This is strange, it could be Bro is not using pf_ring, could you try running pfcount? You should see files under /proc/net/pf_ring/ containing the application pid in the file name when running applications on pf_ring.
Alfredo > On 16 Mar 2017, at 19:18, Espresso Beanies <[email protected]> wrote: > > Hi Alfredo, > > I see. I'm running this in conjunction with Bro IDS. Even with Bro active, > I'm still seeing my ring count set to zero. I didn't install the supported > Intel drivers that come with the PF_RING program, but I am using the latest > Intel drivers from the Intel website. Would that be the reason? > > Thanks for the reply, > > On Thu, Mar 16, 2017 at 7:00 AM, <[email protected] > <mailto:[email protected]>> wrote: > Send Ntop-misc mailing list submissions to > [email protected] <mailto:[email protected]> > > To subscribe or unsubscribe via the World Wide Web, visit > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > <http://listgateway.unipi.it/mailman/listinfo/ntop-misc> > or, via email, send a message with subject or body 'help' to > [email protected] > <mailto:[email protected]> > > You can reach the person managing the list at > [email protected] > <mailto:[email protected]> > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Ntop-misc digest..." > > > Today's Topics: > > 1. Issue with '0' total rings in pfring stats file (Espresso Beanies) > 2. Re: Issue with '0' total rings in pfring stats file > (Alfredo Cardigliano) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 15 Mar 2017 11:36:18 -0400 > From: Espresso Beanies <[email protected] > <mailto:[email protected]>> > To: [email protected] <mailto:[email protected]> > Subject: [Ntop-misc] Issue with '0' total rings in pfring stats file > Message-ID: > <caoed16-xbch8pmn+nfdv+yl6h+fyonv+j3_f4lknz3fnoxe...@mail.gmail.com > <mailto:caoed16-xbch8pmn%2bnfdv%2byl6h%2bfyonv%[email protected]>> > Content-Type: text/plain; charset="utf-8" > > Good morning, > > If I run a 'cat /proc/net/pf_ring/info' command, I receive the following > output: > > [root@localhost opt]# cat /proc/net/pf_ring/info > PF_RING Version : 6.5.0 > (dev:b947515496b2f18ded1b2b166c1a96ba136bd626) > Total rings : *0* > > Standard (non ZC) Options > Ring slots : 4096 > Slot version : 16 > Capture TX : Yes [RX+TX] > IP Defragment : No > Socket Mode : Standard > Cluster Fragment Queue : 0 > Cluster Fragment Discard : 0 > > My total # of rings is set to zero and it has been this way ever since I > installed pf_ring from source. I created the following file with these > parameters: > > options pf_ring transparent_mode=0 min_num_slots=65534 > > But my ring slots didn't increase. If I run an 'lsmod | grep pf_ring' and I > can see the pf_ring module loaded, but a 'modinfo pf_ring' command fails. > How do I get my total rings up from zero? > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > <http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170315/15cdc4e4/attachment-0001.htm > > <http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170315/15cdc4e4/attachment-0001.htm>> > > ------------------------------ > > Message: 2 > Date: Thu, 16 Mar 2017 10:56:55 +0100 > From: Alfredo Cardigliano <[email protected] <mailto:[email protected]>> > To: [email protected] <mailto:[email protected]> > Subject: Re: [Ntop-misc] Issue with '0' total rings in pfring stats > file > Message-ID: <[email protected] > <mailto:[email protected]>> > Content-Type: text/plain; charset="utf-8" > > Hi > what if you manually load the module? > > # rmmod pf_ring > # insmod <path>/pf_ring.ko min_num_slots=65534 > # cat /proc/net/pf_ring/info > PF_RING Version : 6.5.0 > (dev:002e0bc48dd36335f98f266aa39dbb714957a3b2) > Total rings : 0 > > Standard (non ZC) Options > Ring slots : 65534 > Slot version : 16 > Capture TX : Yes [RX+TX] > IP Defragment : No > Socket Mode : Standard > Cluster Fragment Queue : 0 > Cluster Fragment Discard : 0 > > Please note the "total rings? counter is the number of active sockets, did > you run an application to see it increasing? > > # cat /proc/net/pf_ring/info > PF_RING Version : 6.5.0 > (dev:002e0bc48dd36335f98f266aa39dbb714957a3b2) > Total rings : 1 > > Standard (non ZC) Options > Ring slots : 65534 > Slot version : 16 > Capture TX : Yes [RX+TX] > IP Defragment : No > Socket Mode : Standard > Cluster Fragment Queue : 0 > Cluster Fragment Discard : 0 > > Alfredo > > > On 15 Mar 2017, at 16:36, Espresso Beanies <[email protected] > > <mailto:[email protected]>> wrote: > > > > Good morning, > > > > If I run a 'cat /proc/net/pf_ring/info' command, I receive the following > > output: > > > > [root@localhost opt]# cat /proc/net/pf_ring/info > > PF_RING Version : 6.5.0 > > (dev:b947515496b2f18ded1b2b166c1a96ba136bd626) > > Total rings : 0 > > > > Standard (non ZC) Options > > Ring slots : 4096 > > Slot version : 16 > > Capture TX : Yes [RX+TX] > > IP Defragment : No > > Socket Mode : Standard > > Cluster Fragment Queue : 0 > > Cluster Fragment Discard : 0 > > > > My total # of rings is set to zero and it has been this way ever since I > > installed pf_ring from source. I created the following file with these > > parameters: > > > > options pf_ring transparent_mode=0 min_num_slots=65534 > > > > But my ring slots didn't increase. If I run an 'lsmod | grep pf_ring' and I > > can see the pf_ring module loaded, but a 'modinfo pf_ring' command fails. > > How do I get my total rings up from zero? > > _______________________________________________ > > Ntop-misc mailing list > > [email protected] <mailto:[email protected]> > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > <http://listgateway.unipi.it/mailman/listinfo/ntop-misc> > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > <http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170316/5dca0fc2/attachment-0001.htm > > <http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170316/5dca0fc2/attachment-0001.htm>> > > ------------------------------ > > _______________________________________________ > Ntop-misc mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > <http://listgateway.unipi.it/mailman/listinfo/ntop-misc> > > End of Ntop-misc Digest, Vol 153, Issue 9 > ***************************************** > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
