[Oisf-users] Difficulty finding compatible PF_RING revision/version

[Will Metcalf]

Have you contacted the ntop-dev list to report the driver build
failure?  I'm sure they would like to know about it ;-).

Regards,

Will

On Tue, Jun 7, 2011 at 12:47 PM,  <hachirota at gmail.com> wrote:
> Many thanks to all for the fast suggestions, and to Victor for the
> equally speedy patch.
>
> With r4613 (4.6.5), e1000e-pf_ring 1.3.10a fails to
> dkms build on Debian 5.0 + 2.6.26-2-openvz-amd64 kernel.
>
> With PF_RING r4381 (4.5.0) everything clicked into place and suricata
> built. Kudos.
>
> A few tests suggest to me that it's installed properly. The eth0
> driver version hasn't changed but I don't think that's a problem...
> someone correct me if I'm wrong :)
>
>
> # ethtool -i eth0
> driver: e1000e
> version: 0.3.3.3-k2
> firmware-version: 3.1-2
> bus-info: 0000:03:00.0
>
> # modinfo pf_ring
> filename:       /lib/modules/2.6.26-2-openvz-amd64/updates/dkms/pf_ring.ko
> alias:          net-pf-27
> description:    Packet capture acceleration and analysis
> author:         Luca Deri <deri at ntop.org>
> license:        GPL
> depends:
> vermagic:       2.6.26-2-openvz-amd64 SMP mod_unload modversions
> parm:           min_num_slots:Number of ring slots (uint)
> parm:           transparent_mode:0=standard Linux, 1=direct2pfring+transparent, 2=direct2pfring+non transparentFor 1 and 2 you need to use a PF_RING aware driver (uint)
> parm:           enable_tx_capture:Set to 1 to capture outgoing packets (uint)
> parm:           enable_ip_defrag:Set to 1 to enable IP defragmentation(only rx traffic is defragmentead) (uint)
>
> # cat /proc/net/pf_ring/info
> PF_RING Version     : 4.5.0 ($Revision: exported$)
> Ring slots          : 4096
> Slot version        : 12
> Capture TX          : Yes [RX+TX]
> IP Defragment       : No
> Transparent mode    : Yes
> Total rings         : 0
> Total plugins       : 0
>
> # ./pcount
> Capturing from eth0
> =========================
> Absolute Stats: [3 pkts rcvd][0 pkts dropped]
> Total Pkts=3/Dropped=0.0 %
> 3 pkts [9.2 pkt/sec] - 226 bytes [0.01 Mbit/sec]
> =========================
>
>
> --
> David
>
> Tuesday, June 07, 2011, 12:44:57 PM Eastern Standard Time
>
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>