You should use libpfring and daq from svn (userland/lib, userland/snort). Alfredo
On Apr 5, 2013, at 7:36 PM, Michal Purzynski <[email protected]> wrote: > On 2013-04-05 19:31, Alfredo Cardigliano wrote: >> Hi Michal >> could you try to reproduce this issue with latest pf_ring from svn? > > Sure thing, working on it - already recompiled the pf_ring.ko and now snort > tells me to upgrade the libpfring library. > > Somehow I cannot find it, any clues? Something more I should also do? > >> >> Thank you >> Alfredo >> >> On Apr 5, 2013, at 5:57 PM, Michal Purzynski <[email protected]> wrote: >> >>> Hi, >>> >>> I'm building a full packet capture IDS setup, using Security Onion (hence >>> pf_ring). >>> >>> Every time I start snort I get a long kernel stack trace and a kernel panic >>> - literally in seconds. >>> >>> The full panic capture is here: http://pastebin.com/sgLMrr49 >>> >>> Details: >>> >>> It's a HP 360 G8 server with dual CPUs (12 cores), HT enabled, 16 GB of RAM >>> running Ubuntu 12.04. The system is updated, kernel 3.2.0-39-generic. >>> >>> pf_ring version 5.5.2 >>> >>> NICs - two Intel X520-1 (82599EB chipset). >>> >>> Traffic (more or less) - eth4 250Mbit/sec, 50Kpps. eth5 2Gbit/sec and >>> 250Kpps. >>> >>> The traffic is mirrored from a load balancers. >>> >>> The same result is with distribution bundled drivers and hand build 3.14.5 >>> loaded with LRO=0 >>> >>> Ethtool options are: >>> >>> rx 4096 >>> >>> rx, tx, sg, tso, ufo, gso, lro - off >>> >>> What's interesting - I've once tried running the kernel as UP (nosmp >>> option during boot) and the system was stable (and crawling). >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
