[Oisf-devel] pfring_autofp broken in latest git master

[Victor Julien]

On 04/12/2011 12:47 AM, Chris Wakelin wrote:
> 
> 
> On 11/04/11 21:31, Victor Julien wrote:
>> On 04/11/2011 04:35 PM, Chris Wakelin wrote:
>>> Just trying the latest git master (as I generally do :)) and found my
>>> Suricata wouldn't start:
>>>
>>>> suricata --pfring-int=eth2 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow -c /etc/suricata/suricata.yaml
>>>> [22778] 11/4/2011 -- 15:25:25 - (suricata.c:554) <Info> (main) -- This is Suricata version 1.1beta1 (rev 663d03c)
>>>> [22778] 11/4/2011 -- 15:25:25 - (util-cpu.c:171) <Info> (UtilCpuPrintSummary) -- CPUs/cores online: 4
>>>> [22778] 11/4/2011 -- 15:25:25 - (util-ioctl.c:80) <Info> (GetIfaceMTU) -- Failure when trying to get MTU via ioctl: 19
>>>> Error: Queue "" doesn't have a writer
>>>
>>> I like the new options to choose runmode, and the descriptions that go
>>> with them. It works if I use "--runmode=auto" (which seems to be the
>>> default) but not "--runmode=autofp". BTW can the default be made
>>> explicit somewhere, and maybe log which runmode is being used?
>>
>> I just pushed a new git master containing a fix, can you try that?
>>
>> Cheers,
>> Victor
>>
> 
> Starts OK now, though I'd got a mistake in my suricata.yaml where I'd
> had "cluster-type: cluster_per_flow" instead of "cluster_flow". The
> older version didn't seem to mind as I'd specified the correct type on
> the command line. I guess it's all right to insist the config file entry
> is correct as long as the command line version still takes precedence.

Right, this was the bug: the command line supplied values weren't used.
Current master fixes this.

> When I have threads > 1, it still doesn't log stats properly - all the
> RxPfringN entries are 0. It seems to work OK, though.

Ya, known issue. It think it does update the log at shutdown. Can you
open a ticket for this?

> P.S. I'm off to Networkshop (3-day .ac.uk networking conference)
> tomorrow and giving my talk on Suricata + PF_RING on Wednesday morning.
> Let's see if I can get some more converts :)

Cool! Please let us know if new ideas are born there :)

Cheers,
Victor


-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------