[Oisf-users] Difficulty finding compatible PF_RING revision/version

Tue Jun 7 19:47:34 UTC 2011

Will Metcalf wrote:

> Have you contacted the ntop-dev list to report the driver build
> failure?  I'm sure they would like to know about it ;-).

Good idea, thanks. I did that just now.

Chris Wakelin wrote:

>> # ethtool -i eth0
>> driver: e1000e
>> version: 0.3.3.3-k2
>> firmware-version: 3.1-2
>> bus-info: 0000:03:00.0

> That'll be the non-PF_RING enabled driver. You probably need to do
> "rmmod e1000e;modprobe e1000e" to get the 1.0.15 driver. PF_RING
> will work without, it just won't be as much of a performance boost.

Hi Chris. While the server was idling, and before I ran rmmod
e1000e;modprobe e1000e, this appeared in /var/log/messages:

> [PF_RING] Welcome to PF_RING 4.5.0 ($Revision: exported$)
> (C) 2004-10 L.Deri <deri at ntop.org>
> [PF_RING] registered /proc/net/pf_ring/
> NET: Registered protocol family 27
> proc_dir_entry 'eth0' already registered
> Pid: 4674, comm: modprobe Not tainted 2.6.26-2-openvz-amd64 #1
> 
> Call Trace:
>  [<ffffffff8030f1c6>] idr_get_new+0xb/0x28
>  [<ffffffff802e08b9>] proc_register+0xcb/0x14b
>  [<ffffffff802e0ae9>] proc_mkdir_mode+0x3c/0x51
>  [<ffffffffa030e029>] :pf_ring:add_device_to_ring_list+0x50/0x9f
>  [<ffffffffa030e0ed>] :pf_ring:ring_notifier+0x75/0x14f
>  [<ffffffff803b1513>] register_netdevice_notifier+0x53/0x164
>  [<ffffffffa00251f8>] :pf_ring:ring_init+0x1f8/0x2b2
>  [<ffffffff8025dcaf>] sys_init_module+0x191b/0x1ab1
>  [<ffffffff8029c485>] __kmalloc+0x0/0x198
>  [<ffffffff8020c00a>] system_call_after_swapgs+0x8a/0x8f
> 
> [PF_RING] Min # ring slots 4096
> [PF_RING] Slot version     12
> [PF_RING] Capture TX       Yes [RX+TX]
> [PF_RING] Transparent Mode 0
> [PF_RING] IP Defragment    No
> [PF_RING] Initialized correctly

Then I ran rmmod e1000e;modprobe e1000e...

> ACPI: PCI interrupt for device 0000:02:00.0 disabled
> br0: port 1(eth0) entering disabled state
> device eth0 left promiscuous mode
> br0: port 1(eth0) entering disabled state
> remove_proc_entry: removing non-empty directory 'dev/eth0', leaking at least 'info'
> ------------[ cut here ]------------
> WARNING: at fs/proc/generic.c:842 remove_proc_entry+0x164/0x182()
> Modules linked in: pf_ring vzethdev vznetdev simfs vzrst vzcpt tun vzdquota vzmon vzdev xt_tcpudp xt_length ipt_ttl xt_tcpmss xt_TCPMSS iptable_mangle iptable_filter xt_multiport xt_limit xt_dscp ipt_REJECT ip_tables x_tables ipv6 bridge raid1 md_mod loop snd_hda_intel snd_pcm psmouse snd_timer i2c_i801 shpchp serio_raw snd soundcore pci_hotplug i2c_core pcspkr snd_page_alloc button evdev ext3 jbd mbcache sd_mod ata_piix ata_generic libata scsi_mod dock ide_pci_generic ide_core e1000e(-) ehci_hcd uhci_hcd thermal processor fan thermal_sys [last unloaded: scsi_wait_scan]
> Pid: 4892, comm: rmmod Not tainted 2.6.26-2-openvz-amd64 #1
> Call Trace:
>  [<ffffffff80234e10>] warn_on_slowpath+0x51/0x7a
>  [<ffffffff80235c5a>] printk+0x4e/0x56
>  [<ffffffff802eb08c>] remove_dir+0x29/0x31
>  [<ffffffff802e0617>] xlate_proc_name+0x3b/0x90
>  [<ffffffff802e0fea>] remove_proc_entry+0x164/0x182
>  [<ffffffff8030fade>] kobject_del+0x23/0x2d
>  [<ffffffffa030d296>] :pf_ring:remove_device_from_ring_list+0x57/0x92
>  [<ffffffffa030e10a>] :pf_ring:ring_notifier+0x92/0x14f
>  [<ffffffff8024b464>] notifier_call_chain+0x29/0x4c
>  [<ffffffff803b173c>] rollback_registered+0xa1/0xfb
>  [<ffffffff803b17c8>] unregister_netdevice+0x32/0x5b
>  [<ffffffff803b1802>] unregister_netdev+0x11/0x17
>  [<ffffffffa00428d8>] :e1000e:e1000_remove+0x52/0xc4
>  [<ffffffff8031cf0c>] pci_device_remove+0x24/0x47
>  [<ffffffff8037a1ec>] __device_release_driver+0x74/0x97
>  [<ffffffff8037a603>] driver_detach+0x7f/0xac
>  [<ffffffff8037961a>] bus_remove_driver+0x7b/0x9e
>  [<ffffffff8031d1b6>] pci_unregister_driver+0x24/0x7a
>  [<ffffffffa0042874>] :e1000e:e1000_exit_module+0x10/0x22
>  [<ffffffff8025e043>] sys_delete_module+0x1a6/0x1fe
>  [<ffffffff803125a7>] __up_write+0x21/0x10e
>  [<ffffffff8020c00a>] system_call_after_swapgs+0x8a/0x8f
> ---[ end trace 5564a751e99d2647 ]---
> ACPI: PCI interrupt for device 0000:03:00.0 disabled
> e1000e: Intel(R) PRO/1000 Network Driver - 1.0.15-NAPI
> e1000e: Copyright(c) 1999 - 2009 Intel Corporation.
> ACPI: PCI Interrupt 0000:03:00.0[A] -> GSI 16 (level, low) -> IRQ 16
> e1000e 0000:03:00.0: Warning: detected ASPM enabled in EEPROM
> proc_dir_entry 'eth0' already registered
> Pid: 4920, comm: modprobe Tainted: G        W 2.6.26-2-openvz-amd64 #1
> Call Trace:
>  [<ffffffff8030f1c6>] idr_get_new+0xb/0x28
>  [<ffffffff802e08b9>] proc_register+0xcb/0x14b
>  [<ffffffff802e0ae9>] proc_mkdir_mode+0x3c/0x51
>  [<ffffffffa030e029>] :pf_ring:add_device_to_ring_list+0x50/0x9f
>  [<ffffffffa030e0ed>] :pf_ring:ring_notifier+0x75/0x14f
>  [<ffffffff8024b464>] notifier_call_chain+0x29/0x4c
>  [<ffffffff803b20cb>] register_netdevice+0x317/0x358
>  [<ffffffff803b2145>] register_netdev+0x39/0x46
>  [<ffffffffa0330491>] :e1000e:e1000_probe+0x911/0xe80
>  [<ffffffff802b37d5>] iput+0x27/0x60
>  [<ffffffff802eaebd>] sysfs_addrm_finish+0x62/0x208
>  [<ffffffff802eaba8>] sysfs_find_dirent+0x1b/0x2f
>  [<ffffffff8031cfef>] pci_device_probe+0xa9/0xf8
>  [<ffffffff8037a408>] driver_probe_device+0xd0/0x14d
>  [<ffffffff8037a4cb>] __driver_attach+0x46/0x6d
>  [<ffffffff8037a485>] __driver_attach+0x0/0x6d
>  [<ffffffff80379bab>] bus_for_each_dev+0x44/0x6f
>  [<ffffffff80379fe1>] bus_add_driver+0xb4/0x203
>  [<ffffffff8037a727>] driver_register+0x8d/0x101
>  [<ffffffff8031d253>] __pci_register_driver+0x47/0x78
>  [<ffffffff8025dcaf>] sys_init_module+0x191b/0x1ab1
>  [<ffffffff80296a26>] alloc_pages_current+0x0/0xa0
>  [<ffffffff8020c00a>] system_call_after_swapgs+0x8a/0x8f
> 0000:03:00.0: eth0: (PCI Express:2.5GB/s:Width x1) 00:e0:81:b1:91:69
> 0000:03:00.0: eth0: Intel(R) PRO/1000 Network Connection
> 0000:03:00.0: eth0: MAC: 3, PHY: 2, PBA No: ffffff-0ff
> ACPI: PCI Interrupt 0000:02:00.0[A] -> GSI 17 (level, low) -> IRQ 17
> e1000e 0000:02:00.0: Warning: detected ASPM enabled in EEPROM
> 0000:02:00.0: eth1: (PCI Express:2.5GB/s:Width x1) 00:e0:81:b1:91:68
> 0000:02:00.0: eth1: Intel(R) PRO/1000 Network Connection
> 0000:02:00.0: eth1: MAC: 3, PHY: 2, PBA No: ffffff-0ff

I got dropped off my remote server and had to wait for a scheduled
reboot.

> pcount uses libpcap; what does pfcount (native PF_RING) do? If you're
> feeling brave you can try "transparent_mode=2" in pf_ring, but make sure
> you're not using the same interface for non-PF_RING apps like SSH :)

/proc/net/pf_ring/info is not present and ./pfcount gives me
"pfring_open error". Oddly, earlier in the day pfcount was working and
/proc/net/pf_ring/info was present, even though ethtool reported
e1000e version 0.3.3.3-k2.

I suppose something is wrong. I might have to try to find a version of
PF_RING that has the newer version 1.3.10a, perhaps something after
PF_RING v4.6.5. And that works with the Suricata build process, of
course. Oh, the tangled webs we weave :)

Warm Regards,

-- 
David

Tuesday, June 07, 2011, 3:14:35 PM Eastern Standard Time