I have an intel T340-T4 card installed in a HP DL385, and I'm trying to get the
pfring aware igb driver. The make install goes fine, and I've unloaded/reload
the driver. But when I modprobe the pf_ring driver, it does not see the card
as able to do hardware filtering. I'm running snort with the pf_ring daq, and
when I use transparent_mode 1 or 2, no packets get pushed to snort when using
modes 1 and 2. I'm currently using PF_RING 5.4.3 and the igb PF_RING aware
driver 3.4.7 (from the PF_RING 5.4.3 tarball).
Here's the lspci output for one of the ports on the card:
0e:00.0 Ethernet controller: Intel Corporation 82580 Gigabit Network Connection
(rev 01)
Subsystem: Intel Corporation Ethernet Server Adapter I340-T4
Flags: bus master, fast devsel, latency 0, IRQ 30
Memory at fbf80000 (32-bit, non-prefetchable) [size=512K]
Memory at fbf70000 (32-bit, non-prefetchable) [size=16K]
[virtual] Expansion ROM at e7100000 [disabled] [size=512K]
Capabilities: [40] Power Management version 3
Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+
Capabilities: [70] MSI-X: Enable+ Count=10 Masked-
Capabilities: [a0] Express Endpoint, MSI 00
Capabilities: [100] Advanced Error Reporting
Capabilities: [140] Device Serial Number 00-1b-21-ff-ff-d3-f1-24
Capabilities: [1a0] Transaction Processing Hints
Capabilities: [1c0] Latency Tolerance Reporting
Kernel driver in use: igb
Kernel modules: igb
And here's the log output from when I load the pf_ring driver (eth4,5,6,7 are
on the intel card):
Sep 20 18:05:35 XXXXX kernel: [14713.263261] [PF_RING] Welcome to PF_RING 5.4.3
($Revision: $)
Sep 20 18:05:35 XXXXX kernel: [14713.263264] (C) 2004-12 L.Deri <[email protected]>
Sep 20 18:05:35 XXXXX kernel: [14713.263275] [PF_RING] registered
/proc/net/pf_ring/
Sep 20 18:05:35 XXXXX kernel: [14713.263278] NET: Registered protocol family 27
Sep 20 18:05:35 XXXXX kernel: [14713.263281] [PF_RING] packet_notifier(5)
[lo][772]
Sep 20 18:05:35 XXXXX kernel: [14713.263283] [PF_RING] packet_notifier(lo):
skipping non ethernet device
Sep 20 18:05:35 XXXXX kernel: [14713.263286] [PF_RING] packet_notifier(1)
[lo][772]
Sep 20 18:05:35 XXXXX kernel: [14713.263288] [PF_RING] packet_notifier(lo):
skipping non ethernet device
Sep 20 18:05:35 XXXXX kernel: [14713.263290] [PF_RING] packet_notifier(5)
[eth0][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263293] [PF_RING] packet_notifier(eth0)
[REGISTER][pfring_ptr= (null)][hook=ffffffffa02e21c0]
Sep 20 18:05:35 matims7 kernel: [14713.263298] [PF_RING] Device eth0 does NOT
support hardware packet filtering [2]
Sep 20 18:05:35 XXXXX kernel: [14713.263301] [PF_RING] packet_notifier(1)
[eth0][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263303] [PF_RING] packet_notifier(5)
[eth1][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263305] [PF_RING] packet_notifier(eth1)
[REGISTER][pfring_ptr= (null)][hook=ffffffffa02e21c0]
Sep 20 18:05:35 XXXXX kernel: [14713.263310] [PF_RING] Device eth1 does NOT
support hardware packet filtering [2]
Sep 20 18:05:35 XXXXX kernel: [14713.263312] [PF_RING] packet_notifier(1)
[eth1][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263315] [PF_RING] packet_notifier(5)
[eth2][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263317] [PF_RING] packet_notifier(eth2)
[REGISTER][pfring_ptr= (null)][hook=ffffffffa02e21c0]
Sep 20 18:05:35 XXXXX kernel: [14713.263322] [PF_RING] Device eth2 does NOT
support hardware packet filtering [2]
Sep 20 18:05:35 XXXXX kernel: [14713.263324] [PF_RING] packet_notifier(1)
[eth2][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263327] [PF_RING] packet_notifier(5)
[eth3][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263329] [PF_RING] packet_notifier(eth3)
[REGISTER][pfring_ptr= (null)][hook=ffffffffa02e21c0]
Sep 20 18:05:35 XXXXX kernel: [14713.263333] [PF_RING] Device eth3 does NOT
support hardware packet filtering [2]
Sep 20 18:05:35 XXXXX kernel: [14713.263336] [PF_RING] packet_notifier(1)
[eth3][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263338] [PF_RING] packet_notifier(5)
[tun0][65534]
Sep 20 18:05:35 XXXXX kernel: [14713.263340] [PF_RING] packet_notifier(tun0):
skipping non ethernet device
Sep 20 18:05:35 XXXXX kernel: [14713.263343] [PF_RING] packet_notifier(1)
[tun0][65534]
Sep 20 18:05:35 XXXXX kernel: [14713.263345] [PF_RING] packet_notifier(tun0):
skipping non ethernet device
Sep 20 18:05:35 XXXXX kernel: [14713.263347] [PF_RING] packet_notifier(5)
[eth4][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263350] [PF_RING] packet_notifier(eth4)
[REGISTER][pfring_ptr= (null)][hook=ffffffffa02e21c0]
Sep 20 18:05:35 XXXXX kernel: [14713.263354] [PF_RING] Device eth4 does NOT
support hardware packet filtering [2]
Sep 20 18:05:35 XXXXX kernel: [14713.263357] [PF_RING] packet_notifier(1)
[eth4][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263359] [PF_RING] packet_notifier(5)
[eth5][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263361] [PF_RING] packet_notifier(eth5)
[REGISTER][pfring_ptr= (null)][hook=ffffffffa02e21c0]
Sep 20 18:05:35 XXXXX kernel: [14713.263366] [PF_RING] Device eth5 does NOT
support hardware packet filtering [2]
Sep 20 18:05:35 XXXXX kernel: [14713.263368] [PF_RING] packet_notifier(5)
[eth6][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263371] [PF_RING] packet_notifier(eth6)
[REGISTER][pfring_ptr= (null)][hook=ffffffffa02e21c0]
Sep 20 18:05:35 XXXXX kernel: [14713.263375] [PF_RING] Device eth6 does NOT
support hardware packet filtering [2]
Sep 20 18:05:35 XXXXX kernel: [14713.263378] [PF_RING] packet_notifier(5)
[eth7][1]
Sep 20 18:05:35 XXXXX kernel: [14713.263380] [PF_RING] packet_notifier(eth7)
[REGISTER][pfring_ptr= (null)][hook=ffffffffa02e21c0]
Sep 20 18:05:35 XXXXX kernel: [14713.263384] [PF_RING] Device eth7 does NOT
support hardware packet filtering [2]
Sep 20 18:05:35 XXXXX kernel: [14713.263387] [PF_RING] Min # ring slots 32768
Sep 20 18:05:35 XXXXX kernel: [14713.263389] [PF_RING] Slot version 13
Sep 20 18:05:35 XXXXX kernel: [14713.263390] [PF_RING] Capture TX No [RX
only]
Sep 20 18:05:35 XXXXX kernel: [14713.263392] [PF_RING] Transparent Mode 1
Sep 20 18:05:35 XXXXX kernel: [14713.263394] [PF_RING] IP Defragment No
Sep 20 18:05:35 XXXXX kernel: [14713.263395] [PF_RING] Initialized correctly
--
Bob Bomar
Secure Information Services
terremark worldwide
Confidentiality Notice: This e-mail message, including any attachments, is for
the sole use of the intended recipient(s) and may contain confidential and
privileged information. Any unauthorized review, use, disclosure or
distribution is prohibited. If you are not the intended recipient and received
this in error, please contact the sender by reply e-mail and you are hereby
notified that the copying, use or distribution of any information or materials
transmitted in or with this message is strictly prohibited.
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
