<font size=2 face="sans-serif">I am trying to get Suricata up and running
with PF_RING and it is crashing on the PF_RING part. In ifconfig,
my interfaces/sub interfaces are:</font>
<br>
<br><font size=2 face="sans-serif">bond0</font>
<br><font size=2 face="sans-serif">bond0.1035</font>
<br><font size=2 face="sans-serif">bond0.1036</font>
<br><font size=2 face="sans-serif">.</font>
<br><font size=2 face="sans-serif">.</font>
<br><font size=2 face="sans-serif">.</font>
<br><font size=2 face="sans-serif">bond0.142</font>
<br><font size=2 face="sans-serif">eth0</font>
<br><font size=2 face="sans-serif">eth2</font>
<br><font size=2 face="sans-serif">eth3</font>
<br><font size=2 face="sans-serif">lo</font>
<br>
<br><font size=2 face="sans-serif">Suricata was compiled with PF_RING support
and PF_RING was installed and everything seems to be fine until I try to
run Suricata with PF_RING on bond0:</font>
<br>
<br><font size=2 face="sans-serif">/usr/local/bin/suricata -c /etc/suricata/suricata-open.yaml
--pfring-int=bond0 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow</font>
<br>
<br><font size=2 face="sans-serif">I get these errors at the end:</font>
<br>
<br><font size=2 face="sans-serif">[20106] 21/7/2011 -- 16:26:51 - (source-pfring.c:282)
<Error> (ReceivePfringThreadInit) -- [ERRCODE: SC_ERR_PF_RING_OPEN(34)]
- opening bond0 failed: pfring_open error</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:51 - (stream-tcp.c:367)
<Info> (StreamTcpInitConfig) -- stream "memcap": 33554432</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:55 - (stream-tcp.c:374)
<Info> (StreamTcpInitConfig) -- stream "midstream" session
pickups: disabled</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (stream-tcp.c:382)
<Info> (StreamTcpInitConfig) -- stream "async_oneside":
disabled</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (stream-tcp.c:398)
<Info> (StreamTcpInitConfig) -- stream "checksum_validation":
enabled</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (stream-tcp.c:409)
<Info> (StreamTcpInitConfig) -- stream."inline": disabled</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (stream-tcp.c:418)
<Info> (StreamTcpInitConfig) -- stream.reassembly "memcap":
67108864</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (stream-tcp.c:428)
<Info> (StreamTcpInitConfig) -- stream.reassembly "depth":
1048576</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (stream-tcp.c:451)
<Info> (StreamTcpInitConfig) -- stream.reassembly "toserver_chunk_size":
2560</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (stream-tcp.c:453)
<Info> (StreamTcpInitConfig) -- stream.reassembly "toclient_chunk_size":
2560</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (tm-threads.c:1472)
<Error> (TmThreadWaitOnThreadInit) -- [ERRCODE: SC_ERR_THREAD_INIT(49)]
- thread "ReceivePfring" closed on initialization.</font>
<br><font size=2 face="sans-serif">[20071] 21/7/2011 -- 16:26:58 - (suricata.c:1344)
<Error> (main) -- [ERRCODE: SC_ERR_INITIALIZATION(45)] - Engine initialization
failed, aborting...</font>
<br>
<br><font size=2 face="sans-serif">But if I run the same command but using
a different interface like eth2, it does not crash. I can even run
the PF_RING example program on bond0 and it works:</font>
<br>
<br><font size=2 face="sans-serif"># ./pfcount -bond0</font>
<br><font size=2 face="sans-serif">Using PF_RING v.4.7.1</font>
<br><font size=2 face="sans-serif">Capturing from eth0 [00:C0:9F:3F:61:1A]</font>
<br><font size=2 face="sans-serif"># Device RX channels: 1</font>
<br><font size=2 face="sans-serif"># Polling threads: 1</font>
<br><font size=2 face="sans-serif">=========================</font>
<br><font size=2 face="sans-serif">Absolute Stats: [3 pkts rcvd][0 pkts
dropped]</font>
<br><font size=2 face="sans-serif">Total Pkts=3/Dropped=0.0 %</font>
<br><font size=2 face="sans-serif">3 pkts - 225 bytes</font>
<br><font size=2 face="sans-serif">=========================</font>
<br>
<br><font size=2 face="sans-serif">=========================</font>
<br><font size=2 face="sans-serif">Absolute Stats: [8 pkts rcvd][0 pkts
dropped]</font>
<br><font size=2 face="sans-serif">Total Pkts=8/Dropped=0.0 %</font>
<br><font size=2 face="sans-serif">8 pkts - 674 bytes [7.98 pkt/sec - 0.01
Mbit/sec]</font>
<br><font size=2 face="sans-serif">=========================</font>
<br><font size=2 face="sans-serif">Actual Stats: 5 pkts [1'001.94 ms][4.99
pkt/sec]</font>
<br><font size=2 face="sans-serif">=========================</font>
<br>
<br><font size=2 face="sans-serif">I also see PF_RING create the rings
when I have something capturing using it:</font>
<br>
<br><font size=2 face="sans-serif"># cat /proc/net/pf_ring/info</font>
<br><font size=2 face="sans-serif">PF_RING Version : 4.7.1
($Revision: 4733$)</font>
<br><font size=2 face="sans-serif">Ring slots
: 4096</font>
<br><font size=2 face="sans-serif">Slot version :
13</font>
<br><font size=2 face="sans-serif">Capture TX
: Yes [RX+TX]</font>
<br><font size=2 face="sans-serif">IP Defragment :
No</font>
<br><font size=2 face="sans-serif">Socket Mode
: Standard</font>
<br><font size=2 face="sans-serif">Transparent mode : Yes
(mode 0)</font>
<br><font size=2 face="sans-serif">Total rings
: 2</font>
<br><font size=2 face="sans-serif">Total plugins :
0</font>
<br>
<br><font size=2 face="sans-serif">I pulled the latest PF_RING source from
SVN today (v4.7.1) and the latest Suricata beta source (v1.1b2) from the
OISF site. Sorry for the long email but I though I would ask the
experts.</font>
<br>
<br><font size=2 face="sans-serif">Thanks for any responses.</font>
<br>
<br><font size=2 face="sans-serif">-David</font>