[Oisf-devel] <Error> (ReceivePfring) -- [ERRCODE: SC_ERR_PF_RING_RECV(31)] - pfring_recv error -1

[Peter Manev]

On Thu, Aug 4, 2011 at 6:25 PM, Chris Wakelin <c.d.wakelin at reading.ac.uk>wrote:

> I've been running with 1520 today, and still get those sorts of errors
> with both native PF_RING (threads=1) and PF_RING-enabled libpcap.
>
> stats.log shows decoder.max_pkt_size = 1518 in both cases. (I'm now
> using PF_RING 4.7.2 and took vlan_id out of the packet hash to cope with
> our one-sided VLAN tags).
>
> Best Wishes,
> Chris
>
> On 04/08/11 16:54, Will Metcalf wrote:
> > Yes or as Peter mentioned VLAN headers... 1518 seems like a better
> > default imho taking these two things into account.  Or heck what about
> > 1522 to account for both 802.1q headers and FCS?
> >
> > Regards,
> >
> > Will
> >
>
> --
> --+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
> Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
> IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 2908
> Whiteknights, Reading, RG6 6AF, UK              Fax: +44 (0)118 975 3094
> _______________________________________________
> Oisf-devel mailing list
> Oisf-devel at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>


Hi,
Can you please try the following:
1. Increase the MTU to 1522
2. Can you try to point suricata to listen to the VLAN interface directly
for example: suricata -c /etc/suricata/yaml -i eth0.15
3. is there any difference?
4. A pcap would be helpful to further explore the issue (should you
consider).

Thanks


-- 
Peter Manev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20110804/1790e0ad/attachment-0002.html>