Mailing List Archive

Hi Alfredo,

I see. I'm running this in conjunction with Bro IDS. Even with Bro active,
I'm still seeing my ring count set to zero. I didn't install the supported
Intel drivers that come with the PF_RING program, but I am using the latest
Intel drivers from the Intel website. Would that be the reason?

Thanks for the reply,

On Thu, Mar 16, 2017 at 7:00 AM, <ntop-misc-request@listgateway.unipi.it>
wrote:

> Send Ntop-misc mailing list submissions to
> ntop-misc@listgateway.unipi.it
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> or, via email, send a message with subject or body 'help' to
> ntop-misc-request@listgateway.unipi.it
>
> You can reach the person managing the list at
> ntop-misc-owner@listgateway.unipi.it
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Ntop-misc digest..."
>
>
> Today's Topics:
>
> 1. Issue with '0' total rings in pfring stats file (Espresso Beanies)
> 2. Re: Issue with '0' total rings in pfring stats file
> (Alfredo Cardigliano)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 15 Mar 2017 11:36:18 -0400
> From: Espresso Beanies <espressobeanies@gmail.com>
> To: ntop-misc@listgateway.unipi.it
> Subject: [Ntop-misc] Issue with '0' total rings in pfring stats file
> Message-ID:
> <CAOeD16-XbcH8Pmn+NFdV+yL6h+FyONv+J3_f4LKnZ3fnOXe1Qg@mail.
> gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> Good morning,
>
> If I run a 'cat /proc/net/pf_ring/info' command, I receive the following
> output:
>
> [root@localhost opt]# cat /proc/net/pf_ring/info
> PF_RING Version : 6.5.0
> (dev:b947515496b2f18ded1b2b166c1a96ba136bd626)
> Total rings : *0*
>
> Standard (non ZC) Options
> Ring slots : 4096
> Slot version : 16
> Capture TX : Yes [RX+TX]
> IP Defragment : No
> Socket Mode : Standard
> Cluster Fragment Queue : 0
> Cluster Fragment Discard : 0
>
> My total # of rings is set to zero and it has been this way ever since I
> installed pf_ring from source. I created the following file with these
> parameters:
>
> options pf_ring transparent_mode=0 min_num_slots=65534
>
> But my ring slots didn't increase. If I run an 'lsmod | grep pf_ring' and I
> can see the pf_ring module loaded, but a 'modinfo pf_ring' command fails.
> How do I get my total rings up from zero?
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <http://listgateway.unipi.it/mailman/private/ntop-misc/
> attachments/20170315/15cdc4e4/attachment-0001.htm>
>
> ------------------------------
>
> Message: 2
> Date: Thu, 16 Mar 2017 10:56:55 +0100
> From: Alfredo Cardigliano <cardigliano@ntop.org>
> To: ntop-misc@listgateway.unipi.it
> Subject: Re: [Ntop-misc] Issue with '0' total rings in pfring stats
> file
> Message-ID: <95DE8D40-99C7-4DE4-8972-8EB18A14F91A@ntop.org>
> Content-Type: text/plain; charset="utf-8"
>
> Hi
> what if you manually load the module?
>
> # rmmod pf_ring
> # insmod <path>/pf_ring.ko min_num_slots=65534
> # cat /proc/net/pf_ring/info
> PF_RING Version : 6.5.0 (dev:002e0bc48dd36335f98f266aa39dbb
> 714957a3b2)
> Total rings : 0
>
> Standard (non ZC) Options
> Ring slots : 65534
> Slot version : 16
> Capture TX : Yes [RX+TX]
> IP Defragment : No
> Socket Mode : Standard
> Cluster Fragment Queue : 0
> Cluster Fragment Discard : 0
>
> Please note the "total rings? counter is the number of active sockets, did
> you run an application to see it increasing?
>
> # cat /proc/net/pf_ring/info
> PF_RING Version : 6.5.0 (dev:002e0bc48dd36335f98f266aa39dbb
> 714957a3b2)
> Total rings : 1
>
> Standard (non ZC) Options
> Ring slots : 65534
> Slot version : 16
> Capture TX : Yes [RX+TX]
> IP Defragment : No
> Socket Mode : Standard
> Cluster Fragment Queue : 0
> Cluster Fragment Discard : 0
>
> Alfredo
>
> > On 15 Mar 2017, at 16:36, Espresso Beanies <espressobeanies@gmail.com>
> wrote:
> >
> > Good morning,
> >
> > If I run a 'cat /proc/net/pf_ring/info' command, I receive the following
> output:
> >
> > [root@localhost opt]# cat /proc/net/pf_ring/info
> > PF_RING Version : 6.5.0 (dev:b947515496b2f18ded1b2b166c1a96
> ba136bd626)
> > Total rings : 0
> >
> > Standard (non ZC) Options
> > Ring slots : 4096
> > Slot version : 16
> > Capture TX : Yes [RX+TX]
> > IP Defragment : No
> > Socket Mode : Standard
> > Cluster Fragment Queue : 0
> > Cluster Fragment Discard : 0
> >
> > My total # of rings is set to zero and it has been this way ever since I
> installed pf_ring from source. I created the following file with these
> parameters:
> >
> > options pf_ring transparent_mode=0 min_num_slots=65534
> >
> > But my ring slots didn't increase. If I run an 'lsmod | grep pf_ring'
> and I can see the pf_ring module loaded, but a 'modinfo pf_ring' command
> fails. How do I get my total rings up from zero?
> > _______________________________________________
> > Ntop-misc mailing list
> > Ntop-misc@listgateway.unipi.it
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <http://listgateway.unipi.it/mailman/private/ntop-misc/
> attachments/20170316/5dca0fc2/attachment-0001.htm>
>
> ------------------------------
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> End of Ntop-misc Digest, Vol 153, Issue 9
> *****************************************
>