Hello all, I’m new to the idea of PF_Ring and I’ve installed the RPM on a new CentOS 6.5 x86_64 install. There are two NICs on this machine (DNA capable I believe, Intel Corporation Ethernet Controller 10-Gigabit X540-AT2 is the readout from lspci), and they are each currently plugged into a span port on a switch. Now, from the user guide I understand I can use PF_Ring to take the input from those two interfaces, and send it to a single PF_Ring ring using the “multi” (Link Aggregation) module. I then see that I should be able to start up say 10 or so processes and have each of them be fed a separate portion of the traffic in that ring. From my understanding, I will need to compile the pf_ring modified version of libpcap if the applications use that library for their packet capture, and I may need to recompile the application itself. I’m not quite sure how the mechanics of this work, IE would each process attach to a separate device (dna0, dna1, etc, instead of eth0). But I’ve decided to try it out on a test box.
However, I’ve hit a bit of a stumbling block. I just installed the pfring rpm, I’ve noticed something odd, at least to me. Whenever the machine boots, even with the service scripts disabled, the pf_ring.ko kernel module is still loaded. I’m trying to prevent this from happening so that I can load the pf_ring module with parameters specified in the conf file when the service script runs. However, I have not been able to find any config files which are actually loading the module at boot. Running `grep –r “pf_ring.ko” *` inside of /etc produces the following output: init.d/pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" init.d/pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc0.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc0.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc1.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc1.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc2.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc2.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc3.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc3.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc4.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc4.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc5.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc5.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc6.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc6.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc.d/rc5.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc.d/rc5.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc.d/rc2.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc.d/rc2.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc.d/rc6.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc.d/rc6.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc.d/rc4.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc.d/rc4.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc.d/rc0.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc.d/rc0.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc.d/rc1.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc.d/rc1.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc.d/rc3.d/K60pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc.d/rc3.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" rc.d/init.d/pf_ring: PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" rc.d/init.d/pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko” Which is what I’d expect to see as the pf_ring script was installed by the RPM, but even after running “chkconfig pf_ring off” and “chkconfig cluster off”, I still get the module loaded at boot. Any advice on how to disable this module being loaded outside the script would be welcome, as well as any advice for how to go about reaching my end goal. Thanks, Jeff Reynolds _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
