Mailing List Archive: PF_RING ZC with 82598EB -> "pfring

PF_RING ZC with 82598EB -> "pfring_open error [No such device]"

May 27, 2016, 12:39 AM

Post #1 of 4 (2915 views)

Hi,

I've trying to get Intel 82598EB (05:00.0 Ethernet controller: Intel Corporation 82598EB 10-Gigabit AF Network Connection (rev 01)) running with PF_RING ZC (to use with suricata).

When I test "pfcount -i zc:enp5s0" I just get error message " pfring_open error [No such device] (pf_ring not loaded or interface zc:enp5s0 is down ?)" Some info about my setup:

CentOS Linux release 7.2.1511
3.10.0-327.18.2.el7.x86_64 #1 SMP Thu May 12 11:03:55 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
pfring-dkms-6.3.0-596.noarch (I also tried stable packages...)
pfring-6.3.0-596.x86_64
ixgbe-zc-4.1.5.596-1dkms.noarch

[root@suricata ~]# cat /proc/net/pf_ring/info
PF_RING Version : 6.3.0 (dev:9a327df3fab3b769c7494b898cf165bb24a9f6eb)
Total rings : 0

Standard (non DNA/ZC) Options
Ring slots : 4096
Slot version : 16
Capture TX : Yes [RX+TX]
IP Defragment : No
Socket Mode : Standard
Total plugins : 0
Cluster Fragment Queue : 0
Cluster Fragment Discard : 0

[root@suricata ~]# cat /proc/net/pf_ring/dev/enp5s0/info
Name: enp5s0
Index: 6
Address: 00:1B:21:39:A9:60
Polling Mode: NAPI/ZC
Type: Ethernet
Family: Intel ixgbe 82598
Max # TX Queues: 2
# Used RX Queues: 2
Num RX Slots: 32768
Num TX Slots: 32768

[root@suricata ~]# ifconfig enp5s0
enp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 00:1b:21:39:a9:60 txqueuelen 1000 (Ethernet)
RX packets 46315 bytes 39432447 (37.6 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xdf2a0000-df2c0000

And heres how I'm loading modules etc. http://pastebin.com/rRSUHDug

Command "pfcount -i enp5s0" works and also normal tcpdump is OK.

Any suggestions or ideas how to get ZC working? Or should I use something else with suricata?

_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: PF_RING ZC with 82598EB -> "pfring_open error [No such device]" [ In reply to ]

cardigliano at ntop

May 27, 2016, 1:08 AM

Post #2 of 4 (2893 views)

Permalink

Hi Miika
82598 is not supported as it has several limitations and we decided not to support it in ZC (as you can see it is not listed in http://www.ntop.org/products/packet-capture/pf_ring/pf_ring-zc-zero-copy/), sorry.

Best Regards
Alfredo

> On 27 May 2016, at 09:39, Miika RÃ¤isÃ¤nen <Miika.Raisanen@oulu.fi> wrote:
>
> Hi,
>
> I've trying to get Intel 82598EB (05:00.0 Ethernet controller: Intel Corporation 82598EB 10-Gigabit AF Network Connection (rev 01)) running with PF_RING ZC (to use with suricata).
>
> When I test "pfcount -i zc:enp5s0" I just get error message " pfring_open error [No such device] (pf_ring not loaded or interface zc:enp5s0 is down ?)" Some info about my setup:
>
> CentOS Linux release 7.2.1511
> 3.10.0-327.18.2.el7.x86_64 #1 SMP Thu May 12 11:03:55 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
> pfring-dkms-6.3.0-596.noarch (I also tried stable packages...)
> pfring-6.3.0-596.x86_64
> ixgbe-zc-4.1.5.596-1dkms.noarch
>
> [root@suricata ~]# cat /proc/net/pf_ring/info
> PF_RING Version : 6.3.0 (dev:9a327df3fab3b769c7494b898cf165bb24a9f6eb)
> Total rings : 0
>
> Standard (non DNA/ZC) Options
> Ring slots : 4096
> Slot version : 16
> Capture TX : Yes [RX+TX]
> IP Defragment : No
> Socket Mode : Standard
> Total plugins : 0
> Cluster Fragment Queue : 0
> Cluster Fragment Discard : 0
>
> [root@suricata ~]# cat /proc/net/pf_ring/dev/enp5s0/info
> Name: enp5s0
> Index: 6
> Address: 00:1B:21:39:A9:60
> Polling Mode: NAPI/ZC
> Type: Ethernet
> Family: Intel ixgbe 82598
> Max # TX Queues: 2
> # Used RX Queues: 2
> Num RX Slots: 32768
> Num TX Slots: 32768
>
> [root@suricata ~]# ifconfig enp5s0
> enp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
> ether 00:1b:21:39:a9:60 txqueuelen 1000 (Ethernet)
> RX packets 46315 bytes 39432447 (37.6 MiB)
> RX errors 0 dropped 0 overruns 0 frame 0
> TX packets 0 bytes 0 (0.0 B)
> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
> device memory 0xdf2a0000-df2c0000
>
> And heres how I'm loading modules etc. http://pastebin.com/rRSUHDug
>
> Command "pfcount -i enp5s0" works and also normal tcpdump is OK.
>
> Any suggestions or ideas how to get ZC working? Or should I use something else with suricata?
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: PF_RING ZC with 82598EB -> "pfring_open error [No such device]" [ In reply to ]

Miika.Raisanen at oulu

May 27, 2016, 1:43 AM

Post #3 of 4 (2893 views)

Permalink

I thought it will work because I did not get any scary warnings etc. :) I also have 82599 cards so this should not to be a problem.

Thanks.

> -----Original Message-----
> From: ntop-misc-bounces@listgateway.unipi.it [mailto:ntop-misc-
> bounces@listgateway.unipi.it] On Behalf Of Alfredo Cardigliano
> Sent: 27. toukokuuta 2016 11:09
> To: ntop-misc@listgateway.unipi.it
> Subject: Re: [Ntop-misc] PF_RING ZC with 82598EB -> "pfring_open error [No
> such device]"
>
> Hi Miika
> 82598 is not supported as it has several limitations and we decided not to
> support it in ZC (as you can see it is not listed in
> http://www.ntop.org/products/packet-capture/pf_ring/pf_ring-zc-zero-
> copy/), sorry.
>
> Best Regards
> Alfredo
>
> > On 27 May 2016, at 09:39, Miika RÃ¤isÃ¤nen <Miika.Raisanen@oulu.fi> wrote:
> >
> > Hi,
> >
> > I've trying to get Intel 82598EB (05:00.0 Ethernet controller: Intel
> Corporation 82598EB 10-Gigabit AF Network Connection (rev 01)) running
> with PF_RING ZC (to use with suricata).
> >
> > When I test "pfcount -i zc:enp5s0" I just get error message " pfring_open
> error [No such device] (pf_ring not loaded or interface zc:enp5s0 is down ?)"
> Some info about my setup:
> >
> > CentOS Linux release 7.2.1511
> > 3.10.0-327.18.2.el7.x86_64 #1 SMP Thu May 12 11:03:55 UTC 2016 x86_64
> x86_64 x86_64 GNU/Linux
> > pfring-dkms-6.3.0-596.noarch (I also tried stable packages...)
> > pfring-6.3.0-596.x86_64
> > ixgbe-zc-4.1.5.596-1dkms.noarch
> >
> > [root@suricata ~]# cat /proc/net/pf_ring/info
> > PF_RING Version : 6.3.0
> (dev:9a327df3fab3b769c7494b898cf165bb24a9f6eb)
> > Total rings : 0
> >
> > Standard (non DNA/ZC) Options
> > Ring slots : 4096
> > Slot version : 16
> > Capture TX : Yes [RX+TX]
> > IP Defragment : No
> > Socket Mode : Standard
> > Total plugins : 0
> > Cluster Fragment Queue : 0
> > Cluster Fragment Discard : 0
> >
> > [root@suricata ~]# cat /proc/net/pf_ring/dev/enp5s0/info
> > Name: enp5s0
> > Index: 6
> > Address: 00:1B:21:39:A9:60
> > Polling Mode: NAPI/ZC
> > Type: Ethernet
> > Family: Intel ixgbe 82598
> > Max # TX Queues: 2
> > # Used RX Queues: 2
> > Num RX Slots: 32768
> > Num TX Slots: 32768
> >
> > [root@suricata ~]# ifconfig enp5s0
> > enp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
> > ether 00:1b:21:39:a9:60 txqueuelen 1000 (Ethernet)
> > RX packets 46315 bytes 39432447 (37.6 MiB)
> > RX errors 0 dropped 0 overruns 0 frame 0
> > TX packets 0 bytes 0 (0.0 B)
> > TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
> > device memory 0xdf2a0000-df2c0000
> >
> > And heres how I'm loading modules etc. http://pastebin.com/rRSUHDug
> >
> > Command "pfcount -i enp5s0" works and also normal tcpdump is OK.
> >
> > Any suggestions or ideas how to get ZC working? Or should I use
> something else with suricata?
> >
> > _______________________________________________
> > Ntop-misc mailing list
> > Ntop-misc@listgateway.unipi.it
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc

_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: PF_RING ZC with 82598EB -> "pfring_open error [No such device]" [ In reply to ]

cardigliano at ntop

May 27, 2016, 1:45 AM

Post #4 of 4 (2895 views)

Permalink

Yes we should probably add some warning in this case :-)

Alfredo

> On 27 May 2016, at 10:43, Miika RÃ¤isÃ¤nen <Miika.Raisanen@oulu.fi> wrote:
>
> I thought it will work because I did not get any scary warnings etc. :) I also have 82599 cards so this should not to be a problem.
>
> Thanks.
>
>> -----Original Message-----
>> From: ntop-misc-bounces@listgateway.unipi.it [mailto:ntop-misc-
>> bounces@listgateway.unipi.it] On Behalf Of Alfredo Cardigliano
>> Sent: 27. toukokuuta 2016 11:09
>> To: ntop-misc@listgateway.unipi.it
>> Subject: Re: [Ntop-misc] PF_RING ZC with 82598EB -> "pfring_open error [No
>> such device]"
>>
>> Hi Miika
>> 82598 is not supported as it has several limitations and we decided not to
>> support it in ZC (as you can see it is not listed in
>> http://www.ntop.org/products/packet-capture/pf_ring/pf_ring-zc-zero-
>> copy/), sorry.
>>
>> Best Regards
>> Alfredo
>>
>>> On 27 May 2016, at 09:39, Miika RÃ¤isÃ¤nen <Miika.Raisanen@oulu.fi> wrote:
>>>
>>> Hi,
>>>
>>> I've trying to get Intel 82598EB (05:00.0 Ethernet controller: Intel
>> Corporation 82598EB 10-Gigabit AF Network Connection (rev 01)) running
>> with PF_RING ZC (to use with suricata).
>>>
>>> When I test "pfcount -i zc:enp5s0" I just get error message " pfring_open
>> error [No such device] (pf_ring not loaded or interface zc:enp5s0 is down ?)"
>> Some info about my setup:
>>>
>>> CentOS Linux release 7.2.1511
>>> 3.10.0-327.18.2.el7.x86_64 #1 SMP Thu May 12 11:03:55 UTC 2016 x86_64
>> x86_64 x86_64 GNU/Linux
>>> pfring-dkms-6.3.0-596.noarch (I also tried stable packages...)
>>> pfring-6.3.0-596.x86_64
>>> ixgbe-zc-4.1.5.596-1dkms.noarch
>>>
>>> [root@suricata ~]# cat /proc/net/pf_ring/info
>>> PF_RING Version : 6.3.0
>> (dev:9a327df3fab3b769c7494b898cf165bb24a9f6eb)
>>> Total rings : 0
>>>
>>> Standard (non DNA/ZC) Options
>>> Ring slots : 4096
>>> Slot version : 16
>>> Capture TX : Yes [RX+TX]
>>> IP Defragment : No
>>> Socket Mode : Standard
>>> Total plugins : 0
>>> Cluster Fragment Queue : 0
>>> Cluster Fragment Discard : 0
>>>
>>> [root@suricata ~]# cat /proc/net/pf_ring/dev/enp5s0/info
>>> Name: enp5s0
>>> Index: 6
>>> Address: 00:1B:21:39:A9:60
>>> Polling Mode: NAPI/ZC
>>> Type: Ethernet
>>> Family: Intel ixgbe 82598
>>> Max # TX Queues: 2
>>> # Used RX Queues: 2
>>> Num RX Slots: 32768
>>> Num TX Slots: 32768
>>>
>>> [root@suricata ~]# ifconfig enp5s0
>>> enp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
>>> ether 00:1b:21:39:a9:60 txqueuelen 1000 (Ethernet)
>>> RX packets 46315 bytes 39432447 (37.6 MiB)
>>> RX errors 0 dropped 0 overruns 0 frame 0
>>> TX packets 0 bytes 0 (0.0 B)
>>> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
>>> device memory 0xdf2a0000-df2c0000
>>>
>>> And heres how I'm loading modules etc. http://pastebin.com/rRSUHDug
>>>
>>> Command "pfcount -i enp5s0" works and also normal tcpdump is OK.
>>>
>>> Any suggestions or ideas how to get ZC working? Or should I use
>> something else with suricata?
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Mailing List Archive

Attached Files:

Attached Files: