Hi Luca, That was my point i can't read any traffic from my application. I have used pfcount on this machine pfcount didn't get any traffic too. But when I use same kernel and same pfcount on a system that has broadcom interface (tg3 driver) I can see packets but not on this system. This system have E1000:
06:07.0 Ethernet controller: Intel Corporation 82541GI Gigabit Ethernet Controller (rev 05) 07:08.0 Ethernet controller: Intel Corporation 82541GI Gigabit Ethernet Controller (rev 05) Is there any special instructions for E1000 driver ? On http://bjou.homeunix.net/blog/2006/12/advanced-packet-capturing-howto-pf_ring-napi-and-extended-libpcap-on-debian-sarge/ I have read I also must enable NAPI support but that didn't work too. Regards. pfcount -i eth1 Capturing from eth1 Using PF_RING v.3.9.3 ========================= Absolute Stats: [0 pkts rcvd][0 pkts dropped] Total Pkts=0/Dropped=0.0 % 0 pkts - 0 bytes [0.0 pkt/sec - 0.00 Mbit/sec] ========================= ========================= Absolute Stats: [0 pkts rcvd][0 pkts dropped] Total Pkts=0/Dropped=0.0 % 0 pkts - 0 bytes [0.0 pkt/sec - 0.00 Mbit/sec] ========================= Actual Stats: 0 pkts [1001.0 ms][0.0 pkt/sec] ========================= ========================= Absolute Stats: [0 pkts rcvd][0 pkts dropped] Total Pkts=0/Dropped=0.0 % 0 pkts - 0 bytes [0.0 pkt/sec - 0.00 Mbit/sec] ========================= Actual Stats: 0 pkts [1001.0 ms][0.0 pkt/sec] ========================= Leaving... ========================= Absolute Stats: [0 pkts rcvd][0 pkts dropped] Total Pkts=0/Dropped=0.0 % 0 pkts - 0 bytes [0.0 pkt/sec - 0.00 Mbit/sec] ========================= Actual Stats: 0 pkts [620.0 ms][0.0 pkt/sec] ========================= cat 2498-eth1.147 Bound Device : eth1 Version : 9 Sampling Rate : 1 IP Defragment : No BPF Filtering : Disabled # Filt. Rules : 0 Cluster Id : 0 Channel Id : -1 Tot Slots : 4112 Bucket Len : 128 Slot Len : 226 [bucket+header] Tot Memory : 929792 Tot Packets : 866026 Tot Pkt Lost : 861914 Tot Insert : 4112 Tot Read : 0 Num Free Slots: 0 ________________________________ From: Luca Deri <[email protected]> To: [email protected] Sent: Sunday, June 28, 2009 10:31:46 PM Subject: Re: [Ntop-dev] pf_ring question Martin - eth0: no traffic - eth1: your app does not seem to read packets from the ring. Can you please check why? Luca On Jun 28, 2009, at 5:57 PM, Martin Badie wrote: > Hi, > > Here is the output of /proc/net/pf_ring directory: > > ls -l > total 0 > -r--r--r-- 1 root root 0 Jun 28 18:53 9198-eth0.17 > -r--r--r-- 1 root root 0 Jun 28 18:53 9198-eth1.18 > -r--r--r-- 1 root root 0 Jun 28 18:53 info > -r--r--r-- 1 root root 0 Jun 28 18:53 plugins_info > # ls -l > total 0 > -r--r--r-- 1 root root 0 Jun 28 18:53 9198-eth0.17 > -r--r--r-- 1 root root 0 Jun 28 18:53 9198-eth1.18 > -r--r--r-- 1 root root 0 Jun 28 18:53 info > -r--r--r-- 1 root root 0 Jun 28 18:53 plugins_info > # cat 9198-eth0.17 > Bound Device : eth0 > Version : 9 > Sampling Rate : 1 > IP Defragment : No > BPF Filtering : Disabled > # Filt. Rules : 0 > Cluster Id : 0 > Channel Id : -1 > Tot Slots : 4096 > Bucket Len : 16384 > Slot Len : 16482 [bucket+header] > Tot Memory : 67514368 > Tot Packets : 0 > Tot Pkt Lost : 0 > Tot Insert : 0 > Tot Read : 0 > Num Free Slots: 4096 > > > > # cat 9198-eth1.18 > Bound Device : eth1 > Version : 9 > Sampling Rate : 1 > IP Defragment : No > BPF Filtering : Disabled > # Filt. Rules : 0 > Cluster Id : 0 > Channel Id : -1 > Tot Slots : 4098 > Bucket Len : 1500 > Slot Len : 1598 [bucket+header] > Tot Memory : 6549504 > Tot Packets : 1507 > Tot Pkt Lost : 0 > Tot Insert : 1507 > Tot Read : 0 > Num Free Slots: 2591 > > The reason i only use only pf_ring enabled lib ( not pfring lib + pcap lib > but only pcap lib with pfring code inside ) is i dont' want to recompile my > application > > From: Martin Badie <[email protected]> > To: [email protected] > Sent: Friday, June 26, 2009 10:34:03 AM > Subject: [Ntop-dev] pf_ring question > > Hi, > > I have a program written in C using standart pcap library. I have compiled a > kernel installed it and also compiled pcap library in pfring source tree. nm > output is like: > > nm libpcap.so.0.9.7.WITH_PFRING |grep -i pfring > 00006388 T pcap_get_pfring_handle > 0001b612 T pfring_add_filtering_rule > 0001b373 T pfring_close > 0001b6c1 T pfring_enable_ring > 0001b4a9 T pfring_get_filtering_rule_stats > 0001b50f T pfring_get_hash_filtering_rule_stats > 0001bb6d T pfring_get_selectable_fd > 0001b762 T pfring_handle_hash_filtering_rule > 0001aec3 T pfring_open > 0001ad3d T pfring_purge_idle_hash_rules > 0001b873 T pfring_recv > 0001b70b T pfring_remove_filtering_rule > 0001ac8a T pfring_remove_from_cluster > 0001ac40 T pfring_set_channel_id > 0001abf6 T pfring_set_cluster > 0001acd5 T pfring_set_reflector > 0001b7d3 T pfring_set_sampling_rate > 0001b823 T pfring_stats > 0001b409 T pfring_toggle_filtering_policy > 0001b459 T pfring_version > > But when I use libpcap for pfring I can see /proc/net/pf_ring is changed but > I can't receive any traffic. Do I have to change my application to use > pf_ring if so what must be done in the code? > > Regards. > > > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
_______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
