Hello all, Yesterday I upgraded a number of my systems to the Linux 3.13 kernel and PF-RING from 5.6.2 to 6.0.1. I have encountered several significant problems after the upgrades.
First, one of my systems which was collecting around 900Mbps began recording only 1Mbps. Rolling back just the PF_RING 5.6.2 kernel module (compiled against the 3.13 kernel) fixed this problem and capture levels returned to normal. Second, a different system running several capture processes is recording packets filtered with "port 25" as ethernet packets only. It appears as though the IP and TCP headers are being stripped, but the ethernet and tcp payload are being stored. The only way I was able to get this working again was to roll back to an old 3.2 kernel, the PF_RING 5.6.2 kernel module AND the the PF_RING libpcap library. This behavior appeared with every packet capture tool I tried (snort, tcpdump, bro, etc). Is the 3.13 linux kernel officially supported? Is there something else that might cause these strange errors? In all cases I was running transparent mode 0 with the vanilla NIC drivers. Thanks in advance, Jason
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
