<br><br><div class="gmail_quote">On Thu, Aug 4, 2011 at 5:54 PM, Will Metcalf <span dir="ltr"><<a href="mailto:william.metcalf@gmail.com">william.metcalf@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Yes or as Peter mentioned VLAN headers... 1518 seems like a better<br>
default imho taking these two things into account. Or heck what about<br>
1522 to account for both 802.1q headers and FCS?<br>
<br>
Regards,<br>
<font color="#888888"><br>
Will<br>
</font><div><div></div><div class="h5"><br>
On Thu, Aug 4, 2011 at 10:43 AM, Will Metcalf <<a href="mailto:william.metcalf@gmail.com">william.metcalf@gmail.com</a>> wrote:<br>
> Heh... It looks like there might be off-by-one error based on the<br>
> allocated buffer and the macro GET_PKT_DIRECT_MAX_SIZE() which is used<br>
> to determine how much data to copy from PF_RING. If I'm reading the<br>
> code correctly it looks like on a fully loaded frame cuts off the last<br>
> byte in a payload. Until we can come up wit a patch/further validate<br>
> try setting your default-packet-size: setting in your suricata.yaml to<br>
> one more byte than the maximum on-wire size of a frame. So for<br>
> example MTU + ethernet header = 1514 bytes set to 1515 bytes or if you<br>
> want to account for FCS transmitted on wire set it to MTU + ethernet<br>
> header + FCS = 1518 set to 1519 bytes.<br>
><br>
> Additionally since there is no guarantee that FCS won't be included in<br>
> a frame Suricata should account for this, by making the default<br>
> snaplen 1518 bytes imho. Thoughts?<br>
><br>
> <a href="http://wiki.wireshark.org/Ethernet" target="_blank">http://wiki.wireshark.org/Ethernet</a><br>
><br>
> Regards,<br>
><br>
> Will<br>
><br>
><br>
> On Thu, Aug 4, 2011 at 10:06 AM, <<a href="mailto:David.R.Wharton@regions.com">David.R.Wharton@regions.com</a>> wrote:<br>
>> Thanks Will. I installed Suricata version 1.1beta2 (rev b3f7e6a) from git<br>
>> and now I don't get the PF_RING errors. Now I get tons of App Layer parser<br>
>> errors, similar to the following, mostly on SSL/TLS connections but I also<br>
>> see it on http and smtp 'app layer protocol':<br>
>><br>
>> [4640] 4/8/2011 -- 09:56:38 - (app-layer-parser.c:955) <Error><br>
>> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing<br>
>> "tls" app layer protocol, using network protocol 6, source IP address<br>
>> <a href="tel:66.255.199.50" value="+16625519950">66.255.199.50</a>, destination IP address <removed>, src port 34481 and dst port<br>
>> 443<br>
>> [4640] 4/8/2011 -- 09:56:38 - (app-layer-parser.c:955) <Error><br>
>> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing<br>
>> "tls" app layer protocol, using network protocol 6, source IP address<br>
>> 153.69.201.240, destination IP address <removed>, src port 7132 and dst port<br>
>> 443<br>
>> [4640] 4/8/2011 -- 09:56:38 - (app-layer-parser.c:955) <Error><br>
>> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing<br>
>> "http" app layer protocol, using network protocol 6, source IP address<br>
>> <removed>, destination IP address 68.147.232.208, src port 53771 and dst<br>
>> port 80<br>
>><br>
>> Thanks.<br>
>><br>
>> -David<br>
>><br>
>><br>
>><br>
>> From: Will Metcalf <<a href="mailto:william.metcalf@gmail.com">william.metcalf@gmail.com</a>><br>
>> To: <a href="mailto:David.R.Wharton@regions.com">David.R.Wharton@regions.com</a><br>
>> Cc: <a href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</a><br>
>> Date: 08/03/2011 04:35 PM<br>
>> Subject: Re: [Oisf-devel] <Error> (ReceivePfring) -- [ERRCODE:<br>
>> SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>> ________________________________<br>
>><br>
>><br>
>> You need to upgrade to the latest suricata version from git. Packets<br>
>> are now passed as a reference in PF_RING 4.7.1, which required us to<br>
>> modify suri.<br>
>><br>
>> Regards,<br>
>><br>
>> Will<br>
>> On Wed, Aug 3, 2011 at 4:30 PM, <<a href="mailto:David.R.Wharton@regions.com">David.R.Wharton@regions.com</a>> wrote:<br>
>>> I'm trying to get Suricata up and running with PF_RING but I keep getting<br>
>>> a<br>
>>> pfring_recv error. Here is a snipped from when Suricata starts up:<br>
>>><br>
>>> [13373] 3/8/2011 -- 16:25:22 - (source-pfring.c:313) <Info><br>
>>> (ReceivePfringThreadInit) -- (ReceivePfring) Using PF_RING v.4.7.1,<br>
>>> interface eth2, cluster-id 99<br>
>>> [13354] 3/8/2011 -- 16:25:23 - (tm-threads.c:1485) <Info><br>
>>> (TmThreadWaitOnThreadInit) -- all 11 packet processing threads, 3<br>
>>> management<br>
>>> threads initialized, engine started.<br>
>>> [13373] 3/8/2011 -- 16:25:23 - (source-pfring.c:232) <Error><br>
>>> (ReceivePfring)<br>
>>> -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>>> [13373] 3/8/2011 -- 16:25:23 - (source-pfring.c:332) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Packets 0, bytes 0<br>
>>> [13373] 3/8/2011 -- 16:25:23 - (source-pfring.c:336) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Pfring Total:0 Recv:0<br>
>>> Drop:0 (nan%).<br>
>>> [13354] 3/8/2011 -- 16:25:24 - (tm-threads.c:1400) <Info><br>
>>> (TmThreadRestartThread) -- thread "ReceivePfring" restarted<br>
>>> [13387] 3/8/2011 -- 16:25:24 - (source-pfring.c:313) <Info><br>
>>> (ReceivePfringThreadInit) -- (ReceivePfring) Using PF_RING v.4.7.1,<br>
>>> interface eth2, cluster-id 99<br>
>>> [13387] 3/8/2011 -- 16:25:24 - (source-pfring.c:232) <Error><br>
>>> (ReceivePfring)<br>
>>> -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>>> [13387] 3/8/2011 -- 16:25:24 - (source-pfring.c:332) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Packets 0, bytes 0<br>
>>> [13387] 3/8/2011 -- 16:25:24 - (source-pfring.c:336) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Pfring Total:0 Recv:0<br>
>>> Drop:0 (nan%).<br>
>>> [13354] 3/8/2011 -- 16:25:24 - (tm-threads.c:1400) <Info><br>
>>> (TmThreadRestartThread) -- thread "ReceivePfring" restarted<br>
>>> [13388] 3/8/2011 -- 16:25:24 - (source-pfring.c:313) <Info><br>
>>> (ReceivePfringThreadInit) -- (ReceivePfring) Using PF_RING v.4.7.1,<br>
>>> interface eth2, cluster-id 99<br>
>>> [13388] 3/8/2011 -- 16:25:24 - (source-pfring.c:232) <Error><br>
>>> (ReceivePfring)<br>
>>> -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>>> [13388] 3/8/2011 -- 16:25:24 - (source-pfring.c:332) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Packets 0, bytes 0<br>
>>> [13388] 3/8/2011 -- 16:25:24 - (source-pfring.c:336) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Pfring Total:0 Recv:0<br>
>>> Drop:0 (nan%).<br>
>>> [13354] 3/8/2011 -- 16:25:24 - (tm-threads.c:1400) <Info><br>
>>> (TmThreadRestartThread) -- thread "ReceivePfring" restarted<br>
>>> [13389] 3/8/2011 -- 16:25:24 - (source-pfring.c:313) <Info><br>
>>> (ReceivePfringThreadInit) -- (ReceivePfring) Using PF_RING v.4.7.1,<br>
>>> interface eth2, cluster-id 99<br>
>>> [13389] 3/8/2011 -- 16:25:24 - (source-pfring.c:232) <Error><br>
>>> (ReceivePfring)<br>
>>> -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>>> [13389] 3/8/2011 -- 16:25:24 - (source-pfring.c:332) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Packets 0, bytes 0<br>
>>> [13389] 3/8/2011 -- 16:25:24 - (source-pfring.c:336) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Pfring Total:0 Recv:0<br>
>>> Drop:0 (nan%).<br>
>>> [13354] 3/8/2011 -- 16:25:24 - (tm-threads.c:1400) <Info><br>
>>> (TmThreadRestartThread) -- thread "ReceivePfring" restarted<br>
>>> [13390] 3/8/2011 -- 16:25:24 - (source-pfring.c:313) <Info><br>
>>> (ReceivePfringThreadInit) -- (ReceivePfring) Using PF_RING v.4.7.1,<br>
>>> interface eth2, cluster-id 99<br>
>>> [13390] 3/8/2011 -- 16:25:24 - (source-pfring.c:232) <Error><br>
>>> (ReceivePfring)<br>
>>> -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>>> [13390] 3/8/2011 -- 16:25:24 - (source-pfring.c:332) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Packets 0, bytes 0<br>
>>> [13390] 3/8/2011 -- 16:25:24 - (source-pfring.c:336) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Pfring Total:0 Recv:0<br>
>>> Drop:0 (nan%).<br>
>>> [13354] 3/8/2011 -- 16:25:24 - (tm-threads.c:1400) <Info><br>
>>> (TmThreadRestartThread) -- thread "ReceivePfring" restarted<br>
>>> [13391] 3/8/2011 -- 16:25:24 - (source-pfring.c:313) <Info><br>
>>> (ReceivePfringThreadInit) -- (ReceivePfring) Using PF_RING v.4.7.1,<br>
>>> interface eth2, cluster-id 99<br>
>>> [13391] 3/8/2011 -- 16:25:24 - (source-pfring.c:232) <Error><br>
>>> (ReceivePfring)<br>
>>> -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>>> [13391] 3/8/2011 -- 16:25:24 - (source-pfring.c:332) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Packets 0, bytes 0<br>
>>> [13391] 3/8/2011 -- 16:25:24 - (source-pfring.c:336) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Pfring Total:0 Recv:0<br>
>>> Drop:0 (nan%).<br>
>>> [13354] 3/8/2011 -- 16:25:24 - (tm-threads.c:1400) <Info><br>
>>> (TmThreadRestartThread) -- thread "ReceivePfring" restarted<br>
>>> [13392] 3/8/2011 -- 16:25:24 - (source-pfring.c:313) <Info><br>
>>> (ReceivePfringThreadInit) -- (ReceivePfring) Using PF_RING v.4.7.1,<br>
>>> interface eth2, cluster-id 99<br>
>>> [13392] 3/8/2011 -- 16:25:24 - (source-pfring.c:232) <Error><br>
>>> (ReceivePfring)<br>
>>> -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>>> [13392] 3/8/2011 -- 16:25:24 - (source-pfring.c:332) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Packets 0, bytes 0<br>
>>> [13392] 3/8/2011 -- 16:25:24 - (source-pfring.c:336) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Pfring Total:0 Recv:0<br>
>>> Drop:0 (nan%).<br>
>>> [13354] 3/8/2011 -- 16:25:24 - (tm-threads.c:1400) <Info><br>
>>> (TmThreadRestartThread) -- thread "ReceivePfring" restarted<br>
>>> [13393] 3/8/2011 -- 16:25:25 - (source-pfring.c:313) <Info><br>
>>> (ReceivePfringThreadInit) -- (ReceivePfring) Using PF_RING v.4.7.1,<br>
>>> interface eth2, cluster-id 99<br>
>>> [13393] 3/8/2011 -- 16:25:25 - (source-pfring.c:232) <Error><br>
>>> (ReceivePfring)<br>
>>> -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1<br>
>>> [13393] 3/8/2011 -- 16:25:25 - (source-pfring.c:332) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Packets 0, bytes 0<br>
>>> [13393] 3/8/2011 -- 16:25:25 - (source-pfring.c:336) <Info><br>
>>> (ReceivePfringThreadExitStats) -- (ReceivePfring) Pfring Total:0 Recv:0<br>
>>> Drop:0 (nan%).<br>
>>> [13354] 3/8/2011 -- 16:25:25 - (tm-threads.c:1400) <Info><br>
>>> (TmThreadRestartThread) -- thread "ReceivePfring" restarted<br>
>>> [13395] 3/8/2011 -- 16:25:25 - (source-pfring.c:307) <Error><br>
>>> (ReceivePfringThreadInit) -- [ERRCODE:<br>
>>> SC_ERR_PF_RING_SET_CLUSTER_FAILED(37)] - pfring_set_cluster returned -1<br>
>>> for<br>
>>> cluster-id: 99<br>
>>> [13354] 3/8/2011 -- 16:25:25 - (suricata.c:1363) <Info> (main) -- signal<br>
>>> received<br>
>>> [13354] 3/8/2011 -- 16:25:25 - (suricata.c:1414) <Info> (main) -- time<br>
>>> elapsed 3s<br>
>>> [13384] 3/8/2011 -- 16:25:25 - (flow.c:1142) <Info> (FlowManagerThread) --<br>
>>> 0<br>
>>> new flows, 0 established flows were timed out, 0 flows in closed state<br>
>>> [13354] 3/8/2011 -- 16:25:25 - (stream-tcp-reassemble.c:352) <Info><br>
>>> (StreamTcpReassembleFree) -- Max memuse of the stream reassembly engine<br>
>>> 11220864 (in use 0)<br>
>>> [13354] 3/8/2011 -- 16:25:25 - (stream-tcp.c:495) <Info><br>
>>> (StreamTcpFreeConfig) -- Max memuse of stream engine 4063232 (in use 0)<br>
>>> [13354] 3/8/2011 -- 16:25:26 - (detect.c:3403) <Info><br>
>>> (SigAddressCleanupStage1) -- cleaning up signature grouping structure...<br>
>>> complete<br>
>>><br>
>>> I am running PF_RING 4.7.1 ($Revision: 4753$) and Suricata version<br>
>>> 1.1beta2.<br>
>>><br>
>>> PF_RING seems to be installed OK and I can run the pfcount program just<br>
>>> fine:<br>
>>><br>
>>> # cat /proc/net/pf_ring/info<br>
>>> PF_RING Version : 4.7.1 ($Revision: 4753$)<br>
>>> Ring slots : 4096<br>
>>> Slot version : 13<br>
>>> Capture TX : Yes [RX+TX]<br>
>>> IP Defragment : No<br>
>>> Socket Mode : Standard<br>
>>> Transparent mode : Yes (mode 0)<br>
>>> Total rings : 0<br>
>>> Total plugins : 0<br>
>>><br>
>>><br>
>>> # ./pfcount -i eth2<br>
>>> Using PF_RING v.4.7.1<br>
>>> Capturing from eth2 [00:1B:78:31:F1:A4]<br>
>>> # Device RX channels: 1<br>
>>> # Polling threads: 1<br>
>>> =========================<br>
>>> Absolute Stats: [49859 pkts rcvd][0 pkts dropped]<br>
>>> Total Pkts=49859/Dropped=0.0 %<br>
>>> 49'859 pkts - 28'713'541 bytes<br>
>>> =========================<br>
>>><br>
>>> =========================<br>
>>> Absolute Stats: [102158 pkts rcvd][0 pkts dropped]<br>
>>> Total Pkts=102158/Dropped=0.0 %<br>
>>> 102'158 pkts - 59'531'866 bytes [101'959.38 pkt/sec - 475.33 Mbit/sec]<br>
>>> =========================<br>
>>> Actual Stats: 52299 pkts [1'001.94 ms][52'197.37 pkt/sec]<br>
>>> =========================<br>
>>><br>
>>><br>
>>> Any ideas?<br>
>>><br>
>>> Thanks.<br>
>>><br>
>>> -David<br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> Oisf-devel mailing list<br>
>>> <a href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a><br>
>>> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
>>><br>
>>><br>
>><br>
>><br>
><br>
_______________________________________________<br>
Oisf-devel mailing list<br>
<a href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
</div></div></blockquote></div><br>yes,<br>1522 would be the best.<br>Linx default MTU is 1500 I think....<br><br clear="all"><br>-- <br>Peter Manev<br>
<div style="visibility: hidden; left: -5000px; position: absolute; z-index: 9999; padding: 0px; margin-left: 0px; margin-top: 0px; overflow: hidden; word-wrap: break-word; color: black; font-size: 10px; text-align: left; line-height: 130%;" id="avg_ls_inline_popup">
</div>