Luca,
After upgrading from rev 4466 to the latest svn version (4565) of
PF_RING, my CentOS 5.6 system, which has multiple custom-named sniffing
interfaces, stopped allocating any rings for any packet sniffing
programs. After adding the "enable_debug=1" kernel module option --
thanks for that feature! -- I finally traced the issue to this code
segment in pf_ring.c
5610- /* Skip non ethernet interfaces */
5611- if(strncmp(dev->name, "eth", 3) && strncmp(dev->name, "lan", 3)) {
5612: if(enable_debug) printk("[PF_RING] packet_notifier(%s):
skipping non ethernet device\n", dev->name);
5613- return NOTIFY_DONE;
5614- }
I deleted these lines, recompiled the kernel module, and I seem to be
back in business. Will I likely regret this hack?
Is there possibly a better way to determine whether an interface is
Ethernet or not, instead of requiring it to be prefixed with 'eth' or
'lan'? If so, that would be a helpful tweak for me. I can always touch
the code every time I update, but perhaps there are a number of other
PF_RING users who also custom name their sniffing interfaces. It sure
helps me keep them straight.
Kevin
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
