186, btch: 31 usd: 65 [2313169.749903] CPU 11: hi: 186, btch: 31 usd: 183 [2313169.749904] CPU 12: hi: 186, btch: 31 usd: 99 [2313169.749905] CPU 13: hi: 186, btch: 31 usd: 134 [2313169.749905] CPU 14: hi: 186, btch: 31 usd: 83 [2313169.749906] CPU 15: hi: 186, btch: 31 usd: 159 [2313169.749907] CPU 16: hi: 186, btch: 31 usd: 131 [2313169.749908] CPU 17: hi: 186, btch: 31 usd: 171 [2313169.749909] CPU 18: hi: 186, btch: 31 usd: 123 [2313169.749909] CPU 19: hi: 186, btch: 31 usd: 170 [2313169.749910] CPU 20: hi: 186, btch: 31 usd: 106 [2313169.749911] CPU 21: hi: 186, btch: 31 usd: 185 [2313169.749912] CPU 22: hi: 186, btch: 31 usd: 69 [2313169.749912] CPU 23: hi: 186, btch: 31 usd: 170 [2313169.749913] Node 1 Normal per-cpu: [2313169.749914] CPU 0: hi: 186, btch: 31 usd: 162 [2313169.749915] CPU 1: hi: 186, btch: 31 usd: 22 [2313169.749916] CPU 2: hi: 186, btch: 31 usd: 0 [2313169.749917] CPU 3: hi: 186, btch: 31 usd: 39 [2313169.749917] CPU 4: hi: 186, btch: 31 usd: 0 [2313169.749918] CPU 5: hi: 186, btch: 31 usd: 16 [2313169.749919] CPU 6: hi: 186, btch: 31 usd: 0 [2313169.749920] CPU 7: hi: 186, btch: 31 usd: 35 [2313169.749921] CPU 8: hi: 186, btch: 31 usd: 0 [2313169.749921] CPU 9: hi: 186, btch: 31 usd: 40 [2313169.749922] CPU 10: hi: 186, btch: 31 usd: 161 [2313169.749923] CPU 11: hi: 186, btch: 31 usd: 30 [2313169.749924] CPU 12: hi: 186, btch: 31 usd: 177 [2313169.749925] CPU 13: hi: 186, btch: 31 usd: 68 [2313169.749925] CPU 14: hi: 186, btch: 31 usd: 0 [2313169.749926] CPU 15: hi: 186, btch: 31 usd: 131 [2313169.749927] CPU 16: hi: 186, btch: 31 usd: 0 [2313169.749928] CPU 17: hi: 186, btch: 31 usd: 24 [2313169.749928] CPU 18: hi: 186, btch: 31 usd: 0 [2313169.749929] CPU 19: hi: 186, btch: 31 usd: 112 [2313169.749930] CPU 20: hi: 186, btch: 31 usd: 0 [2313169.749931] CPU 21: hi: 186, btch: 31 usd: 19 [2313169.749931] CPU 22: hi: 186, btch: 31 usd: 179 [2313169.749932] CPU 23: hi: 186, btch: 31 usd: 29 [2313169.749935] active_anon:4277144 inactive_anon:640496 isolated_anon:0 [2313169.749935] active_file:12376829 inactive_file:12425030 isolated_file:0 [2313169.749935] unevictable:0 dirty:1222881 writeback:0 unstable:0 [2313169.749935] free:223060 slab_reclaimable:713276 slab_unreclaimable:24747 [2313169.749935] mapped:12913 shmem:2993 pagetables:14714 bounce:0 [2313169.749935] free_cma:0 [2313169.749937] Node 0 DMA free:15880kB min:8kB low:8kB high:12kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15640kB managed:15896kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:0kB slab_unreclaimable:16kB kernel_stack:0kB pagetables:0kB unstable:0kB bounce:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? yes [2313169.749940] lowmem_reserve[]: 0 2963 64451 64451 [2313169.749942] Node 0 DMA32 free:572988kB min:2068kB low:2584kB high:3100kB active_anon:199832kB inactive_anon:106276kB active_file:920172kB inactive_file:933336kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3035024kB managed:2986436kB mlocked:0kB dirty:195084kB writeback:0kB mapped:140kB shmem:128kB slab_reclaimable:225004kB slab_unreclaimable:12440kB kernel_stack:280kB pagetables:624kB unstable:0kB bounce:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:32 all_unreclaimable? no [2313169.749945] lowmem_reserve[]: 0 0 61488 61488 [2313169.749948] Node 0 Normal free:121780kB min:42956kB low:53692kB high:64432kB active_anon:4091200kB inactive_anon:877040kB active_file:26087148kB inactive_file:26133128kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:62963712kB managed:62911516kB mlocked:0kB dirty:1284964kB writeback:0kB mapped:24516kB shmem:6144kB slab_reclaimable:945684kB slab_unreclaimable:37676kB kernel_stack:2496kB pagetables:24848kB unstable:0kB bounce:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [2313169.749951] lowmem_reserve[]: 0 0 0 0 [2313169.749953] Node 1 Normal free:181592kB min:45068kB low:56332kB high:67600kB active_anon:12817544kB inactive_anon:1578668kB active_file:22499996kB inactive_file:22633656kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:66060288kB managed:66057020kB mlocked:0kB dirty:3411476kB writeback:0kB mapped:26996kB shmem:5700kB slab_reclaimable:1682416kB slab_unreclaimable:48856kB kernel_stack:2272kB pagetables:33384kB unstable:0kB bounce:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [2313169.749955] lowmem_reserve[]: 0 0 0 0 [2313169.749957] Node 0 DMA: 04kB 18kB (U) 016kB 032kB 264kB (U) 1128kB (U) 1256kB (U) 0512kB 11024kB (U) 12048kB (R) 34096kB (M) = 15880kB [2313169.749963] Node 0 DMA32: 244994kB (UEM) 321728kB (UEM) 749216kB (UEM) 234832kB (UEM) 18664kB (UEM) 27128kB (UEM) 8256kB (UEM) 6512kB (UEM) 21024kB (EM) 02048kB 04096kB = 572908kB [2313169.749980] Node 0 Normal: 214044kB (UEM) 39918kB (UEM) 116kB (M) 032kB 064kB 0128kB 0256kB 0512kB 01024kB 02048kB 14096kB (R) = 121656kB [2313169.749985] Node 1 Normal: 414084kB (UEM) 13898kB (UEM) 016kB 132kB (R) 064kB 1128kB (R) 1256kB (R) 1512kB (R) 11024kB (R) 12048kB (R) 04096kB = 180744kB [2313169.749991] 24815230 total pagecache pages [2313169.749992] 8231 pages in swap cache [2313169.749993] Swap cache stats: add 424798, delete 416567, find 4002470/4017633 [2313169.749994] Free swap = 14645196kB [2313169.749994] Total swap = 15624188kB [2313170.098287] 33554416 pages RAM [2313170.098289] 557039 pages reserved [2313170.098290] 26766740 pages shared [2313170.098291] 8416833 pages non-shared

    opened by dionum 24
  • VM crashing on machine with multiple docker cgroup networks when pf_ring kernel module is installed.

    VM crashing on machine with multiple docker cgroup networks when pf_ring kernel module is installed.

    I installed the current pf_ring kernel module (pfring 7.1.0-1752) in a system having multiple docker containers which create multiple network cgroups. The VM quickly becomes unstable and starts rebooting and the containers also start crashes.

    Here are some extracts from the vmcore-dmesg.txt (crash logs)

    [    1.675582] pf_ring: module verification failed: signature and/or required key missing - tainting kernel
    [    1.676035] [PF_RING] Welcome to PF_RING 7.1.0 ($Revision: dev:ec0bf5e8e11324a267f67b9a49be19339a965163$)
    (C) 2004-17 ntop.org
    [    1.676037] LINUX_VERSION_CODE 00030A00
    [    1.676038] [PF_RING] Min # ring slots 4096
    [    1.676039] [PF_RING] Slot version     17
    [    1.676039] [PF_RING] Capture TX       No [RX only]
    [    1.676040] [PF_RING] IP Defragment    No
    [    1.676045] NET: Registered protocol family 27
    [    1.676046] [PF_RING] Init network namespace ffffffff819e07c0
    [    1.676053] [PF_RING] registered /proc/net/pf_ring/
    [    1.676058] [PF_RING] Initialized correctly
    
    .....
    
    [   11.955061] [PF_RING] Init network namespace ffff8807fdcc8000
    [   11.955065] [PF_RING] registered /proc/net/pf_ring/
    [   12.001865] [PF_RING] Removing lo/info from /proc
    [   12.001868] [PF_RING] Removing lo from /proc
    [   12.282256] [PF_RING] Exit network namespace ffff8807fdcc8000
    [   12.312630] [PF_RING] Init network namespace ffff8807fdcc9080
    [   12.312634] [PF_RING] registered /proc/net/pf_ring/
    [   12.365377] [PF_RING] Removing lo/info from /proc
    [   12.365380] [PF_RING] Removing lo from /proc
    [   12.645608] [PF_RING] Exit network namespace ffff8807fdcc9080
    [   12.679004] [PF_RING] Init network namespace ffff8807fdcca100
    [   12.679013] [PF_RING] registered /proc/net/pf_ring/
    [   12.730767] [PF_RING] Removing lo/info from /proc
    [   12.730770] [PF_RING] Removing lo from /proc
    [   13.010926] [PF_RING] Exit network namespace ffff8807fdcca100
    [   13.035228] [PF_RING] Init network namespace ffff8800bb918000
    [   13.035235] [PF_RING] registered /proc/net/pf_ring/
    [   13.077794] [PF_RING] Removing lo/info from /proc
    [   13.077796] [PF_RING] Removing lo from /proc
    [   13.358304] [PF_RING] Exit network namespace ffff8800bb918000
    [   13.382641] [PF_RING] Init network namespace ffff8800bb919080
    [   13.382646] [PF_RING] registered /proc/net/pf_ring/
    [   13.431096] [PF_RING] Removing lo/info from /proc
    [   13.431099] [PF_RING] Removing lo from /proc
    [   13.715640] [PF_RING] Exit network namespace ffff8800bb919080
    [   13.727003] [PF_RING] Init network namespace ffff8800bb91a100
    [   13.727011] [PF_RING] registered /proc/net/pf_ring/
    [   13.798584] [PF_RING] Removing lo/info from /proc
    [   13.798589] [PF_RING] Removing lo from /proc
    
    ....
    
    [   18.860588] SELinux: initialized (dev dm-31, type xfs), uses xattr
    [   18.861513] device veth923e0c5 entered promiscuous mode
    [   18.861570] IPv6: ADDRCONF(NETDEV_UP): veth923e0c5: link is not ready
    [   18.861573] br-fad371a0f070: port 28(veth923e0c5) entered forwarding state
    [   18.861578] br-fad371a0f070: port 28(veth923e0c5) entered forwarding state
    [   18.870677] br-fad371a0f070: port 15(veth30b0109) entered disabled state
    [   18.871118] [PF_RING] Removing veth32a3547/info from /proc
    [   18.871120] [PF_RING] Removing veth32a3547 from /proc
    [   18.871255] [PF_RING] Removing veth30b0109/info from /proc
    [   18.871256] [PF_RING] Removing veth30b0109 from /proc
    [   18.871261] device veth30b0109 left promiscuous mode
    [   18.871268] br-fad371a0f070: port 15(veth30b0109) entered disabled state
    [   18.903227] [PF_RING] Removing veth38bf222/info from /proc
    [   18.903230] [PF_RING] Removing veth38bf222 from /proc
    [   18.942609] [PF_RING] Removing veth38bf222/info from /proc
    [   18.942612] [PF_RING] Removing veth38bf222 from /proc
    [   18.953570] IPv6: ADDRCONF(NETDEV_CHANGE): veth445327b: link becomes ready
    [   18.986017] XFS (dm-32): Mounting V4 Filesystem
    [   19.011657] br-fad371a0f070: port 28(veth923e0c5) entered disabled state
    [   19.053047] SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
    [   19.070124] SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs
    [   19.070446] [PF_RING] Init network namespace ffff8807fd605280
    [   19.070450] [PF_RING] registered /proc/net/pf_ring/
    [   19.070876] SELinux: initialized (dev proc, type proc), uses genfs_contexts
    
    
    .......
    
    
    [   33.639040] [PF_RING] Removing veth2653856/info from /proc
    [   33.639043] [PF_RING] Removing veth2653856 from /proc
    [   33.671899] [PF_RING] Removing veth2653856/info from /proc
    [   33.671903] [PF_RING] Removing veth2653856 from /proc
    [   33.672410] IPv6: ADDRCONF(NETDEV_CHANGE): veth74374c9: link becomes ready
    [   34.349456] br-fad371a0f070: port 28(veth923e0c5) entered forwarding state
    [   34.749962] [PF_RING] Removing eth0/info from /proc
    [   34.749966] [PF_RING] Removing eth0 from /proc
    [   34.750461] [PF_RING] Removing vethe3462b7/info from /proc
    [   34.750464] [PF_RING] Removing vethe3462b7 from /proc
    [   34.788142] br-fad371a0f070: port 29(veth0fd1d8b) entered disabled state
    [   34.788605] [PF_RING] Removing vethe3462b7/info from /proc
    [   34.788607] [PF_RING] Removing vethe3462b7 from /proc
    [   34.788756] [PF_RING] Removing veth0fd1d8b/info from /proc
    [   34.788757] [PF_RING] Removing veth0fd1d8b from /proc
    [   34.788760] device veth0fd1d8b left promiscuous mode
    [   34.788772] br-fad371a0f070: port 29(veth0fd1d8b) entered disabled state
    [   35.030529] [PF_RING] Removing eth0/info from /proc
    [   35.030533] [PF_RING] Removing eth0 from /proc
    [   35.031058] [PF_RING] Removing veth9f4c4c8/info from /proc
    [   35.031060] [PF_RING] Removing veth9f4c4c8 from /proc
    [   35.066633] br-fad371a0f070: port 12(vethb8a5fe9) entered disabled state
    [   35.067239] [PF_RING] Removing veth9f4c4c8/info from /proc
    [   35.067241] [PF_RING] Removing veth9f4c4c8 from /proc
    [   35.067430] [PF_RING] Removing vethb8a5fe9/info from /proc
    [   35.067432] [PF_RING] Removing vethb8a5fe9 from /proc
    [   35.067436] device vethb8a5fe9 left promiscuous mode
    [   35.067445] br-fad371a0f070: port 12(vethb8a5fe9) entered disabled state
    [   35.281925] XFS (dm-14): Mounting V4 Filesystem
    [   35.296373] [PF_RING] Removing lo/info from /proc
    [   35.296377] [PF_RING] Removing lo from /proc
    [   35.296378] ------------[ cut here ]------------
    [   35.296384] WARNING: at fs/proc/generic.c:562 remove_proc_entry+0x1a2/0x1b0()
    [   35.296386] remove_proc_entry: removing non-empty directory 'dev/lo', leaking at least 'info'
    [   35.296387] Modules linked in: xt_nat veth ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype iptable_filter xt_conntrack nf_nat nf_conntrack bridge stp llc dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio coretemp xfs libcrc32c dm_mod crc32_pclmul ghash_clmulni_intel ppdev aesni_intel lrw gf128mul glue_helper ablk_helper cryptd vmw_balloon pcspkr sg parport_pc parport vmw_vmci shpchp i2c_piix4 pf_ring(OF) ip_tables ext4 mbcache jbd2 sr_mod cdrom sd_mod crc_t10dif ata_generic pata_acpi crct10dif_pclmul crct10dif_common vmwgfx crc32c_intel serio_raw drm_kms_helper mptspi scsi_transport_spi ttm mptscsih ata_piix drm libata mptbase vmxnet3 i2c_core floppy
    [   35.296419] CPU: 6 PID: 88 Comm: kworker/u16:1 Tainted: GF          O--------------   3.10.0-229.el7.x86_64 #1
    [   35.296420] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 09/30/2014
    [   35.296424] Workqueue: netns cleanup_net
    [   35.296426]  ffff88081071ba98 000000004a323a51 ffff88081071ba50 ffffffff81604b0a
    [   35.296428]  ffff88081071ba88 ffffffff8106e34b ffff8800b99b0b80 0000000000000002
    [   35.296430]  ffff8800b99a6d08 ffff88075ccea3c0 ffff8800b99b0bf5 ffff88081071baf0
    [   35.296431] Call Trace:
    [   35.296438]  [<ffffffff81604b0a>] dump_stack+0x19/0x1b
    [   35.296442]  [<ffffffff8106e34b>] warn_slowpath_common+0x6b/0xb0
    [   35.296443]  [<ffffffff8106e3ec>] warn_slowpath_fmt+0x5c/0x80
    [   35.296445]  [<ffffffff81233fd2>] remove_proc_entry+0x1a2/0x1b0
    [   35.296450]  [<ffffffffa02744f3>] remove_device_from_proc.part.43+0x73/0x80 [pf_ring]
    [   35.296453]  [<ffffffffa02815ba>] remove_device_from_ring_list+0xda/0x180 [pf_ring]
    [   35.296456]  [<ffffffffa0281cf0>] ring_notifier+0x2c0/0x6d0 [pf_ring]
    [   35.296459]  [<ffffffff81508560>] ? neigh_ifdown+0xa0/0xf0
    [   35.296463]  [<ffffffff815b1229>] ? addrconf_ifdown+0x2b9/0x3e0
    [   35.296466]  [<ffffffff816103ac>] notifier_call_chain+0x4c/0x70
    [   35.296471]  [<ffffffff8109d556>] raw_notifier_call_chain+0x16/0x20
    [   35.296484]  [<ffffffff814f7d2d>] call_netdevice_notifiers+0x2d/0x60
    [   35.296486]  [<ffffffff814f9375>] rollback_registered_many+0x105/0x220
    [   35.296488]  [<ffffffff814f9519>] unregister_netdevice_many+0x19/0x50
    [   35.296489]  [<ffffffff814fa971>] default_device_exit_batch+0x151/0x190
    [   35.296491]  [<ffffffff81098350>] ? wake_up_bit+0x30/0x30
    [   35.296493]  [<ffffffff814f4933>] ops_exit_list.isra.1+0x53/0x60
    [   35.296495]  [<ffffffff814f51c0>] cleanup_net+0x110/0x260
    [   35.296498]  [<ffffffff8108f1db>] process_one_work+0x17b/0x470
    [   35.296500]  [<ffffffff8108ffbb>] worker_thread+0x11b/0x400
    [   35.296502]  [<ffffffff8108fea0>] ? rescuer_thread+0x400/0x400
    [   35.296504]  [<ffffffff8109739f>] kthread+0xcf/0xe0
    [   35.296505]  [<ffffffff810972d0>] ? kthread_create_on_node+0x140/0x140
    [   35.296507]  [<ffffffff8161497c>] ret_from_fork+0x7c/0xb0
    [   35.296509]  [<ffffffff810972d0>] ? kthread_create_on_node+0x140/0x140
    [   35.296510] ---[ end trace a89f8c7b63fe9b11 ]---
    [   35.322218] XFS (dm-14): Ending clean mount
    

    I am also attaching the entire log in case this doesn't help.

    Please advise.

    Only the kernel module is installed on the VM, the pfring-enhanced program is in another docker container. vmcore-dmesg.txt

    opened by JulianCeaser 24
  • PF-ring driver is queuing income packets up to 4 packets prior to releasing them to application.

    PF-ring driver is queuing income packets up to 4 packets prior to releasing them to application.

    Hello,

    This is problem is a show stopper for us and must be addressed in expedited manner. Any help greatly would be appreciated.

    Problem Definition

    PF-ring driver is queuing income packets up to 4 packets prior to releasing them to application. This issue exists in both pfring_zc_recv_pkt_burst() and pfring_zc_recv_pkt() functions.

    How to recreate

    You can try this simply by running zcount & zsend applications as follows: ./zsend -c 2 -g 14 -i zc:psdeth2 -p 1 -l 125 ./zcount -c 3 -g 19 -i zc:psdeth3

    In my case I setup my switch with port channel with my device. In this scenario the switch send a LACP packets every one second to my application and expects response. My application receive the incoming packets in batch (four at the time) due to the queueing. Since my application does not receive the LACP packet one per second, therefor the port channel fails to establish.

    zcount & zsend applications output

    zsend application output ————————————- [[email protected] examples_zc]# ./zsend -c 2 -g 14 -i zc:psdeth2 -p 1 -l 125 Sending packets to zc:psdeth2 Estimated CPU freq: 2466502000 Hz Estimated CPU freq: 2493272000 Hz Rate set to 1 pps

    Absolute Stats: 1 pkts - 149 bytes

    ========================= Absolute Stats: 2 pkts - 298 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 3 pkts - 447 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 4 pkts - 596 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 5 pkts - 745 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 6 pkts - 894 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 7 pkts - 1'043 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 8 pkts - 1'192 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 9 pkts - 1'341 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 10 pkts - 1'490 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 11 pkts - 1'639 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 12 pkts - 1'788 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 13 pkts - 1'937 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 14 pkts - 2'086 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 15 pkts - 2'235 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 16 pkts - 2'384 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 17 pkts - 2'533 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 18 pkts - 2'682 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 19 pkts - 2'831 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 20 pkts - 2'980 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 21 pkts - 3'129 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ========================= Absolute Stats: 22 pkts - 3'278 bytes Actual Stats: 1.00 pps - 0.00 Gbps [149 bytes / 1.0 sec]

    ^CLeaving...

    Absolute Stats: 23 pkts - 3'427 bytes Actual Stats: 1.17 pps - 0.00 Gbps [149 bytes / 0.9 sec]

    ========================= Absolute Stats: 23 pkts - 3'427 bytes Actual Stats: 0.00 pps - 0.00 Gbps [0 bytes / 1.0 sec]

    ==========================================================

    ========================================================== zcount application output ————————————— [[email protected] examples_zc]# ./zcount -c 3 -g 19 -i zc:psdeth3

    Absolute Stats: 0 pkts (0 drops) - 0 bytes. <<<—— First second

    ========================= Absolute Stats: 0 pkts (0 drops) - 0 bytes <<<—— Second second Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 0 pkts (0 drops) - 0 bytes <<<—— Third second Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 4 pkts (0 drops) - 596 bytes <<<—— Fourth second 4 packets Actual Stats: 4.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 4 pkts (0 drops) - 596 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 4 pkts (0 drops) - 596 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 4 pkts (0 drops) - 596 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 8 pkts (0 drops) - 1'192 bytes Actual Stats: 4.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 8 pkts (0 drops) - 1'192 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 8 pkts (0 drops) - 1'192 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 8 pkts (0 drops) - 1'192 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 12 pkts (0 drops) - 1'788 bytes Actual Stats: 4.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 12 pkts (0 drops) - 1'788 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 12 pkts (0 drops) - 1'788 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 12 pkts (0 drops) - 1'788 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 12 pkts (0 drops) - 1'788 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 16 pkts (0 drops) - 2'384 bytes Actual Stats: 4.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 16 pkts (0 drops) - 2'384 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    ========================= Absolute Stats: 16 pkts (0 drops) - 2'384 bytes Actual Stats: 0.00 pps (0.00 drops) - 0.00 Gbps

    Environment

    OS
    ===
    Linux 3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 20 20:32:50 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
    
    Driver
    =====
    i40e
    
    Application
    ========
    zcount - (C) 2014 ntop.org
    Using PFRING_ZC v.7.1.0.171107
    

    Thank you, Steven

    opened by szarea 22
  • user app crash keeps zc interface locked

    user app crash keeps zc interface locked

    Hello @cardigliano @lucaderi

    I have the following issue while using zbalance_ipc -m 1 -n 2 -c 1 When I run an application that listens to traffic from zc:[email protected] (i.e zeek or suricata) and if for some reason the user app is killed, then the virtual interface of zc:[email protected] is locked. The error is that no such device exists.

    An ugly fix would be to restart the zbalance_ipc process.

    Is there a more elegant way of disconnecting and unlocking zc:[email protected] so that another user space app could read from it ? Any signal that needs to be sent for example ?

    Thank you Anton

    opened by AntonyNow19 5
  • pkts dropped problem!!!

    pkts dropped problem!!!

    There is a serious problem when I use paid pf_ring zc mode. I have set up 10 rx teams for the network interface, but zc:[email protected] always drops pkts, the other nine channel is normal. Following is pfcount data. pf_ring version is 8.0.0. CPU and memory resources are sufficient.

    pfcount -i zc:[email protected]
    =========================
    Absolute Stats: [24'753'506 pkts total][22'183'919 pkts dropped][89.6% dropped]
    [2'569'587 pkts rcvd][1'340'354'585 bytes rcvd][142'739.71 pkt/sec][595.65 Mbit/sec]
    =========================
    Actual Stats: [121'757 pkts rcvd][1'000.11 ms][121'742.75 pps][0.46 Gbps]
    =========================
    
    pfcount -i zc:[email protected] # the same as zc:[email protected][2-9]
    =========================
    Absolute Stats: [1'023'366 pkts total][0 pkts dropped][0.0% dropped]
    [1'023'366 pkts rcvd][462'426'738 bytes rcvd][85'272.72 pkt/sec][308.26 Mbit/sec]
    =========================
    Actual Stats: [131'643 pkts rcvd][1'000.12 ms][131'626.02 pps][0.51 Gbps]
    =========================
    

    Looking forward to your reply. Thank you very much.

    opened by wangfeng22 8
  • pf_ring dkms (8.1.0-7556) does not compile for the 5.18.x kernel

    pf_ring dkms (8.1.0-7556) does not compile for the 5.18.x kernel

    [[email protected] pfring-8.1.0]# make make -C /lib/modules/5.18.5-200.fc36.x86_64/build M=/usr/src/pfring-8.1.0 EXTRA_CFLAGS='-I/usr/src/pfring-8.1.0 -DGIT_REV=""dev:cabd2381e3bb623b5b22e670e9612b622fa94d49"" -no-pie -fno-pie -Wno-implicit-fallthrough' modules make[1]: Entering directory '/usr/src/kernels/5.18.5-200.fc36.x86_64' CC [M] /usr/src/pfring-8.1.0/pf_ring.o In file included from ./include/linux/byteorder/little_endian.h:5, from ./arch/x86/include/uapi/asm/byteorder.h:5, from ./arch/x86/include/asm/orc_types.h:43, from ./arch/x86/include/asm/unwind_hints.h:6, from ./arch/x86/include/asm/nospec-branch.h:13, from ./arch/x86/include/asm/paravirt_types.h:40, from ./arch/x86/include/asm/ptrace.h:97, from ./arch/x86/include/asm/math_emu.h:5, from ./arch/x86/include/asm/processor.h:13, from ./arch/x86/include/asm/timex.h:5, from ./include/linux/timex.h:67, from ./include/linux/time32.h:13, from ./include/linux/time.h:60, from ./include/linux/stat.h:19, from ./include/linux/module.h:13, from /usr/src/pfring-8.1.0/pf_ring.c:79: /usr/src/pfring-8.1.0/pf_ring.c: In function ‘allocate_extra_dma_memory’: /usr/src/pfring-8.1.0/pf_ring.c:4818:7: error: implicit declaration of function ‘pci_map_single’; did you mean ‘dma_map_single’? [-Werror=implicit-function-declaration] 4818 | pci_map_single(to_pci_dev(dma_memory->hwdev), slot, | ^~~~~~~~~~~~~~ ./include/uapi/linux/byteorder/little_endian.h:32:51: note: in definition of macro ‘__cpu_to_le64’ 32 | #define __cpu_to_le64(x) ((__force __le64)(__u64)(x)) | ^ /usr/src/pfring-8.1.0/pf_ring.c:4817:31: note: in expansion of macro ‘cpu_to_le64’ 4817 | dma_memory->dma_addr[i] = cpu_to_le64( | ^~~~~~~~~~~ /usr/src/pfring-8.1.0/pf_ring.c:4820:22: error: ‘PCI_DMA_BIDIRECTIONAL’ undeclared (first use in this function); did you mean ‘DMA_BIDIRECTIONAL’? 4820 | PCI_DMA_BIDIRECTIONAL)); | ^~~~~~~~~~~~~~~~~~~~~ ./include/uapi/linux/byteorder/little_endian.h:32:51: note: in definition of macro ‘__cpu_to_le64’ 32 | #define __cpu_to_le64(x) ((__force __le64)(__u64)(x)) | ^ /usr/src/pfring-8.1.0/pf_ring.c:4817:31: note: in expansion of macro ‘cpu_to_le64’ 4817 | dma_memory->dma_addr[i] = cpu_to_le64( | ^~~~~~~~~~~ /usr/src/pfring-8.1.0/pf_ring.c:4820:22: note: each undeclared identifier is reported only once for each function it appears in 4820 | PCI_DMA_BIDIRECTIONAL)); | ^~~~~~~~~~~~~~~~~~~~~ ./include/uapi/linux/byteorder/little_endian.h:32:51: note: in definition of macro ‘__cpu_to_le64’ 32 | #define __cpu_to_le64(x) ((__force __le64)(__u64)(x)) | ^ /usr/src/pfring-8.1.0/pf_ring.c:4817:31: note: in expansion of macro ‘cpu_to_le64’ 4817 | dma_memory->dma_addr[i] = cpu_to_le64( | ^~~~~~~~~~~ In file included from ./include/linux/skbuff.h:31, from /usr/src/pfring-8.1.0/pf_ring.c:83: /usr/src/pfring-8.1.0/pf_ring.c: In function ‘free_extra_dma_memory’: /usr/src/pfring-8.1.0/pf_ring.c:4843:26: error: ‘PCI_DMA_BIDIRECTIONAL’ undeclared (first use in this function); did you mean ‘DMA_BIDIRECTIONAL’? 4843 | PCI_DMA_BIDIRECTIONAL); | ^~~~~~~~~~~~~~~~~~~~~ ./include/linux/dma-mapping.h:407:70: note: in definition of macro ‘dma_unmap_single’ 407 | #define dma_unmap_single(d, a, s, r) dma_unmap_single_attrs(d, a, s, r, 0) | ^ /usr/src/pfring-8.1.0/pf_ring.c: In function ‘pf_ring_inject_packet_to_stack’: /usr/src/pfring-8.1.0/pf_ring.c:5833:9: error: implicit declaration of function ‘netif_rx_ni’; did you mean ‘netif_rx’? [-Werror=implicit-function-declaratio] 5833 | err = netif_rx_ni(skb); | ^~~~~~~~~~~ | netif_rx /usr/src/pfring-8.1.0/pf_ring.c: In function ‘ring_getsockopt’: /usr/src/pfring-8.1.0/pf_ring.c:7888:26: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 7888 | char *dev_addr = pfr->ring_dev->dev->dev_addr; | ^~~ cc1: some warnings being treated as errors make[2]: *** [scripts/Makefile.build:288: /usr/src/pfring-8.1.0/pf_ring.o] Error 1 make[1]: *** [Makefile:1838: /usr/src/pfring-8.1.0] Error 2 make[1]: Leaving directory '/usr/src/kernels/5.18.5-200.fc36.x86_64' make: *** [Makefile:67: all] Error 2

    opened by rwhalb 3
  • pfring_recv doesn't return while there is traffic

    pfring_recv doesn't return while there is traffic

    Hi,

    I'm using pf_ring 7.6.0 in my program to capture packets. The program almost definitely will stop working after running for several hours. I did some debugging and found that the program ran into a situation in which tot_read == tot_insert while insert_off != remove_off. I think this is unexpected but can't figure out how it get there.

    I went over the issues list, but found no similar issues, so I created this one.

    Here is some information I can provide:

    1. The program is built for ubuntu18.04 running on arm64.
    2. ZC is not used.
    3. The content of the file /proc/net/pf_ring/pid-if.ring_id when the program stops is:
    Bound Device(s)    : enp125s0f1,enp125s0f0
    Active                 : 1
    Breed                  : Standard
    Appl. Name             : <unknown>
    Socket Mode            : RX only
    Capture Direction      : RX+TX
    Sampling Rate          : 1
    Filtering Sampling Rate: 0
    IP Defragment          : No
    BPF Filtering          : Disabled
    Sw Filt Hash Rules     : 0
    Sw Filt WC Rules       : 0
    Sw Filt Hash Match     : 0
    Sw Filt Hash Miss      : 0
    Sw Filt Hash Filtered  : 0
    Hw Filt Rules          : 0
    Poll Pkt Watermark     : 128
    Num Poll Calls         : 1647837
    Poll Watermark Timeout : 0
    Channel Id Mask        : 0xFFFFFFFFFFFFFFFF
    VLAN Id                : 65535
    Slot Version           : 17 [7.6.0]
    Min Num Slots          : 746
    Bucket Len             : 9000
    Slot Len               : 9048 [bucket+header]
    Tot Memory             : 6762496
    Tot Packets            : 170765465
    Tot Pkt Lost           : 63662720
    Tot Insert             : 107102745
    Tot Read               : 107102745
    Insert Offset          : 5887824
    Remove Offset          : 5905872
    Num Free Slots         : 746
    Reflect: Fwd Ok        : 0
    Reflect: Fwd Errors    : 0
    

    Any help is appreciated, thanks.

    bug ARM 
    opened by chxd 2
  • epoll() seems stop working with zc mode in some case

    epoll() seems stop working with zc mode in some case

    English is not my first language.

    Here is the two interfaces with configured 8 RSS.

    $ ethtool -l ens2f0
    Current hardware settings:
    RX:		0
    TX:		0
    Other:		1
    Combined:	8
    
    $ ethtool -l ens2f1
    Current hardware settings:
    RX:		0
    TX:		0
    Other:		1
    Combined:	8
    

    I open the two interfaces and make it in inline mode, and I found an issues(maybe).

    1. Start the traffic generator
    2. Start the inline program(it works, forwarding)
    3. Stop the traffic generator(make sure no packets incoming)
    4. Start the traffic generator again
    5. Inline program is not working

    or

    1. Make sure no packets incoming
    2. Start the inline program
    3. Start the traffic generator
    4. Inline program is not working

    Here is some information.

    $ cat /proc/net/pf_ring/info 
    PF_RING Version          : 8.0.0 (8.0.0-stable:58e764f619bb4711a66b021f7a475401d99ba371)
    Total rings              : 0
    
    Standard (non ZC) Options
    Ring slots               : 65536
    Slot version             : 18
    Capture TX               : Yes [RX+TX]
    IP Defragment            : No
    Socket Mode              : Standard
    Cluster Fragment Queue   : 0
    
    $ sudo pf_ringcfg --list-interfaces    
    Name: ens2f0               Driver: ixgbe      RSS:     8    [Running ZC]
    Name: ens2f1               Driver: ixgbe      RSS:     8    [Running ZC]
    Name: enp1s0f0             Driver: igb        RSS:     8    [Supported by ZC]
    Name: enp1s0f1             Driver: igb        RSS:     8    [Supported by ZC]
    
    $ uname -a
    Linux ubuntu 5.4.0-050400-generic #201911242031 SMP Mon Nov 25 01:35:10 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
    

    And the full code:

    #ifndef _GNU_SOURCE
    #define _GNU_SOURCE
    #endif /* _GNU_SOURCE */
    
    #include <stdio.h>
    #include <stdlib.h>
    #include <unistd.h>
    #include <getopt.h>
    #include <string.h>
    #include <errno.h>
    #include <signal.h>
    #include <net/if.h>
    #include <sys/epoll.h>
    #include <pfring.h>
    #include <pfring_zc.h>
    #include <sched.h>
    
    int stop = 0;
    
    void handler(int sig) {
        stop = 1;
    }//end handler
    
    void stick_cpu_core(int cpu) {
        cpu_set_t cpuset;
    
        CPU_ZERO(&cpuset);
        CPU_SET(cpu, &cpuset);
    
        sched_setaffinity(0, sizeof(cpu_set_t), &cpuset);
    }//end stick_cpu_core
    
    pfring *open_ring(const char *dev) {
        pfring *r;
    
        printf("open %s\n", dev);
        r = pfring_open(dev, 1536, PF_RING_PROMISC);
        if(!r) {
            perror("pfring_open()");
            exit(1);
        }//end if
    
        pfring_enable_ring(r);
    
        return r;
    }//end open_ring
    
    static void epoll_ctl_add(int epfd, int fd, uint32_t events) {
        struct epoll_event ev;
    
        ev.events = events;
        ev.data.fd = fd;
        if(epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &ev) == -1) {
            perror("epoll_ctl()");
            exit(1);
        }//end if
    }//end epoll_ctl_add
    
    int main(int argc, char *argv[]) {
    
        int core = 8;
    
        if(argc == 2) {
            core = atoi(argv[1]);
        }//end if
    
        signal(SIGINT, handler);
    
        for(int i = 0 ; i < core ;i++) {
    
            if(fork() == 0) {
                stick_cpu_core(i);
    
                char dev[64];
                snprintf(dev, sizeof(dev), "zc:[email protected]%d", i);
                pfring *ens2f0 = open_ring(dev);
                snprintf(dev, sizeof(dev), "zc:[email protected]%d", i);
                pfring *ens2f1 = open_ring(dev);
    
                int epfd = epoll_create1(1);
                int ens2f0_fd, ens2f1_fd;
                ens2f0_fd = pfring_get_selectable_fd(ens2f0);
                ens2f1_fd = pfring_get_selectable_fd(ens2f1);
    
                epoll_ctl_add(epfd, ens2f0_fd, EPOLLIN);
                epoll_ctl_add(epfd, ens2f1_fd, EPOLLIN);
    
                struct epoll_event events[2];
    
                while(!stop) {
                    int nfds = epoll_wait(epfd, events, 2, 1000);
                    if(nfds < 0) {
                        perror("epoll_wait()");
                        break;
                    } else if(nfds == 0) {
                        continue;
                    }//end if
    
                    for(int i = 0 ; i < nfds ; i++) {
                        pfring *r, *s;
                        if(events[i].data.fd == ens2f0_fd) {
                            r = ens2f0;
                            s = ens2f1;
                        } else {
                            r = ens2f1;
                            s = ens2f0;
                        }//end else
    
                        u_char *buf;
                        struct pfring_pkthdr hdr;
                        errno = 0;
                        hdr.caplen = 0;
                        int ret = pfring_recv(r, &buf, 0, &hdr, 0);
                        if(ret < 0 && errno != 0) {
                            perror("pfring_recv()");
                            continue;
                        }//end if
    
                        errno = 0;
                        ret = pfring_send(s, (char *)buf, hdr.caplen, 1);
                        if(ret < 0 && errno != 0) {
                            perror("pfring_send()");
                        }//end if
                    }//end for
                }//end while
    
                pfring_close(ens2f0);
                pfring_close(ens2f1);
    
                exit(0);
            }//end if
        }//end for
    
        while(!stop) {
            sleep(1);
        }//end while
        sleep(3);
    
        return 0;
    }//end main
    

    When no packets incoming, it blocks in epoll_wait().

    opened by QbsuranAlang 5
Releases(8.2.0)
  • 8.2.0(Jun 30, 2022)

    PF_RING Library

    • New new pfring_get_caplen API
    • New pfring_get_link_type API
    • Add src_ip_mask and dst_ip_mask to generic_flow_rule
    • Add priority to hw_filtering_rule
    • Add module version to device info returned by pfring_findalldevs
    • Refactor device name parsing
    • Use sockaddr_ll in bind (to supports interface names longer than 14 chars)

    ZC Library

    • New Mellanox support for ConnectX 4/5/6 adapters, including hardware offloads for timestamp, filtering, RSS
    • Fix pfring_zc_numa_get_cpu_node

    FT Library

    • Add native support for flow export over ZMQ

    PF_RING Kernel Module

    • Add support for VXLAN
    • Add support for both sockaddr and sockaddr_ll in bind
    • Refactor kernel locking
    • Discard VLAN in hash cluster_per_flow_ip_with_dup_tuple calculation
    • Detect when a process owning a PF_RING socket changes the PID (e.g. fork)
    • Export process PID to userspace
    • Fix compilation on latest kernels for Rocky Linux and RH 8.5, Debian 9, 10, 11, Ubuntu 18, 20, 22
    • Fix net namespace handling
    • Fix crash when renaming /proc entries

    PF_RING Capture Modules

    Fix drop statistics on Napatech with HBA set

    ZC Drivers

    • New igb-zc driver v.5.10.2
    • New i40e-zc driver v.2.17.4
    • New ice-zc driver v.1.8.8

    nBPF

    • Fix double free

    Examples

    • New sample application pfsend_multichannel to send traffic using RSS
    • New zdelay application to forward traffic between interfaces, adding a configurable delay
    • pfcount_multichannel: remove limit on number of threads
    • zbalance_ipc: improve hashing modes (e.g. add -Y to control eth type)
    • pfcount:
      • Add -0 to steer all traffic to RSS queueu 0
      • Add -P to set rule priority
    • ftflow_dpdk:
      • Set RSS mode/hf (required on some adapters e.g. Mellanox)
      • Use time from hardware timestamp when available

    Misc

    • Add support for Ubuntu 22
    • Remove nBroker support (fm10k adapters are EOL)
    Source code(tar.gz)
    Source code(zip)
  • 8.0.0(Aug 19, 2021)

    PF_RING Library

    • Add pfring_recv_burst API allowing batch receive (when supported by the capture module/adapter)
    • New zero-copy AF_XDP support (reworked), including pfring_recv_burst support
    • Fix breakloop when using pfring_loop

    ZC Library

    • New pfring_zc_pkt_buff_data_from_cluster API to get the packet buffer providing packet handle and cluster
    • New pfring_zc_pkt_data_buff API to get the packet handle providing packet buffer and cluster
    • New pfring_zc_pkt_buff_pull_only API to remove data from the head room of a packet
    • Add PF_RING_ZC_BUFFER_HEAD_ROOM define (buffer head room size)
    • Add PF_RING_ZC_SEND_PKT_MULTI_MAX_QUEUES define (max number of queues in queues_mask)

    FT Library

    • New pfring_ft_api_version API to get the API version
    • New pfring_zc_precompute_cluster_settings API to get memory information before allocating resources
    • Add VXLAN encapsulation support
    • Add tunnel_id to flow metadata
    • Add support for compiling examples with DPDK >=20
    • Fix L7 metadata with short flows

    PF_RING-aware Libpcap/Tcpdump

    • Set 5-tuple clustering as default when using clustering with libpcap

    PF_RING Kernel Module

    • Support for kernel >=5.9
    • Add more info to /proc, including promisc mode and ZC slots info
    • Handle long interface name (error on interface length bigger than 14-char as supported by bind)
    • Fix channel selection when channel is unknown (e.g. VM)
    • Fix triple VLAN tags with hw offload/acceleration
    • Fix check on mapped memory size
    • Fix potential data race in SO_SET_APPL_NAME
    • Fix OOB access

    PF_RING Capture Modules

    • Accolade library update (SDK 1_2_20210714)
    • Napatech library update (SDK 12.7.2.1)
    • Silicom/Fiberblaze library update (SDK 3_5_9_1)
    • Add steer_to_ring and ring_id fields to Accolade rules (accolade_hw_rule)
    • Add support for recv burst on Napatech adapters in chunk mode
    • Add PF_RING_PACKET_CAPTURE_PRIO env var to set hostBufferAllowance on Napatech adapters
    • Rename ACCOLADE_RING_BLOCKS env var to ANIC_RING_BLOCKS on Accolade adapters (default is now 16)
    • Fix Accolade drop counter when capturing from rings
    • Fix extraction of packets with nsec timestamps on Timeline module (n2disk dump)

    ZC Drivers

    • New ice ZC driver v.1.3.2 (Intel Columbiaville / E810 adapters) with symmetric RSS support
    • Support latest kernels, including RH/CentOS 8.4 and Ubuntu 20, for all ZC drivers
    • i40e ZC driver update (v.2.13.10)
    • e1000e ZC driver update (v.3.8.7)

    nBPF

    • New nBPF primitives 'device ' and 'interface ' to match metadata from Arista MetaWatch devices
    • Examples
    • pfcount
      • Add -B option (burst mode)
    • pfsend
      • Add -n support with -f
      • Add support to reforge src/dst IP from pcap with -S and -D
    • ftflow
      • Add -E option to run extra DPI dissection (e.g. to print JA3 info)
    • zbalance_ipc
      • Add runtime reload of nDPI protocol configuration file
      • Add -m 7 option (sample distribution based on eth type)
      • Add default configuration file /etc/cluster/cluster.conf (when no option is specified)

    Misc

    • Move libraries and utility scripts from /usr/local to /usr
    • Install pfring-aware tcpdump with packages
    • Add revision to pfring-dkms version
    Source code(tar.gz)
    Source code(zip)
  • 7.8.0(Oct 19, 2020)

    PF_RING Library

    • Add support for Device ID and Port ID to the extended packet header
    • Add Arista 7150 Series hw timestamps support (keyframes and packet trailer parsing and stripping)
    • Add Metawatch Metamako hw timestamps support (packet trailer parsing and stripping)
    • errno EINTR is now returned on breakloop
    • Improve XDP support
    • Replace configure --enable-xdp with --disable-xdp (XDP enabled by default when supported)

    ZC Library

    • New PF_RING_ZC_DEVICE_METAWATCH_TIMESTAMP flag to enable Metawatch hw timestamps
    • New pfring_zc_get_pool_id API to get the Pool ID
    • New pfring_zc_run_balancer_v2 pfring_zc_run_fanout_v2 APIs to support filtering functions
    • BPF support in ZC interfaces, standard interfaces and SPSC queues
    • Add support for BPF in TX queues
    • Builtin GTP hash now expose GTP info (flags)
    • Fix CRC strip on ixgbevf
    • FT Library
    • New pfring_ft_flow_get_id API to get the flow ID
    • New PFRING_FT_IGNORE_HW_HASH flag to ignore hw packet hash
    • New PKT_FLAGS_FLOW_OFFLOAD_1ST packet flag (first packet of a flow)
    • Add support for flow slicing
    • New API pfring_ft_flow_get_users to get flow users (in case of slicing)
    • Improve application protocol detection
    • Fix bogus-IP headers parsing

    PF_RING-aware Libpcap/Tcpdump

    • New libpcap v.191
    • New tcpdump v.4.9.3
    • stats.ps_recv now includes packets dropped due to out of buffer space

    PF_RING Kernel Module

    • Fix channels with standard drivers
    • Fix 64-bit channel mask
    • Fix defragmentation of packets with ethernet padding
    • Fix unnecessary device mapping causing ifindex exhaustion

    PF_RING Capture Modules

    • Update support for Fiberblaze adapters
    • Fix filtering with Accolade adapters

    ZC Drivers

    • New ice ZC driver supporting E800 Series Intel adapters
    • Support for Ubuntu 20 LTS
    • Support for CentOS/RedHat 8.2
    • Fix queue attach/detach in ixgbe-zc
    • Support for kernel 5.4

    nBPF

    • Add support for matching Local/Remote IP (new extended-BPF primitives)
    • Support uppercase AND/OR in extended-BPF filters
    • Fix extended-BPF grammar

    Examples

    • New zfilter_mq_ipc sample app (packet filtering with multiple threads and fanout to multiple consumer processes)
    • ftflow:
      • New -H option to ignore hw hash setting PFRING_FT_IGNORE_HW_HASH
      • New -t option to print stats only
    • ftflow_dpdk
      • New -l option to run loopback tests
      • Add RX/TX ring size configuration
    • pfsend:
      • New -z option to precompute randomized sequence
      • New -W ID[,ID] option to forge VLAN and QinQ VLAN
    • zbalance_ipc:
      • New -x option to filter by VLAN ID
      • Add ability to set BPF to egress queues
      • Add ability to refresh BPF filters at runtime
      • New -G : option to forward GTP-C traffic to a specific queue
    • New zcount -f option to set BPF filters
    • New pfcount -F option (do not strip FCS)
    • New zcount/zcount_ipc -t option to read the packet payload
    • New pcount -e option to set the capture direction
    • Add VLAN to the flows dumped by ftflow
    • Fix transmission of small packets (less than 60 bytes)
    • Fix CPU affinity in ZC sample applications

    Misc

    • Handle failures in service restart during package updates
    • Add linux headers dependency to the pfring-dkms package
    • Add actual version/revision to pfring-drivers-zc-dkms packages
    • Fix installed .so library and links
    • Fix ZC DAQ compilation and API update
    • Fix service scripts to avoid command injections
    Source code(tar.gz)
    Source code(zip)
  • 7.6.0(Feb 21, 2020)

    PF_RING Library

    • New pfring_open flag PF_RING_TX_BPF to evaluate the BPF filter also for TX
    • New pfring_open flag PF_RING_FLOW_OFFLOAD_TUNNEL to dissect tunneled traffic in flow-offload mode
    • New pfring_open flag PF_RING_DISCARD_INJECTED_PKTS to discard stack-injected packets

    ZC Library

    • New API call pfring_zc_close_device to close a ZC interface
    • New 'flags' parameter to pfring_zc_create_cluster
    • Fixed memory allocation in case of more than 4GB of buffer size

    FT Library

    • New API call pfring_ft_set_filter_all_protocols to reset all filtering rules
    • New API call pfring_ft_set_license to set a license at runtime
    • New API call pfring_ft_flow_get_ndpi_handle to access the flow nDPI handle
    • New pfring_ft_l7_protocol_id, pfring_ft_get_ndpi_handle to access the nDPI handle
    • New pfring_ft_flow_value status field to get flow termination reason
    • New PFRING_FT_TABLE_FLAGS_DPI_EXTRA flag to enable extra metadata extraction
    • New PFRING_FT_DECODE_TUNNELS flag to decode tunnels, new tunnel_type item in the flow value
    • New flow slicing support (pfring_ft_flow_set_flow_slicing API)
    • Added CAPWAP support
    • Added flow metadata for HTTP/DNS/SSL
    • Added global 'default' section to the rules configuration file
    • Added dpi_min_num_tcp_packets / dpi_min_num_udp_packets to the configuration file
    • Added flow_idle_timeout / flow_lifetime_timeout to the configuration file
    • Added src/dst mac to the exported flow key
    • Added ICMP type/code to flow metadata
    • Added flags to flow metadata
    • Added custom flow actions to be defined by the user
    • Added pfring_ft_load_configuration_ext API
    • Improved protocol detection for some protocols like Skype
    • Improved metadata extraction for some protocols like Telnet
    • Improved pfring_ft_license to return the duration also in demo mode
    • Changed l7_detected callback: this is called before the flow_packet callback now
    • Changed pfring_ft_create_table and pfring_ft_flow_value to allocate user metadata as part of the flow structure
    • Fixed filtering/shunting of custom protocols
    • Fixed protocol detection in case of guess
    • Fixed pfring_ft_set_l7_detected_callback user parameter handling

    PF_RING-aware Libpcap

    • Fixed device name check during socket initialization to handle long interface names
    • Fixed loop break

    PF_RING Kernel Module

    • Added new clustering mode cluster_per_flow_ip_with_dup_tuple
    • Allow any to capture from any namespace (on the host only)
    • Remapping ifindex to an internal device index to handle ifindex growing indefinitely
    • Fixed kernel crash parsing malformed packets (12 nested QinQ VLAN headers with GRE)
    • Fixed possible race condition
    • Fixed QinQ VLAN and VLAN offload support
    • Fixed concurrent access to the ring in case of loopback device and bridge
    • Compilation fixes for kernel 5.x
    • Reworked max ring size check to handle cases like jumbo frames
    • Improved promisc management

    PF_RING Capture Modules

    • New AF_XDP capture module
    • Napatech library update, fixed findalldev
    • Accolade library update, fixed caplen vs orig len, new env var ACCOLADE_FLOW_IDLE_TIMEOUT
    • Myricom library update, license fix with port aggregation
    • DAG library update

    ZC Drivers

    • New ixgbe-zc driver v.5.5.3
    • Support for Intel X550
    • Compilation fixes for kernel 5.x
    • Handling if up/down when the interface is in use by ZC

    nBPF

    • Added support to match custom fields through a callback (nbpf_set_custom_callback)

    Examples

    • zcount improvements:
      • Added -T option to capture TX
    • zbalance_ipc improvements:
      • Fixed -m 4/5/6 with multiple applications and more than 32 queues
      • New -E option to enable debug mode
      • New -C and -O options
    • ftflow_dpdk improvements:
      • More stats: drops, hw stats, per-queue throughput
      • New options to control the link status, flow control, autoneg, port speed, checksum offload
      • New -P option to set the TX rate
      • New TX test mode and -T option to set the packet len
      • New -F option to enable forwarding
      • New -m option to set the mtu
      • Capture-only mode
      • Forward optimizations
    • ftflow_pcap improvements:
      • Support for processing a PCAP file
      • New -p <proto.txt> option
      • New -F option to configure filtering/shunting rules
    • pfsend improvements:
      • New -8 option to send the same packets times before moving to the next
      • New -B option to set a BPF filter
      • New -t option to forge N different source port
      • New -A option to generate increasing number of flows
    • pfcount improvements:
      • New -R option to disable RSS reprogramming
    • pfbridge now discards injected packets

    Misc

    • New pf_ringcfg script to automatically configure pf_ring and drivers
    • New pre/post scripts executed by systemd before/after loading pf_ring and drivers
    • Improved hugepages configuration with multiple nodes
    • npcap lib update, storage utility functions fix for NFS
    Source code(tar.gz)
    Source code(zip)
  • 7.4.0(Dec 21, 2018)

    PF_RING Library

    • New pfring_open PF_RING_DO_NOT_STRIP_FCS flag to disable FCS/CRC stripping (when supported by the adapter)
    • Improved support for cross-compilation
    • New PF_RING_FT_CONF environment variable to enable PF_RING FT support and load L7 filtering rules
    • New PF_RING_FT_PROTOCOLS environment variable to load L7 protocols when PF_RING FT for L7 filtering is enabled

    ZC Library

    • New pfring_zc_open_device flag PF_RING_ZC_DO_NOT_STRIP_FCS to disable FCS/CRC stripping (when supported by the adapter)
    • New builtin hash function pfring_zc_builtin_5tuple_hash based on 5-tuple
    • Fixed SPSC queues BPF support
    • Fixed KVM/ivshmem support on Ubuntu 16
    • Fixed pfring_zc_recv_pkt_burst with ixgbe-zc drivers

    FT Library

    • New pfring_ft_set_l7_detected_callback API to set a callback for classified flows/packets (L7 protocol detected)
    • New pfring_ft_set_default_action API to set the default action for classified L7 flows
    • New pfring_ft_flow_get_action API to get the computed/actual flow action asyncronously
    • New pfring_ft_create_table flow_lifetime_timeout parameter to configure the maximum flow duration
    • New pfring_ft_load_ndpi_protocols API to load custom nDPI protocols from a configuration file
    • New pfring_ft_is_ndpi_available API to check nDPI availability
    • Added active_flows to pfring_ft_stats to get the number of currently active flows

    PF_RING-aware Libpcap

    • New pcap_get_pfring_handle API to get the PF_RING handle used by Libpcap
    • New PCAP_PF_RING_ALWAYS_SYNC_FD environment variable for applications not using the fd provided by pcap_get_selectable_fd
    • Fix for applications polling from the pcap selectable fd when ZC drivers are used

    PF_RING Kernel Module

    • Updates to support kernel 4.18 or older
    • Fixed 'stack' TX capture in ZC mode
    • Fixed ifindex lookup
    • Fixed promiscuous mode corner cases
    • Fixed arm32 support
    • Fixed IPv6 support in software filtering rules
    • Fixed software hash rules
    • Fixed kernel clustering in case of non-IP packets (sporadically recognized as IP fragments when the fragments cache was enabled)

    PF_RING Capture Modules

    • Timeline module fixes:
    • Fixed extraction of non-IP packets
    • Fixed permissions check when running as unprivileges user, when the user has permissions on the filesystem
    • Accolade module update to support latest SDK API and features
    • Fixed Fiberblaze module bulk mode

    ZC Drivers

    • New ixgbevf ZC driver
    • Drivers updates to support kernel 4.18 or older
    • Fixed sporadic crashes during application startup on high traffic rates
    • Fixed the DKMS packages
    • i40e ZC driver improvements:
      • Forcing symmetric RSS hash on old firmwares
      • Improved interrupts management to fix packets delivered in batches
      • Fixed interrupts management when multiple sockets are active on the same interface (RX+TX or RSS)
    • ixgbe ZC driver improvements:
      • Increased max MTU length to 16K
      • Fixed card reset due to kernel-space TX packets pending while the interface is in use by ZC
    • Improved hardware timestamp support for igb ZC (i350/82580 adapters)

    nBPF 

    • Fixed 'portrange' token in BPF-like filters

    Examples

    • New pftimeline example to extract traffic from a n2disk dump set using the pf_ring API
    • New pfsend -M option to forge the source MAC address
    • zbalance_ipc improvements:
      • Added -m 6 distribution function (interface X to queue X)
      • Added queues and TX interface stats under /proc (-p)
      • Fixed multiapp (fanout) distribution for more than 32 egress queues
    • ftflow improvements:
      • New -F option to load rules from a configuration file
      • New -p option to load custom protocols
      • Improved output (e.g. printing information including the flow action)
    • Improved ftflow_dpdk example, added bridging support
    • Fixed software filtering in pfcount (enabling full headers when filtering is enabled)

    IDS Support (Snort/Bro)

    • Fixed Snort DAQ filtering API
    • Fixed cluster issues on Bro (due to a libpcap symbols issue)

    Misc

    • CoreOS support, pf_ring module and drivers installation scripts
    • Improved 'zbalance_ipc' clusters management with systemd:
      • Service improvements to set the status after the cluster process is actually up and running
      • Fixed hugepages memory allocation in case of clusters not using ZC drivers
    • Improved service dependencies with systemd with respect to other ntop applications
    • Added GID to the hugepages configuration file to allow nonprivileged users to use ZC applications
    Source code(tar.gz)
    Source code(zip)
  • 7.2.0(Jun 13, 2018)

    • ZC Library

      • New API pfring_zc_pkt_buff_pull / pfring_zc_pkt_buff_push to manage buffer head room
      • New builtin hash pfring_zc_builtin_gre_hash with support for GRE tunneling
        • zbalance_ipc -m 5 option for enabling GRE hashing
      • Support for up to 64 queues in pfring_zc_send_pkt_multi and pfring_zc_distribution_func
      • Fix for attaching to ZC IPC queues from containers
    • FT Library (New)

      • L7 flow classification and filtering library
      • Event-driven capture-agnostic API
      • Sample applications
        • ftflow: flow records generation with PF_RING capture
        • ftflow_pcap: flow records generation with PCAP capture
        • ftflow_dpdk: flow records generation with DPDK capture
        • fttest: performance benchmarking tool
        • zbalance_ipc extension to process flows and filter packets
    • nBroker (New)

      • Traffic steering and filtering on Intel RRC (FM10K adapters)
      • Daemon to drive the adapter (nbrokerd)
      • API to configure the adapter using a C library (nbrokerlib)
      • Command-line tool with auto-completion to configure the adapter using scripts (nbroker-cli)
      • Low-level library used by nbrokerd to drive the adapter (rrclib)
    • PF_RING-aware Libpcap

      • PCAP_PF_RING_USERSPACE_BPF env var to force userspace filtering instead of kernel filtering
    • PF_RING Kernel Module

      • Full support for namespaces and containers
      • Fixed skbuff forwarding with fast-tx using reflect_packet
      • Fixed VLAN support in BPF with kernel extensions
      • Fixed support for NetXtreme cards with multiple queues
      • Fixed sw hash filtering for IPv6
      • Fixed intel_82599_perfect_filter_hw_rule VLAN byte order
      • Fixed huge rings (high number of slots or huge slot size)
      • Fixed VLAN offset and packet hash in case of QinQ and VLAN offload
      • Support for Ubuntu 18
      • Support for latest Centos 7 kernel
      • Support for latest Debian 8 kernel
    • PF_RING Capture Modules

      • Released source code for FPGA capture modules including Endace, Exablaze, Inveatech, Mellanox, Netcope
      • Accolade lib updates
        • New flag PF_RING_FLOW_OFFLOAD_NOUP to enable flow offload without flow updates (standard raw packets are received, flow id is in the packet hash)
        • Automatically generate the rule ID using rule_id = FILTERING_RULE_AUTO_RULE_ID
        • Support for accolade 200Ku Flex adapters
      • Fiberblaze lib updates
        • Packet recv in chunk mode
      • Fixed extraction from npcap/timeline in case of empty PCAP files in the dump set
      • Endace DAG updates
        • Setting extended_hdr.pkt_hash from ERF FlowID or Packet Signature extension headers if available
        • Support for pfring_set_application_name
        • Support for pfring_dag_findalldevs
      • Napatech lib updates
        • Support for sdk v10
    • Drivers

      • e1000e zc driver update v.3.4.0.2
      • i40e zc driver update v.2.4.6
      • ixgbe zc driver update v.5.3.7
      • igb zc driver update v.5.3.5.18
      • Fixed interrupts handling on i40e when in zc mode, this fixes the case where packets are received in batches of 4/8 packets
      • Using nbrokerd for initializing FM10K adapters and configuring the RRC switch
    • nBPF

      • Fixed rules constraints
    • Misc

      • Reworked init.d systemd support
      • New pf_ringctl script to manage pf_ring and drivers (this is used by init.d/systemd)
      • Documentation improvements, Doxygen integration with "read the docs"
    Source code(tar.gz)
    Source code(zip)
  • 7.0.0(Nov 21, 2017)

    PF_RING Library

    • Flow offload support
      • New PF_RING_FLOW_OFFLOAD pfring_open() flag to enable hw flow offload on supported cards (received buffers are native metadata)
      • New PF_RING_FLOW_OFFLOAD_NOUPDATES pfring_open() flag to disable flow updates with hw flow offload enabled: only standard raw packets with a flow id are received
      • New PKT_FLAGS_FLOW_OFFLOAD_UPDATE packet flag to indicate flow metadata in the received buffer (generic_flow_update struct)
      • New PKT_FLAGS_FLOW_OFFLOAD_PACKET packet flag to indicate raw packet with flow_id in pkt_hash
      • New PKT_FLAGS_FLOW_OFFLOAD_MARKER packet flag to indicate marked raw packet
    • Fixes for ARM systems

    ZC Library

    • New pfring_zc_set_app_name API
    • PF_RING_ZC_PKT_FLAGS_FLOW_OFFLOAD flag to enable hw flow offload
    • Fixed BPF filters in SPSC queues
    • Fixed hugepages cleanup in case of application dropping privileges
    • Fixed sigbus error on hugepages allocation failure on numa systems
    • Fixed multiple clusters allocation in a single process

    PF_RING-aware Libpcap/Tcpdump

    • Libpcap update v.1.8.1
    • Tcpdump update v.4.9.2

    PF_RING Kernel Module

    • Docker/containers namespaces isolation support
    • Fixed capture on Raspberry Pi
    • Implemented support for VLAN filtering based on interface name (., where ID = 0 accepts only untagged packets)
    • New cluster types cluster_per_flow_ip_5_tuple/cluster_per_inner_flow_ip_5_tuple to balance 5 tuple with IP traffic, src/dst mac otherwise
    • Fixed hash rule last match, new hash_filtering_rule_stats.inactivity stats

    PF_RING Capture Modules

    • Accolade flow offload support
      • New hw_filtering_rule type accolade_flow_filter_rule to discard or mark a flow
    • Netcope support
      • New hw_filtering_rule type netcope_flow_filter_rule to discard a flow
    • Improved Fiberblaze support
      • pfring_get_device_clock support
      • Ability to set native filters by setting as BPF string 'fbcard:'
      • Fixed TX memory management
      • Fixed subnet BPF filters
      • Fixed drop counter
      • Fixed capture mode
      • Fixed sockets not enabled
      • FPGA error detection
    • Endace DAG update
    • npcap/timeline module compressed pcap extraction fix

    Drivers

    • ixgbe-zc driver update v.5.0.4
    • i40e-zc driver update v.2.2.4

    nBPF

    • Fixed nBPF parser memory leak

    Examples

    • New pfsend option -L to forge VLAN IDs
    • zbalance_ipc improvements
      • Ability to dump output to log file (-l)
      • Fixed privileges drop (-D)

    Misc

    • Fixed systemd dependencies, renamed pfring.service to pf_ring.service
    • New /etc/pf_ring/interfaces.conf configuration file for configuring management and capture interfaces
    Source code(tar.gz)
    Source code(zip)
  • 6.6.0(Apr 25, 2017)

    PF_RING Library

    • New pfring_findalldevs/pfring_freealldevs API for listing all interfaces supported by pf_ring
    • New timeline module based on libnpcap for seamlessly extracting traffic from a n2disk dumpset using the pf_ring API
    • Dynamic capture modules loading with dlopen support
    • Improved pfring_set_bpf_filter to set hw rules when supported by the network card thanks to the nBPF engine

    ZC Library

    • New pfring_zc_set_bpf_filter/pfring_zc_remove_bpf_filter API for setting BPF filters to device queues
    • Fixed pfring_zc_queue_is_full for device queues
    • Flushing SPSC queues when a consumer attaches (RX only)

    PF_RING-aware Libpcap/Tcpdump

    • Support for extracting traffix from a n2disk dumpset using libpcap
    • tcpdump upgrade to v.4.9.0

    PF_RING kernel module

    • Support for latest ubuntu and centos stable kernels
    • Support for SCTP and ICMP packet parsing
    • Packet hash improvements
    • Added tunneled IP version to packet metadata
    • Added IP version to sw filters
    • New kernel cluster hash types for tunneled traffic
    • QinQ VLAN parsing
    • Removed deprecated kernel plugins support
    • Promisc fix in case of multiple devices in a single socket

    Drivers

    • Support for latest ubuntu and centos stable kernels
    • FPGA modules/libraries are now loaded at runtime using dlopen
    • RSS support on Intel i211
    • Jumbo frames support on i40e
    • i40e tx optimisations
    • i40e interrupts fixes in case of RSS
    • Fiberblaze capture module with chunk mode support
    • Exablaze capture module
    • Accolade improvements
    • Endace DAG update and support for streams
    • Myricom ports aggregation fixes, new syntax myri:,

    nBPF

    • New nBPF filtering engine supporting an extended subset of the BPF syntax (tunneled traffic and l7 protocols are supported)
    • nBPF support for hw filtering on Fiberblaze cards
    • nBPF support for hw filtering on Intel FM10K cards (Silicom PE3100G2DQIR)
    • nBPF support for hw filtering on Exablaze cards
    • nBPF support for hw filtering on Napatech cards and NTPL generation
    • Support for "start
    • Support for vlan [id], mpls [label], gtp

    Examples

    • pfcount:
      • ability to list interfaces with -L (-v 1 for more info)
      • ability to dump traffic on PCAP file with -o
    • psend:
      • option to force flush per packet (-F)
      • options to specify src/dst IP for packet forging (-S/-D)
      • option to forge packets on the fly instead of at preprocessing time (-O)
      • option to randomize generated ips sequence (-z)
      • ability to generate IPv6 traffic (-V 6)
      • ability to generate mixed v4 and v6 traffic (-V 0)
      • TCP/UDP checksum when reforging
    • zbalance_ipc
      • option to use hw aggregation when supported by the card (-w)
      • IP-based filtering with ZMQ support for rules injection

    Wireshark

    • New extcap module 'ntopdump' for Wireshark 2.x

    Misc

    • Improved systemd support (Ubuntu 16)
    Source code(tar.gz)
    Source code(zip)
  • v6.4.1(Jun 22, 2016)


    2016-06-16 PF_RING 6.4.1

    • PF_RING Library
      • Fixed pfring_get_interface_speed on several capture modules
    • PF_RING kernel module
      • Fixed packet corruption with standard pf_ring sockets in case of slow consumer
    • Drivers
      • Fixed 'tx hang' on all drivers

    2016-06-07 PF_RING 6.4

    • PF_RING Library
      • Improved Myricom support, new naming scheme to improve usability
      • Improved Napatech support, 100G support
      • Improved Accolade support
      • New Invea-Tech support
      • New API pfring_get_metadata to read ZC metadata
      • New pfring_get_interface_speed API
      • New API pfring_version_noring()
      • C++ wrapper improvements
      • Removed DNA legacy
    • ZC Library
      • New API pfring_zc_set_device_proc_stats to write /proc stats per device
      • New API pfring_zc_set_device_app_name to write the application name under /proc
      • New API pfring_zc_get_cluster_id to get the cluster ID from a queue
      • New API pfring_zc_check_device_license for reading interface license status
      • New API pfring_zc_get_queue_settings to read buffer len and metadata len from queue
      • New API pfring_zc_get_queue_speed to read the link speed
      • New pfring_zc_open_device flag PF_RING_ZC_DEVICE_NOT_PROMISC to open the device without setting promisc mode
      • New packet metadata flags, including IP/L4 checksum (when available from card offloads)
      • Improved pfring_zc_builtin_gtp_hash
    • PF_RING-aware Libpcap/Tcpdump
      • New libpcap v.1.7.4
      • New tcpdump v.4.7.4
      • Libnpcap support to let libpcap-based applications (i.e. tcpdump) read compressed .npcap files produced by n2disk
      • Native nanosecond timestamps support
      • Tcpdump patch to close the pcap handle in case of errors (this avoids breaking ZC queues)
    • PF_RING kernel module
      • Fixed BPF support on kernel 4.4.x
      • Fixed RSS support on Centos 6 (it was reporting the wrong number of queues, affecting RSS rehash)
      • Reworked promisc support: handling promisc through the pf_ring kernel module in order to automatically remove it even when applications drop privileges
      • VLAN ID fix in case of vlan stripping offload enabled (it was including priority bits)
    • Drivers
      • New i40e-zc v.1.5.18
      • New fm10k-zc v.0.20.1
      • Support for latest Ubuntu 16, RHEL 6.8, Centos 7
      • Fixed i40e-zc initialisation failures due to promisc reset
      • Fixed i40e-zc 'transmit queue 0 timed out'
      • Fixed e1000e-zc memory leak
    • Examples
      • Added ability to reforge MAC/IP also when reading packets from pcap file/stdin in pfsend
      • Added -f option for replaying packets from pcap file in zsend
      • Added -o option to pfsend to specify an offset to be used with -b
      • Added -r option to use egress interfaces instead of queues in zbalance_ipc
    • Snort DAQ
      • Fixed DAQ-ZC buffer leak in IPC mode
      • Fixed DAQ_DP_ADD_DC support
      • Fixed support for DAQ < 2.0.6
    Source code(tar.gz)
    Source code(zip)
Owner
ntop
Open source network traffic monitoring software: http://t.me/ntop_community
ntop
DPDK / Packet processing experimentation project

flow-orchestrator About This is currently just a platform for me to learn more about DPDK and to have a foundation for some experiments. Building Buil

stefan 4 May 6, 2022
the LIBpcap interface to various kernel packet capture mechanism

LIBPCAP 1.x.y by The Tcpdump Group To report a security issue please send an e-mail to [email protected] To report bugs and other problems, contri

The Tcpdump Group 2k Oct 3, 2022
network packet indexing and querying

_______ _____.___. ________ _____ _____ \ \\__ | |/ _____/ / \ / _ \ / | \/ | / \ ___ / \ / \ / /_\

64k & stackless-goto 18 Dec 15, 2021
A Simple CLI Network Packet Sniffer

packt packt is a simple CL(command line) network packet sniffer which can run on any unix-like OS including termux (Android). packt works by first ope

null 6 Feb 7, 2022
Winpcap-based network packet capture tool, support TLS (part), UDP, ICMP, TCP, ARP, DNS and other protocol analysis, interface reference wireshark.

Winpcap-based network packet capture tool, support TLS (part), UDP, ICMP, TCP, ARP, DNS and other protocol analysis, interface reference wireshark.

null 45 Oct 1, 2022
A special version of Packet Batch that utilizes AF_XDP Linux sockets (this should be faster than the standard version, but not as fast as the DPDK).

Packet Batch (AF_XDP) Description This is a special version of Packet Batch that utilizes AF_XDP sockets instead of AF_PACKETv3 (which is what the sta

Packet Batch 12 Oct 1, 2022
A special version of Packet Batch that utilizes the DPDK (this should be faster than the standard version).

Packet Batch (DPDK) Description This is a special version of Packet Batch that utilizes the DPDK, a kernel-bypass library. This does not use any form

Packet Batch 7 Sep 22, 2022
Common files for Packet Batch. Read this for configuration guidance and more!

Packet Batch (Common) Description This is a repository for Packet Batch that includes common files for all versions of Packet Batch to use (standard,

Packet Batch 3 Oct 1, 2022
Packet filter using XDP.

MocTok This is a packet filter using XDP. Usage usage: moctok [options] ... options: -g, --gen Generate XDP program. (string) -a, --atta

Ai Nozaki 13 Aug 25, 2022
A packet acknowledgement system for UDP

Introduction reliable is a simple packet acknowledgement system for UDP-based protocols. It has the following features: Acknowledgement when packets a

The Network Protocol Company 517 Sep 2, 2022
Warp speed Data Transfer (WDT) is an embeddedable library (and command line tool) aiming to transfer data between 2 systems as fast as possible over multiple TCP paths.

WDT Warp speed Data Transfer Design philosophy/Overview Goal: Lowest possible total transfer time - to be only hardware limited (disc or network bandw

Facebook 2.7k Oct 2, 2022
A cross-platform HTTP client library with a focus on usability and speed

EasyHttp A cross-platform HTTP client library with a focus on usability and speed. Under its hood, EasyHttp uses POCO C++ Libraries and derives many o

Sony 146 Aug 9, 2022
WDT Warp speed Data Transfer

Warp speed Data Transfer (WDT) is an embeddedable library (and command line tool) aiming to transfer data between 2 systems as fast as possible over multiple TCP paths.

Meta Archive 2.7k Oct 2, 2022
Use eBPF to speed up your Service Mesh like crossing an Einstein-Rosen Bridge.

merbridge Use eBPF to speed up your Service Mesh like crossing an Einstein-Rosen Bridge. Usage You just only need to run the following command to your

null 461 Sep 29, 2022
KBMS is a C++11 high performance network framework based on libevent.

KBMS is a C++11 high performance network framework based on libevent. It is light and easy to deploy. At present, it mainly supports HTTP protocol.

Ke Technologies 29 Sep 13, 2022
A headers only high performance C++ middleware framework/lib. See README for details.

# README # hmbdc is an open source headers only C++ framework and library built on top of various real-world tested lockfree algorithms that facilit

null 12 Jun 29, 2022
High performance server-side application framework

Seastar Introduction SeaStar is an event-driven framework allowing you to write non-blocking, asynchronous code in a relatively straightforward manner

ScyllaDB 6.9k Oct 3, 2022
A modern C++ network library for developing high performance network services in TCP/UDP/HTTP protocols.

evpp Introduction 中文说明 evpp is a modern C++ network library for developing high performance network services using TCP/UDP/HTTP protocols. evpp provid

Qihoo 360 3.1k Sep 29, 2022