[Oisf-devel] pfring_autofp broken in latest git master

Chris Wakelin c.d.wakelin at reading.ac.uk
Mon Apr 11 22:47:12 UTC 2011

On 11/04/11 21:31, Victor Julien wrote:
> On 04/11/2011 04:35 PM, Chris Wakelin wrote:
>> Just trying the latest git master (as I generally do :)) and found my
>> Suricata wouldn't start:
>>> suricata --pfring-int=eth2 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow -c /etc/suricata/suricata.yaml
>>> [22778] 11/4/2011 -- 15:25:25 - (suricata.c:554) <Info> (main) -- This is Suricata version 1.1beta1 (rev 663d03c)
>>> [22778] 11/4/2011 -- 15:25:25 - (util-cpu.c:171) <Info> (UtilCpuPrintSummary) -- CPUs/cores online: 4
>>> [22778] 11/4/2011 -- 15:25:25 - (util-ioctl.c:80) <Info> (GetIfaceMTU) -- Failure when trying to get MTU via ioctl: 19
>>> Error: Queue "" doesn't have a writer
>> I like the new options to choose runmode, and the descriptions that go
>> with them. It works if I use "--runmode=auto" (which seems to be the
>> default) but not "--runmode=autofp". BTW can the default be made
>> explicit somewhere, and maybe log which runmode is being used?
> I just pushed a new git master containing a fix, can you try that?
> Cheers,
> Victor

Starts OK now, though I'd got a mistake in my suricata.yaml where I'd
had "cluster-type: cluster_per_flow" instead of "cluster_flow". The
older version didn't seem to mind as I'd specified the correct type on
the command line. I guess it's all right to insist the config file entry
is correct as long as the command line version still takes precedence.

When I have threads > 1, it still doesn't log stats properly - all the
RxPfringN entries are 0. It seems to work OK, though.

Best Wishes,

P.S. I'm off to Networkshop (3-day .ac.uk networking conference)
tomorrow and giving my talk on Suricata + PF_RING on Wednesday morning.
Let's see if I can get some more converts :)

Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 8439
Whiteknights, Reading, RG6 2AF, UK              Fax: +44 (0)118 975 3094

More information about the Oisf-devel mailing list