Hi,
I am using PFRing ZC libraries to read VLAN tagged GTP traffic from intel
card.
But when the bpf filter is enabled. It is not able to read any traffic.
As soon as I disable the bpf filter it starts reading the packets.
Sharing the details and the sample pcap captured by tcpdump.
Please advise the resolution and let us know if any other details needed.
*BPFFilter*
(udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0)))
or (vlan and udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] &
0x1fff != 0)))
*Server:*
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.7 (Maipo)
Linux version 3.10.0-1062.el7.x86_64 (
mockbuild@x86-040.build.eng.bos.redhat.com) (gcc version 4.8.5 20150623
(Red Hat 4.8.5-39) (GCC) ) #1 <https://github.com/ntop/PF_RING/issues/1> SMP
Thu Jul 18 20:25:13 UTC 2019
*Card:*
*-network:0
description: Ethernet interface
product: Ethernet Controller X710 for 10GbE SFP+
vendor: Intel Corporation
physical id: 0
bus info: pci@0000:5d:00.0
logical name: eno5
version: 01
serial: 48:df:37:85:ae:40
size: 10Gbit/s
width: 64 bits
clock: 33MHz
capabilities: pm msi msix pciexpress vpd bus_master cap_list rom ethernet
physical fibre autonegotiation
configuration: autonegotiation=off broadcast=yes driver=i40e
driverversion=2.8.10-k duplex=full firmware=10.51.5 latency=0 link=yes
multicast=yes port=fibre speed=10Gbit/s
resources: irq:34 memory:e7000000-e7ffffff memory:e9000000-e9007fff
memory:e9080000-e90fffff memory:cffffa00000-cffffdfffff
memory:cfffff00000-cffffffffff
*PFRing:*
cat /proc/net/pf_ring/info
PF_RING Version : 7.5.0 (unknown)
Total rings : 1
Standard (non ZC) Options
Ring slots : 409600
Slot version : 17
Capture TX : No [RX only]
IP Defragment : No
Socket Mode : Standard
[root@RCEM-Probe2 ~]# cat /proc/net/pf_ring/dev/eno5/info
Name: eno5
Index: 16
Address: 48:DF:37:85:AE:40
Polling Mode: NAPI/ZC
Type: Ethernet
Family: Intel i40e
TX Queues: 4
RX Queues: 4
Num RX Slots: 512
Num TX Slots: 512
I am using PFRing ZC libraries to read VLAN tagged GTP traffic from intel
card.
But when the bpf filter is enabled. It is not able to read any traffic.
As soon as I disable the bpf filter it starts reading the packets.
Sharing the details and the sample pcap captured by tcpdump.
Please advise the resolution and let us know if any other details needed.
*BPFFilter*
(udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] & 0x1fff != 0)))
or (vlan and udp and (port 2123 or port 2152 or port 3386 or (ip[6:2] &
0x1fff != 0)))
*Server:*
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.7 (Maipo)
Linux version 3.10.0-1062.el7.x86_64 (
mockbuild@x86-040.build.eng.bos.redhat.com) (gcc version 4.8.5 20150623
(Red Hat 4.8.5-39) (GCC) ) #1 <https://github.com/ntop/PF_RING/issues/1> SMP
Thu Jul 18 20:25:13 UTC 2019
*Card:*
*-network:0
description: Ethernet interface
product: Ethernet Controller X710 for 10GbE SFP+
vendor: Intel Corporation
physical id: 0
bus info: pci@0000:5d:00.0
logical name: eno5
version: 01
serial: 48:df:37:85:ae:40
size: 10Gbit/s
width: 64 bits
clock: 33MHz
capabilities: pm msi msix pciexpress vpd bus_master cap_list rom ethernet
physical fibre autonegotiation
configuration: autonegotiation=off broadcast=yes driver=i40e
driverversion=2.8.10-k duplex=full firmware=10.51.5 latency=0 link=yes
multicast=yes port=fibre speed=10Gbit/s
resources: irq:34 memory:e7000000-e7ffffff memory:e9000000-e9007fff
memory:e9080000-e90fffff memory:cffffa00000-cffffdfffff
memory:cfffff00000-cffffffffff
*PFRing:*
cat /proc/net/pf_ring/info
PF_RING Version : 7.5.0 (unknown)
Total rings : 1
Standard (non ZC) Options
Ring slots : 409600
Slot version : 17
Capture TX : No [RX only]
IP Defragment : No
Socket Mode : Standard
[root@RCEM-Probe2 ~]# cat /proc/net/pf_ring/dev/eno5/info
Name: eno5
Index: 16
Address: 48:DF:37:85:AE:40
Polling Mode: NAPI/ZC
Type: Ethernet
Family: Intel i40e
TX Queues: 4
RX Queues: 4
Num RX Slots: 512
Num TX Slots: 512