Mailing List Archive

PF_RING sees DAG but nprobe does not
Current situation.
When trying to run nprobe against dag0 I get the following:
---------------------
28/Oct/2016 12:57:02 [util.c:4371] ERROR: Cannot get hw addr for dag0
28/Oct/2016 12:57:02 [pro/pf_ring.c:377] Initializing PF_RING socket on device dag0..
28/Oct/2016 12:57:02 [nprobe.c:5573] ERROR: Unable to open interface dag0.
28/Oct/2016 12:57:02 [nprobe.c:7401] ERROR: Unable to open interface dag0 (dag0: No such device exists (SIOCGIFHWADDR: No such device))
-----------------------

Even though the PF_RING pcount utility sees it and can get packet stats from it.
------------------------
[root@localhost ~]# /usr/local/src/pfring/userland/examples/pcount -h
pcount
(C) 2003-14 Deri Luca <deri@ntop.org>
-h [Print help]
-i <device> [Device name]
-f <filter> [pcap filter]
-l <len> [Capture length]
-S [Do not strip hw timestamps (if present)]
-v <mode> [Verbose [1: verbose, 2: very verbose (print packet payload)]]

Available devices (-i):
0. ens3
1. ens4
2. any
3. lo
4. dag0
5. dag0:0
6. nflog
7. nfqueue
8. usbmon1
[root@localhost ~]#
-----------------------
What now?

How I got here:
1)compiled PF_RING with dag libraries and confirmed it worked with the pcount utility.
2)installed nprobe using yum. (I did not see how to compile nprobe)

----------------------------------------------------------------------
John Marshall
Senior Consultant

T +64 9 355 4818 (extn 94818)
M +64 27 819 8366
E John.Marshall@spark.co.nz

Level 1 Green, Spark City | 167 Victoria Street West | Private Bag 92028, Auckland 1010
www.sparkdigital.co.nz
----------------------------------------------------------------------
This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.
_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Re: PF_RING sees DAG but nprobe does not [ In reply to ]
John
our PF_RING packages binaries do not include DAG support yet. We’ve just received DAG drivers and working at this. Please file an issue on https://github.com/ntop/PF_RING/issues <https://github.com/ntop/PF_RING/issues> so we can track the problem more effectively than via email

Regards Luca

> On 28 Oct 2016, at 02:04, John Marshall <John.Marshall@spark.co.nz> wrote:
>
> Current situation.
> When trying to run nprobe against dag0 I get the following:
> ---------------------
> 28/Oct/2016 12:57:02 [util.c:4371] ERROR: Cannot get hw addr for dag0
> 28/Oct/2016 12:57:02 [pro/pf_ring.c:377] Initializing PF_RING socket on device dag0..
> 28/Oct/2016 12:57:02 [nprobe.c:5573] ERROR: Unable to open interface dag0.
> 28/Oct/2016 12:57:02 [nprobe.c:7401] ERROR: Unable to open interface dag0 (dag0: No such device exists (SIOCGIFHWADDR: No such device))
> -----------------------
>
> Even though the PF_RING pcount utility sees it and can get packet stats from it.
> ------------------------
> [root@localhost ~]# /usr/local/src/pfring/userland/examples/pcount -h
> pcount
> (C) 2003-14 Deri Luca <deri@ntop.org>
> -h [Print help]
> -i <device> [Device name]
> -f <filter> [pcap filter]
> -l <len> [Capture length]
> -S [Do not strip hw timestamps (if present)]
> -v <mode> [Verbose [1: verbose, 2: very verbose (print packet payload)]]
>
> Available devices (-i):
> 0. ens3
> 1. ens4
> 2. any
> 3. lo
> 4. dag0
> 5. dag0:0
> 6. nflog
> 7. nfqueue
> 8. usbmon1
> [root@localhost ~]#
> -----------------------
> What now?
>
> How I got here:
> 1)compiled PF_RING with dag libraries and confirmed it worked with the pcount utility.
> 2)installed nprobe using yum. (I did not see how to compile nprobe)
>
> ----------------------------------------------------------------------
> John Marshall
> Senior Consultant
>
> T +64 9 355 4818 (extn 94818)
> M +64 27 819 8366
> E John.Marshall@spark.co.nz
>
> Level 1 Green, Spark City | 167 Victoria Street West | Private Bag 92028, Auckland 1010
> www.sparkdigital.co.nz
> ----------------------------------------------------------------------
> This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc