On 17/03/14 17:58, Reynolds, Jeffrey wrote: > Hello all, > > I’m new to the idea of PF_Ring and I’ve installed the RPM on a new CentOS 6.5 > x86_64 install. There are two NICs on this machine (DNA capable I believe, > Intel Corporation Ethernet Controller 10-Gigabit X540-AT2 is the readout from > lspci), and they are each currently plugged into a span port on a switch. > Now, from the user guide I understand I can use PF_Ring to take the input > from those two interfaces, and send it to a single PF_Ring ring using the > “multi” (Link Aggregation) module. I then see that I should be able to start > up say 10 or so processes and have each of them be fed a separate portion of > the traffic in that ring. From my understanding, I will need to compile the > pf_ring modified version of libpcap if the applications use that library for > their packet capture, and I may need to recompile the application itself. > I’m not quite sure how the mechanics of this work, IE would each process > attach to a separate device (dna0, dna1, etc, instead of eth0). But I’ve > decided to try it out on a test box. > > However, I’ve hit a bit of a stumbling block. I just installed the pfring > rpm, I’ve noticed something odd, at least to me. Whenever the machine boots, > even with the service scripts disabled, the pf_ring.ko kernel module is still > loaded. I’m trying to prevent this from happening so that I can load the > pf_ring module with parameters specified in the conf file when the service > script runs. However, I have not been able to find any config files which > are actually loading the module at boot. Running `grep –r “pf_ring.ko” *` > inside of /etc produces the following output: > > init.d/pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > init.d/pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc0.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc0.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc1.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc1.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc2.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc2.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc3.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc3.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc4.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc4.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc5.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc5.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc6.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc6.d/K60pf_ring: PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc.d/rc5.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc.d/rc5.d/K60pf_ring: > PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc.d/rc2.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc.d/rc2.d/K60pf_ring: > PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc.d/rc6.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc.d/rc6.d/K60pf_ring: > PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc.d/rc4.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc.d/rc4.d/K60pf_ring: > PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc.d/rc0.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc.d/rc0.d/K60pf_ring: > PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc.d/rc1.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc.d/rc1.d/K60pf_ring: > PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc.d/rc3.d/K60pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc.d/rc3.d/K60pf_ring: > PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko" > rc.d/init.d/pf_ring: > PF_RING_MOD="/lib/modules/$KERNEL_VERSION/kernel/net/pf_ring/pf_ring.ko" > rc.d/init.d/pf_ring: > PF_RING_MOD_LOCAL="/usr/local/pfring/kernel/pf_ring.ko” > > Which is what I’d expect to see as the pf_ring script was installed by the > RPM, but even after running “chkconfig pf_ring off” and “chkconfig cluster > off”, I still get the module loaded at boot. Any advice on how to disable > this module being loaded outside the script would be welcome, as well as any > advice for how to go about reaching my end goal. >
I think that the usual Centos way would work: echo "blacklist pfring" >> /etc/modprobe.d/blacklist.conf regards vito > Thanks, > > Jeff Reynolds > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
