[Oisf-users] Difficulty finding compatible PF_RING revision/version

Tue Jul 26 05:34:24 UTC 2011

This patch only sets cluster id and type if there is more than one
receive thread. This has the side-effect that we get accurate drop
stats for a a single PF_RING mode (Luca is aware that cluster drop
stats are broken, and is working on a fix at some point in the
future).  Unfortunately as previously stated the native PF_RING
interface doesn't seem to work with bonded interfaces.

Regards,

Will

On Tue, Jun 7, 2011 at 2:47 PM,  <hachirota at gmail.com> wrote:
> Will Metcalf wrote:
>
>> Have you contacted the ntop-dev list to report the driver build
>> failure?  I'm sure they would like to know about it ;-).
>
> Good idea, thanks. I did that just now.
>
>
> Chris Wakelin wrote:
>
>>> # ethtool -i eth0
>>> driver: e1000e
>>> version: 0.3.3.3-k2
>>> firmware-version: 3.1-2
>>> bus-info: 0000:03:00.0
>
>> That'll be the non-PF_RING enabled driver. You probably need to do
>> "rmmod e1000e;modprobe e1000e" to get the 1.0.15 driver. PF_RING
>> will work without, it just won't be as much of a performance boost.
>
> Hi Chris. While the server was idling, and before I ran rmmod
> e1000e;modprobe e1000e, this appeared in /var/log/messages:
>
>> [PF_RING] Welcome to PF_RING 4.5.0 ($Revision: exported$)
>> (C) 2004-10 L.Deri <deri at ntop.org>
>> [PF_RING] registered /proc/net/pf_ring/
>> NET: Registered protocol family 27
>> proc_dir_entry 'eth0' already registered
>> Pid: 4674, comm: modprobe Not tainted 2.6.26-2-openvz-amd64 #1
>>
>> Call Trace:
>>  [<ffffffff8030f1c6>] idr_get_new+0xb/0x28
>>  [<ffffffff802e08b9>] proc_register+0xcb/0x14b
>>  [<ffffffff802e0ae9>] proc_mkdir_mode+0x3c/0x51
>>  [<ffffffffa030e029>] :pf_ring:add_device_to_ring_list+0x50/0x9f
>>  [<ffffffffa030e0ed>] :pf_ring:ring_notifier+0x75/0x14f
>>  [<ffffffff803b1513>] register_netdevice_notifier+0x53/0x164
>>  [<ffffffffa00251f8>] :pf_ring:ring_init+0x1f8/0x2b2
>>  [<ffffffff8025dcaf>] sys_init_module+0x191b/0x1ab1
>>  [<ffffffff8029c485>] __kmalloc+0x0/0x198
>>  [<ffffffff8020c00a>] system_call_after_swapgs+0x8a/0x8f
>>
>> [PF_RING] Min # ring slots 4096
>> [PF_RING] Slot version     12
>> [PF_RING] Capture TX       Yes [RX+TX]
>> [PF_RING] Transparent Mode 0
>> [PF_RING] IP Defragment    No
>> [PF_RING] Initialized correctly
>
> Then I ran rmmod e1000e;modprobe e1000e...
>
>> ACPI: PCI interrupt for device 0000:02:00.0 disabled
>> br0: port 1(eth0) entering disabled state
>> device eth0 left promiscuous mode
>> br0: port 1(eth0) entering disabled state
>> remove_proc_entry: removing non-empty directory 'dev/eth0', leaking at least 'info'
>> ------------[ cut here ]------------
>> WARNING: at fs/proc/generic.c:842 remove_proc_entry+0x164/0x182()
>> Modules linked in: pf_ring vzethdev vznetdev simfs vzrst vzcpt tun vzdquota vzmon vzdev xt_tcpudp xt_length ipt_ttl xt_tcpmss xt_TCPMSS iptable_mangle iptable_filter xt_multiport xt_limit xt_dscp ipt_REJECT ip_tables x_tables ipv6 bridge raid1 md_mod loop snd_hda_intel snd_pcm psmouse snd_timer i2c_i801 shpchp serio_raw snd soundcore pci_hotplug i2c_core pcspkr snd_page_alloc button evdev ext3 jbd mbcache sd_mod ata_piix ata_generic libata scsi_mod dock ide_pci_generic ide_core e1000e(-) ehci_hcd uhci_hcd thermal processor fan thermal_sys [last unloaded: scsi_wait_scan]
>> Pid: 4892, comm: rmmod Not tainted 2.6.26-2-openvz-amd64 #1
>> Call Trace:
>>  [<ffffffff80234e10>] warn_on_slowpath+0x51/0x7a
>>  [<ffffffff80235c5a>] printk+0x4e/0x56
>>  [<ffffffff802eb08c>] remove_dir+0x29/0x31
>>  [<ffffffff802e0617>] xlate_proc_name+0x3b/0x90
>>  [<ffffffff802e0fea>] remove_proc_entry+0x164/0x182
>>  [<ffffffff8030fade>] kobject_del+0x23/0x2d
>>  [<ffffffffa030d296>] :pf_ring:remove_device_from_ring_list+0x57/0x92
>>  [<ffffffffa030e10a>] :pf_ring:ring_notifier+0x92/0x14f
>>  [<ffffffff8024b464>] notifier_call_chain+0x29/0x4c
>>  [<ffffffff803b173c>] rollback_registered+0xa1/0xfb
>>  [<ffffffff803b17c8>] unregister_netdevice+0x32/0x5b
>>  [<ffffffff803b1802>] unregister_netdev+0x11/0x17
>>  [<ffffffffa00428d8>] :e1000e:e1000_remove+0x52/0xc4
>>  [<ffffffff8031cf0c>] pci_device_remove+0x24/0x47
>>  [<ffffffff8037a1ec>] __device_release_driver+0x74/0x97
>>  [<ffffffff8037a603>] driver_detach+0x7f/0xac
>>  [<ffffffff8037961a>] bus_remove_driver+0x7b/0x9e
>>  [<ffffffff8031d1b6>] pci_unregister_driver+0x24/0x7a
>>  [<ffffffffa0042874>] :e1000e:e1000_exit_module+0x10/0x22
>>  [<ffffffff8025e043>] sys_delete_module+0x1a6/0x1fe
>>  [<ffffffff803125a7>] __up_write+0x21/0x10e
>>  [<ffffffff8020c00a>] system_call_after_swapgs+0x8a/0x8f
>> ---[ end trace 5564a751e99d2647 ]---
>> ACPI: PCI interrupt for device 0000:03:00.0 disabled
>> e1000e: Intel(R) PRO/1000 Network Driver - 1.0.15-NAPI
>> e1000e: Copyright(c) 1999 - 2009 Intel Corporation.
>> ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 16 (level, low) -> IRQ 16
>> e1000e 0000:03:00.0: Warning: detected ASPM enabled in EEPROM
>> proc_dir_entry 'eth0' already registered
>> Pid: 4920, comm: modprobe Tainted: G        W 2.6.26-2-openvz-amd64 #1
>> Call Trace:
>>  [<ffffffff8030f1c6>] idr_get_new+0xb/0x28
>>  [<ffffffff802e08b9>] proc_register+0xcb/0x14b
>>  [<ffffffff802e0ae9>] proc_mkdir_mode+0x3c/0x51
>>  [<ffffffffa030e029>] :pf_ring:add_device_to_ring_list+0x50/0x9f
>>  [<ffffffffa030e0ed>] :pf_ring:ring_notifier+0x75/0x14f
>>  [<ffffffff8024b464>] notifier_call_chain+0x29/0x4c
>>  [<ffffffff803b20cb>] register_netdevice+0x317/0x358
>>  [<ffffffff803b2145>] register_netdev+0x39/0x46
>>  [<ffffffffa0330491>] :e1000e:e1000_probe+0x911/0xe80
>>  [<ffffffff802b37d5>] iput+0x27/0x60
>>  [<ffffffff802eaebd>] sysfs_addrm_finish+0x62/0x208
>>  [<ffffffff802eaba8>] sysfs_find_dirent+0x1b/0x2f
>>  [<ffffffff8031cfef>] pci_device_probe+0xa9/0xf8
>>  [<ffffffff8037a408>] driver_probe_device+0xd0/0x14d
>>  [<ffffffff8037a4cb>] __driver_attach+0x46/0x6d
>>  [<ffffffff8037a485>] __driver_attach+0x0/0x6d
>>  [<ffffffff80379bab>] bus_for_each_dev+0x44/0x6f
>>  [<ffffffff80379fe1>] bus_add_driver+0xb4/0x203
>>  [<ffffffff8037a727>] driver_register+0x8d/0x101
>>  [<ffffffff8031d253>] __pci_register_driver+0x47/0x78
>>  [<ffffffff8025dcaf>] sys_init_module+0x191b/0x1ab1
>>  [<ffffffff80296a26>] alloc_pages_current+0x0/0xa0
>>  [<ffffffff8020c00a>] system_call_after_swapgs+0x8a/0x8f
>> 0000:03:00.0: eth0: (PCI Express:2.5GB/s:Width x1) 00:e0:81:b1:91:69
>> 0000:03:00.0: eth0: Intel(R) PRO/1000 Network Connection
>> 0000:03:00.0: eth0: MAC: 3, PHY: 2, PBA No: ffffff-0ff
>> ACPI: PCI Interrupt 0000:02:00.0[A] -> GSI 17 (level, low) -> IRQ 17
>> e1000e 0000:02:00.0: Warning: detected ASPM enabled in EEPROM
>> 0000:02:00.0: eth1: (PCI Express:2.5GB/s:Width x1) 00:e0:81:b1:91:68
>> 0000:02:00.0: eth1: Intel(R) PRO/1000 Network Connection
>> 0000:02:00.0: eth1: MAC: 3, PHY: 2, PBA No: ffffff-0ff
>
> I got dropped off my remote server and had to wait for a scheduled
> reboot.
>
>
>> pcount uses libpcap; what does pfcount (native PF_RING) do? If you're
>> feeling brave you can try "transparent_mode=2" in pf_ring, but make sure
>> you're not using the same interface for non-PF_RING apps like SSH :)
>
> /proc/net/pf_ring/info is not present and ./pfcount gives me
> "pfring_open error". Oddly, earlier in the day pfcount was working and
> /proc/net/pf_ring/info was present, even though ethtool reported
> e1000e version 0.3.3.3-k2.
>
> I suppose something is wrong. I might have to try to find a version of
> PF_RING that has the newer version 1.3.10a, perhaps something after
> PF_RING v4.6.5. And that works with the Suricata build process, of
> course. Oh, the tangled webs we weave :)
>
>
> Warm Regards,
>
> --
> David
>
> Tuesday, June 07, 2011, 3:14:35 PM Eastern Standard Time
>
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Only-set-PF_RING-cluster-if-we-have-more-than-one-re.patch
Type: application/octet-stream
Size: 4579 bytes
Desc: not available
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20110726/1b78b1a3/attachment.obj>