Mailing List Archive

Re: [Ntop] PFring 7.5.0 ZC unable to read packet when bpf filter is enabled
Hi Jatin
I replied on github, please keep using it for issues (and please do not
send the same request to multiple channels..)

Thank you
Alfredo

> On 25 Nov 2020, at 12:53, Jatin Sahu <jatin152@gmail.com> wrote:
>
> Hi,
>
> I am using PFRing ZC libraries to read VLAN tagged GTP traffic from intel card.
> But when the bpf filter is enabled. It is not able to read any traffic.
> As soon as I disable the bpf filter it starts reading the packets.
>
> Sharing the details and the sample pcap captured by tcpdump.
>
> Please advise the resolution and let us know if any other details needed.
>
> BPFFilter
> (udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0))) or (vlan and udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0)))
>
> Server:
> cat /etc/redhat-release
> Red Hat Enterprise Linux Server release 7.7 (Maipo)
>
> Linux version 3.10.0-1062.el7.x86_64 (mockbuild@x86-040.build.eng.bos.redhat.com <mailto:mockbuild@x86-040.build.eng.bos.redhat.com>) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) ) #1 <https://github.com/ntop/PF_RING/issues/1> SMP Thu Jul 18 20:25:13 UTC 2019
>
> Card:
> *-network:0
> description: Ethernet interface
> product: Ethernet Controller X710 for 10GbE SFP+
> vendor: Intel Corporation
> physical id: 0
> bus info: pci@0000:5d:00.0
> logical name: eno5
> version: 01
> serial: 48:df:37:85:ae:40
> size: 10Gbit/s
> width: 64 bits
> clock: 33MHz
> capabilities: pm msi msix pciexpress vpd bus_master cap_list rom ethernet physical fibre autonegotiation
> configuration: autonegotiation=off broadcast=yes driver=i40e driverversion=2.8.10-k duplex=full firmware=10.51.5 latency=0 link=yes multicast=yes port=fibre speed=10Gbit/s
> resources: irq:34 memory:e7000000-e7ffffff memory:e9000000-e9007fff memory:e9080000-e90fffff memory:cffffa00000-cffffdfffff memory:cfffff00000-cffffffffff
>
> PFRing:
>
> cat /proc/net/pf_ring/info
> PF_RING Version : 7.5.0 (unknown)
> Total rings : 1
>
> Standard (non ZC) Options
> Ring slots : 409600
> Slot version : 17
> Capture TX : No [RX only]
> IP Defragment : No
> Socket Mode : Standard
>
> [root@RCEM-Probe2 ~]# cat /proc/net/pf_ring/dev/eno5/info
> Name: eno5
> Index: 16
> Address: 48:DF:37:85:AE:40
> Polling Mode: NAPI/ZC
> Type: Ethernet
> Family: Intel i40e
> TX Queues: 4
> RX Queues: 4
> Num RX Slots: 512
> Num TX Slots: 512
>
> <tcpdump-eno5-sample.pcap.gz>_______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop