William,
as you might know PF_RING is enabled on an interface you need a patched
libpcap [.you need to apply it to the standard pcap not to pcap-mmap]
(the one you apparently built) for grabbing packets. It seems to me that
there's something wrong on your setup.
Qeustions:
1. did you do "insmod ring" ?
2. when you start your recompiled apps do you see messages like "RING:
numPollCalls=3227 [1.0 packets/call]"? If not then you believe you're
using PF_RING but you don't really use it.
William (ms87) wrote:
> Hi Mr. Deri,
> I read your un-published parer, "Improving passive packet capture". It
> is a great paper! But I find I cannot duplicate the test in your
> paper. The linux kernel I am using is 2.6.3. I've applied the RTIRQ
> patch and ring-2.0 to the kernel. I've also applied the
> libpcap-0.8.1-ring to standard libpcap-0.8.1. The tcpdump is also
> re-compiled. While using tcpdump or any pcap-based utility to drain
> something from the interface, I find there is nothing from the
> interface. I must miss sonething important. Could you please tell me
> what I miss ? Should I apply libpcap-0.8.1-ring/* to standard libpcap
> library or libpcap-mmap ? Thank you very much.
> Regards,
> William Chen
> 886-2-2559-1628#620
> A men's gotta know him limitations.
--
Luca Deri <deri@ntop.org> http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman
as you might know PF_RING is enabled on an interface you need a patched
libpcap [.you need to apply it to the standard pcap not to pcap-mmap]
(the one you apparently built) for grabbing packets. It seems to me that
there's something wrong on your setup.
Qeustions:
1. did you do "insmod ring" ?
2. when you start your recompiled apps do you see messages like "RING:
numPollCalls=3227 [1.0 packets/call]"? If not then you believe you're
using PF_RING but you don't really use it.
William (ms87) wrote:
> Hi Mr. Deri,
> I read your un-published parer, "Improving passive packet capture". It
> is a great paper! But I find I cannot duplicate the test in your
> paper. The linux kernel I am using is 2.6.3. I've applied the RTIRQ
> patch and ring-2.0 to the kernel. I've also applied the
> libpcap-0.8.1-ring to standard libpcap-0.8.1. The tcpdump is also
> re-compiled. While using tcpdump or any pcap-based utility to drain
> something from the interface, I find there is nothing from the
> interface. I must miss sonething important. Could you please tell me
> what I miss ? Should I apply libpcap-0.8.1-ring/* to standard libpcap
> library or libpcap-mmap ? Thank you very much.
> Regards,
> William Chen
> 886-2-2559-1628#620
> A men's gotta know him limitations.
--
Luca Deri <deri@ntop.org> http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman