Mailing List Archive

PFring 7.5.0 ZC unable to read packet when bpf filter is enabled
Hi,

I am using PFRing ZC libraries to read VLAN tagged GTP traffic from intel
card.
But when the bpf filter is enabled. It is not able to read any traffic.
As soon as I disable the bpf filter it starts reading the packets.

Sharing the details and the sample pcap captured by tcpdump.

Please advise the resolution and let us know if any other details needed.

*BPFFilter*
(udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0)))
or (vlan and udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] &
0x1fff != 0)))

*Server:*
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.7 (Maipo)

Linux version 3.10.0-1062.el7.x86_64 (
mockbuild@x86-040.build.eng.bos.redhat.com) (gcc version 4.8.5 20150623
(Red Hat 4.8.5-39) (GCC) ) #1 <https://github.com/ntop/PF_RING/issues/1> SMP
Thu Jul 18 20:25:13 UTC 2019

*Card:*
*-network:0
description: Ethernet interface
product: Ethernet Controller X710 for 10GbE SFP+
vendor: Intel Corporation
physical id: 0
bus info: pci@0000:5d:00.0
logical name: eno5
version: 01
serial: 48:df:37:85:ae:40
size: 10Gbit/s
width: 64 bits
clock: 33MHz
capabilities: pm msi msix pciexpress vpd bus_master cap_list rom ethernet
physical fibre autonegotiation
configuration: autonegotiation=off broadcast=yes driver=i40e
driverversion=2.8.10-k duplex=full firmware=10.51.5 latency=0 link=yes
multicast=yes port=fibre speed=10Gbit/s
resources: irq:34 memory:e7000000-e7ffffff memory:e9000000-e9007fff
memory:e9080000-e90fffff memory:cffffa00000-cffffdfffff
memory:cfffff00000-cffffffffff

*PFRing:*

cat /proc/net/pf_ring/info
PF_RING Version : 7.5.0 (unknown)
Total rings : 1

Standard (non ZC) Options
Ring slots : 409600
Slot version : 17
Capture TX : No [RX only]
IP Defragment : No
Socket Mode : Standard

[root@RCEM-Probe2 ~]# cat /proc/net/pf_ring/dev/eno5/info
Name: eno5
Index: 16
Address: 48:DF:37:85:AE:40
Polling Mode: NAPI/ZC
Type: Ethernet
Family: Intel i40e
TX Queues: 4
RX Queues: 4
Num RX Slots: 512
Num TX Slots: 512
Re: PFring 7.5.0 ZC unable to read packet when bpf filter is enabled [ In reply to ]
Hi Jatin
I replied on github, please keep using it for issues (and please do not
send the same request to multiple channels..)

Thank you
Alfredo

> On 25 Nov 2020, at 12:53, Jatin Sahu <jatin152@gmail.com> wrote:
>
> Hi,
>
> I am using PFRing ZC libraries to read VLAN tagged GTP traffic from intel card.
> But when the bpf filter is enabled. It is not able to read any traffic.
> As soon as I disable the bpf filter it starts reading the packets.
>
> Sharing the details and the sample pcap captured by tcpdump.
>
> Please advise the resolution and let us know if any other details needed.
>
> BPFFilter
> (udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0))) or (vlan and udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0)))
>
> Server:
> cat /etc/redhat-release
> Red Hat Enterprise Linux Server release 7.7 (Maipo)
>
> Linux version 3.10.0-1062.el7.x86_64 (mockbuild@x86-040.build.eng.bos.redhat.com <mailto:mockbuild@x86-040.build.eng.bos.redhat.com>) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) ) #1 <https://github.com/ntop/PF_RING/issues/1> SMP Thu Jul 18 20:25:13 UTC 2019
>
> Card:
> *-network:0
> description: Ethernet interface
> product: Ethernet Controller X710 for 10GbE SFP+
> vendor: Intel Corporation
> physical id: 0
> bus info: pci@0000:5d:00.0
> logical name: eno5
> version: 01
> serial: 48:df:37:85:ae:40
> size: 10Gbit/s
> width: 64 bits
> clock: 33MHz
> capabilities: pm msi msix pciexpress vpd bus_master cap_list rom ethernet physical fibre autonegotiation
> configuration: autonegotiation=off broadcast=yes driver=i40e driverversion=2.8.10-k duplex=full firmware=10.51.5 latency=0 link=yes multicast=yes port=fibre speed=10Gbit/s
> resources: irq:34 memory:e7000000-e7ffffff memory:e9000000-e9007fff memory:e9080000-e90fffff memory:cffffa00000-cffffdfffff memory:cfffff00000-cffffffffff
>
> PFRing:
>
> cat /proc/net/pf_ring/info
> PF_RING Version : 7.5.0 (unknown)
> Total rings : 1
>
> Standard (non ZC) Options
> Ring slots : 409600
> Slot version : 17
> Capture TX : No [RX only]
> IP Defragment : No
> Socket Mode : Standard
>
> [root@RCEM-Probe2 ~]# cat /proc/net/pf_ring/dev/eno5/info
> Name: eno5
> Index: 16
> Address: 48:DF:37:85:AE:40
> Polling Mode: NAPI/ZC
> Type: Ethernet
> Family: Intel i40e
> TX Queues: 4
> RX Queues: 4
> Num RX Slots: 512
> Num TX Slots: 512
>
> <tcpdump-eno5-sample.pcap.gz>_______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
Re: PFring 7.5.0 ZC unable to read packet when bpf filter is enabled [ In reply to ]
Hi Jatin
I replied on github, please keep using it for issues (and please do not
send the same request to multiple channels..)

Thank you
Alfredo

> On 25 Nov 2020, at 12:53, Jatin Sahu <jatin152@gmail.com> wrote:
>
> Hi,
>
> I am using PFRing ZC libraries to read VLAN tagged GTP traffic from intel card.
> But when the bpf filter is enabled. It is not able to read any traffic.
> As soon as I disable the bpf filter it starts reading the packets.
>
> Sharing the details and the sample pcap captured by tcpdump.
>
> Please advise the resolution and let us know if any other details needed.
>
> BPFFilter
> (udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0))) or (vlan and udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0)))
>
> Server:
> cat /etc/redhat-release
> Red Hat Enterprise Linux Server release 7.7 (Maipo)
>
> Linux version 3.10.0-1062.el7.x86_64 (mockbuild@x86-040.build.eng.bos.redhat.com <mailto:mockbuild@x86-040.build.eng.bos.redhat.com>) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC) ) #1 <https://github.com/ntop/PF_RING/issues/1> SMP Thu Jul 18 20:25:13 UTC 2019
>
> Card:
> *-network:0
> description: Ethernet interface
> product: Ethernet Controller X710 for 10GbE SFP+
> vendor: Intel Corporation
> physical id: 0
> bus info: pci@0000:5d:00.0
> logical name: eno5
> version: 01
> serial: 48:df:37:85:ae:40
> size: 10Gbit/s
> width: 64 bits
> clock: 33MHz
> capabilities: pm msi msix pciexpress vpd bus_master cap_list rom ethernet physical fibre autonegotiation
> configuration: autonegotiation=off broadcast=yes driver=i40e driverversion=2.8.10-k duplex=full firmware=10.51.5 latency=0 link=yes multicast=yes port=fibre speed=10Gbit/s
> resources: irq:34 memory:e7000000-e7ffffff memory:e9000000-e9007fff memory:e9080000-e90fffff memory:cffffa00000-cffffdfffff memory:cfffff00000-cffffffffff
>
> PFRing:
>
> cat /proc/net/pf_ring/info
> PF_RING Version : 7.5.0 (unknown)
> Total rings : 1
>
> Standard (non ZC) Options
> Ring slots : 409600
> Slot version : 17
> Capture TX : No [RX only]
> IP Defragment : No
> Socket Mode : Standard
>
> [root@RCEM-Probe2 ~]# cat /proc/net/pf_ring/dev/eno5/info
> Name: eno5
> Index: 16
> Address: 48:DF:37:85:AE:40
> Polling Mode: NAPI/ZC
> Type: Ethernet
> Family: Intel i40e
> TX Queues: 4
> RX Queues: 4
> Num RX Slots: 512
> Num TX Slots: 512
>
> <tcpdump-eno5-sample.pcap.gz>_______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop