'Re: [Ntop] Installing PF_RING on CentOS 5'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ntop
Subject:    Re: [Ntop] Installing PF_RING on CentOS 5
From:       Ed Nabeshin <forte712 () gmail ! com>
Date:       2010-10-11 23:54:39
Message-ID: AANLkTin84L=ujmxJ__hyWv53vSJ5_0CW_6VaN3wybNP1 () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]

Under /proc/net/pf_ring I can see

dev
info
plugins_info

When I cat info,

PF_RING Version     : 4.4.0 ($Revision: 4362$)
Ring slots          : 4096
Slot version        : 12
Capture TX          : Yes [RX+TX]
IP Defragment       : No
Transparent mode    : Yes
Total rings         : 0
Total plugins       : 0

I tried running nprobe again, but cat info doesn't change..

Ed

On Tue, Oct 12, 2010 at 8:53 AM, Yuri Francalacci <yuri@ntop.org> wrote:

> Search under /proc/net/pf_ring folder
> Yuri
> 
> Sent from my iPhone
> 
> 
> Il giorno 12/ott/2010, alle ore 00:48, Ed Nabeshin <forte712@gmail.com> ha
> scritto:
> 
> Thank you for the replies
> 
> Yes I am using the e1000e-1.0.15 driver that comes with the pf_ring codes.
> 
> # ethtool -g eth6
> Ring parameters for eth6:
> Pre-set maximums:
> RX:             4096
> RX Mini:        0
> RX Jumbo:       0
> TX:             4096
> Current hardware settings:
> RX:             256
> RX Mini:        0
> RX Jumbo:       0
> TX:             256
> 
> I was using nprobe v4.0 to test pf_ring. The only thing I did different to
> compile nprobe was adding "-lpfring" to the library flags.
> 
> I tried changing transparency mode when loading the module but I am still
> getting the same result.
> Under /proc/filesystems I did not see pf_ring anywhere...
> But "lsmod" shows pf_ring is used by 2 (processes?) when I turn on nprobe
> on the interface that has the modified driver.
> 
> Here is a tail of /var/log/messages
> 
> [PF_RING] Welcome to PF_RING 4.4.0 ($Revision: 4362$)
> (C) 2004-10 L.Deri < <deri@ntop.org>deri@ntop.org>
> [PF_RING] registered /proc/net/pf_ring/
> NET: Registered protocol family 27
> [PF_RING] Ring slots       4096
> [PF_RING] Slot version     12
> [PF_RING] Capture TX       Yes [RX+TX]
> [PF_RING] Transparent Mode 0
> [PF_RING] IP Defragment    No
> [PF_RING] Initialized correctly
> device eth6 entered promiscuous mode
> 
> Any suggestions is much appreciated.
> 
> Ed
> 
> 
> On Mon, Oct 11, 2010 at 8:58 PM, Luca Deri < <deri@ntop.org>deri@ntop.org>wrote:
> 
> > Ed
> > Are you using a pf_ring-aware driver as those in the drivers/ directory ?
> > What is your application about?
> > 
> > Cheers Luca
> > 
> > ---
> > Luca Deri < <deri@ntop.org>deri@ntop.org>
> > 
> > Il giorno 11/ott/2010, alle ore 08.47, Yuri Francalacci < <yuri@ntop.org>
> > yuri@ntop.org> ha scritto:
> > 
> > You may have to play with the transparent_mode value while loading the
> > module.
> > furthermore check under the proc filesystem if the program using pf_ring
> > is correctly registered on pf_ring
> > Yuri
> > On Oct 11, 2010, at 6:32 AM, Ed Nabeshin wrote:
> > 
> > Hi,
> > 
> > I hope this post is in the right spot. Please let me know otherwise.
> > I have been trying to get PF_RING working in CentOS 5.2
> > This is the instructions I followed:
> > 
> > 
> > <http://gunjan-bansal.blogspot.com/2010/06/installation-guide-for-pfring.html><http://gunjan-bansal.blogspot.com/2010/06/installation-guide-for-pfring.html>
> >  http://gunjan-bansal.blogspot.com/2010/06/installation-guide-for-pfring.html
> > 
> > Afterwards, I re-compiled nprobe and run it.
> > However, I did not see PF_RING related messages in /var/log/messages
> > It just say "device eth6 entered promiscuous mode" when I turn on nprobe.
> > 
> > From looking at other sites, it seems that there should be a message that
> > looks like "RING: succesfully allocated 1024 KB".
> > There seems to be no change in performance either. The number of dropped
> > packets are about the same compared to before installing PF_RING.
> > 
> > Are the instructions from the link above correct?
> > If so, any suggestions on where to start looking for where the problem
> > lies is much appreciated.
> > 
> > Thank you for your time.
> > 
> > Ed
> > _______________________________________________
> > Ntop mailing list
> > <Ntop@listgateway.unipi.it> <Ntop@listgateway.unipi.it>
> > Ntop@listgateway.unipi.it
> > <http://listgateway.unipi.it/mailman/listinfo/ntop>
> > http://listgateway.unipi.it/mailman/listinfo/ntop
> > 
> > 
> > _______________________________________________
> > Ntop mailing list
> > <Ntop@listgateway.unipi.it>Ntop@listgateway.unipi.it
> > <http://listgateway.unipi.it/mailman/listinfo/ntop>
> > http://listgateway.unipi.it/mailman/listinfo/ntop
> > 
> > 
> > _______________________________________________
> > Ntop mailing list
> > <Ntop@listgateway.unipi.it>Ntop@listgateway.unipi.it
> > <http://listgateway.unipi.it/mailman/listinfo/ntop>
> > http://listgateway.unipi.it/mailman/listinfo/ntop
> > 
> > 
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
> 
> 
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
> 
> 

[Attachment #5 (text/html)]

Under /proc/net/pf_ring I can see <br><br>dev  <br>info  <br>plugins_info<br><br>When \
I cat info, <br><br>PF_RING Version     : 4.4.0 ($Revision: 4362$)<br>Ring slots      \
: 4096<br>Slot version        : 12<br>Capture TX          : Yes [RX+TX]<br> IP \
Defragment       : No<br>Transparent mode    : Yes<br>Total rings         : \
0<br>Total plugins       : 0<br><br>I tried running nprobe again, but cat info \
doesn&#39;t change..<br><br>Ed<br><br><br><br><div class="gmail_quote"> On Tue, Oct \
12, 2010 at 8:53 AM, Yuri Francalacci <span dir="ltr">&lt;<a \
href="mailto:yuri@ntop.org">yuri@ntop.org</a>&gt;</span> wrote:<br><blockquote \
class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt \
0pt 0.8ex; padding-left: 1ex;"> <div bgcolor="#FFFFFF"><div>Search under \
/proc/net/pf_ring folder</div><div>Yuri<br><br>Sent from my \
iPhone<div><br></div></div><div><br>Il giorno 12/ott/2010, alle ore 00:48, Ed \
Nabeshin &lt;<a href="mailto:forte712@gmail.com" \
target="_blank">forte712@gmail.com</a>&gt; ha scritto:<br> \
<br></div><div><div></div><div class="h5"><div></div><blockquote \
type="cite"><div>Thank you for the replies<br><br>Yes I am using the e1000e-1.0.15 \
driver that comes with the pf_ring codes.<br><br># ethtool -g eth6<br>Ring parameters \
for eth6:<br> Pre-set maximums:<br>RX:             4096<br>RX Mini:        0<br>
RX Jumbo:       0<br>TX:             4096<br>Current hardware settings:<br>RX:        \
256<br>RX Mini:        0<br>RX Jumbo:       0<br>TX:             256<br><br>I was \
using nprobe v4.0 to test pf_ring. The only thing I did different to compile nprobe \
was adding &quot;-lpfring&quot; to the library flags.<br>

<br>I tried changing transparency mode when loading the module but I am still getting \
the same result.<br>Under /proc/filesystems I did not see pf_ring anywhere...<br>But \
&quot;lsmod&quot; shows pf_ring is used by 2 (processes?) when I turn on nprobe on \
the interface that has the modified driver.<br>

<br>Here is a tail of /var/log/messages<br><br>[PF_RING] Welcome to PF_RING 4.4.0 \
($Revision: 4362$)<br>(C) 2004-10 L.Deri &lt;<a href="mailto:deri@ntop.org" \
target="_blank"></a><a href="mailto:deri@ntop.org" \
target="_blank">deri@ntop.org</a>&gt;<br> [PF_RING] registered /proc/net/pf_ring/<br>
NET: Registered protocol family 27<br>[PF_RING] Ring slots       4096<br>[PF_RING] \
Slot version     12<br>[PF_RING] Capture TX       Yes [RX+TX]<br>[PF_RING] \
Transparent Mode 0<br>[PF_RING] IP Defragment    No<br>[PF_RING] Initialized \
correctly<br>

device eth6 entered promiscuous mode<br><br>Any suggestions is much \
appreciated.<br><br>Ed<br><br><br><div class="gmail_quote">On Mon, Oct 11, 2010 at \
8:58 PM, Luca Deri <span dir="ltr">&lt;<a href="mailto:deri@ntop.org" \
target="_blank"></a><a href="mailto:deri@ntop.org" \
target="_blank">deri@ntop.org</a>&gt;</span> wrote:<br>

<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); \
margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div \
bgcolor="#FFFFFF"><div>Ed</div><div>Are you using a pf_ring-aware driver as those in \
the drivers/ directory ? What is your application about?</div>

<div><br></div><div>Cheers Luca<br><br>---<div>Luca Deri &lt;<a \
href="mailto:deri@ntop.org" target="_blank"></a><a href="mailto:deri@ntop.org" \
target="_blank">deri@ntop.org</a>&gt;</div></div><div><br>Il giorno 11/ott/2010, alle \
ore 08.47, Yuri Francalacci &lt;<a href="mailto:yuri@ntop.org" target="_blank"></a><a \
href="mailto:yuri@ntop.org" target="_blank">yuri@ntop.org</a>&gt; ha scritto:<br>

<br></div><div><div></div><div><div></div><blockquote type="cite"><div>You may have \
to play with the transparent_mode value while loading the module.<div>furthermore \
check under the proc filesystem if the program using pf_ring is correctly registered \
on pf_ring </div>

<div>Yuri<br><div><div>On Oct 11, 2010, at 6:32 AM, Ed Nabeshin \
wrote:</div><br><blockquote type="cite">Hi,<br><br>I hope this post is in the right \
spot. Please let me know otherwise.<br>I have been trying to get PF_RING working in \
CentOS 5.2<br>

This is the instructions I followed:<br><br><a \
href="http://gunjan-bansal.blogspot.com/2010/06/installation-guide-for-pfring.html" \
target="_blank"></a><a \
href="http://gunjan-bansal.blogspot.com/2010/06/installation-guide-for-pfring.html" \
target="_blank"></a><a \
href="http://gunjan-bansal.blogspot.com/2010/06/installation-guide-for-pfring.html" \
target="_blank">http://gunjan-bansal.blogspot.com/2010/06/installation-guide-for-pfring.html</a><br>

<br>Afterwards, I re-compiled nprobe and run it.<br>However, I did not see PF_RING \
related messages in /var/log/messages<br>It just say &quot;device eth6 entered \
promiscuous mode&quot; when I turn on nprobe.<br><br>From looking at other sites, it \
seems that there should be a message that looks like &quot;<font size="2" \
color="black" face="Verdana,Arial,Helvetica"><font size="2" color="black" \
face="Verdana,Arial,Helvetica">RING: succesfully allocated 1024 KB&quot;.<br>

There seems to be no change in performance either. The number of dropped packets are \
about the same compared to before installing PF_RING.<br><br>Are the instructions \
from the link above correct?<br>If so, any suggestions on where to start looking for \
where the problem lies is much appreciated.<br>

<br>Thank you for your time.<br><br>Ed<br></font></font>
_______________________________________________<br>Ntop mailing list<br><a \
href="mailto:Ntop@listgateway.unipi.it" target="_blank"></a><a \
href="mailto:Ntop@listgateway.unipi.it" target="_blank"></a><a \
href="mailto:Ntop@listgateway.unipi.it" \
target="_blank">Ntop@listgateway.unipi.it</a><br>

<a href="http://listgateway.unipi.it/mailman/listinfo/ntop" target="_blank"></a><a \
href="http://listgateway.unipi.it/mailman/listinfo/ntop" \
target="_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</a><br></blockquote>
 </div><br></div></div></blockquote><blockquote \
type="cite"><div><span>_______________________________________________</span><br> \
<span>Ntop mailing list</span><br><span><a href="mailto:Ntop@listgateway.unipi.it" \
target="_blank"></a><a href="mailto:Ntop@listgateway.unipi.it" \
target="_blank">Ntop@listgateway.unipi.it</a></span><br><span><a \
href="http://listgateway.unipi.it/mailman/listinfo/ntop" target="_blank"></a><a \
href="http://listgateway.unipi.it/mailman/listinfo/ntop" \
target="_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</a></span><br>

</div></blockquote></div></div></div><br>_______________________________________________<br>
 Ntop mailing list<br>
<a href="mailto:Ntop@listgateway.unipi.it" target="_blank"></a><a \
href="mailto:Ntop@listgateway.unipi.it" \
target="_blank">Ntop@listgateway.unipi.it</a><br> <a \
href="http://listgateway.unipi.it/mailman/listinfo/ntop" target="_blank"></a><a \
href="http://listgateway.unipi.it/mailman/listinfo/ntop" \
target="_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</a><br> \
<br></blockquote></div><br> </div></blockquote><blockquote \
type="cite"><div><span>_______________________________________________</span><br><span>Ntop \
mailing list</span><br><span><a href="mailto:Ntop@listgateway.unipi.it" \
target="_blank">Ntop@listgateway.unipi.it</a></span><br> <span><a \
href="http://listgateway.unipi.it/mailman/listinfo/ntop" \
target="_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</a></span><br></div> \
</blockquote></div></div></div><br>_______________________________________________<br>

Ntop mailing list<br>
<a href="mailto:Ntop@listgateway.unipi.it">Ntop@listgateway.unipi.it</a><br>
<a href="http://listgateway.unipi.it/mailman/listinfo/ntop" \
target="_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</a><br> \
<br></blockquote></div><br>

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

[prev in list] [next in list] [prev in thread] [next in thread] 