nipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
gt; Cheers Luca
>
>
> > On 08 Jul 2015, at 05:11, Pavel Odintsov > wrote:
> >
> > Hello, folks!
> >
> > We have really huge network with ~1Tbps of traffic with sFLOW
> > monitoring enabled.
> >
> > And we want to build traffic statistics from sFLOW
p
protocol detection with ntop?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Hello, folks!
Sorry for bothering you but this ticket is really important for me:
https://github.com/ntop/PF_RING/issues/13
Because I do all development inside KVM machine and could not use PF_RING now :(
--
Sincerely yours, Pavel Odintsov
___
Ntop
On 28 Jun 2015, at 19:27, Pavel Odintsov wrote:
>>
>> Hello, folks!
>>
>> Do you have open source version of SPSC queue used in binary version
>> of PR_RING ZC? Or it part of commercial closed source library too?
>>
>> --
>> Sincerely yours, Pavel
gt; to your hardware.
>
> Alfredo
>
> > On 28 Jun 2015, at 12:10, Pavel Odintsov > wrote:
> >
> > Hello, folks!
> >
> > I looking for solution which could do 40GE on wire speed (56 Mpps).
> > Could I achieve it with PF_RING ZC + i40e driver?
> &g
Hello, folks!
Do you have open source version of SPSC queue used in binary version
of PR_RING ZC? Or it part of commercial closed source library too?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http
Hello, folks!
I looking for solution which could do 40GE on wire speed (56 Mpps).
Could I achieve it with PF_RING ZC + i40e driver?
Btw, could you add prices for 40GE solutions to the
http://www.nmon.net/shop/cart.php?
--
Sincerely yours, Pavel Odintsov
Thanks you for lightning fast answer! :)
On Fri, Jun 19, 2015 at 10:34 AM, Alfredo Cardigliano
wrote:
> Hi Pavel
> replied on github (issue #15)
>
> Alfredo
>
>> On 19 Jun 2015, at 09:25, Pavel Odintsov wrote:
>>
>> Hello, folks!
>>
>> Just poking
Hello, folks!
Just poking about: https://github.com/ntop/PF_RING/issues/15
Do you have any plans for this feature?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman
x27;s ixgbe.
On Sun, May 31, 2015 at 1:22 PM, Alfredo Cardigliano
wrote:
> Something like zbounce -i zc:ethX -o stack:ethX -b should do the job.
>
> Alfredo
>
>> On 31 May 2015, at 12:03, Pavel Odintsov wrote:
>>
>> Hello!
>>
>> Thank you for fast answer! Do y
no rx vectors found on eth5
no tx vectors found on eth5
eth5 mask=1 for /proc/irq/42/smp_affinity
mkdir: cannot create directory ‘/mnt/huge’: File exists
Git dev branch.
On Sun, Dec 14, 2014 at 2:46 PM, Pavel Odintsov
wrote:
> Thank you!
>
> On Sat, Dec 13, 2014 at 6:33 PM, Alfredo Cardig
Hello!
Thank you for fast answer! Do you have any examples of simple two
direction forwarder between ZC and Linux Network Stack?
On Sat, May 30, 2015 at 5:27 PM, Alfredo Cardigliano
wrote:
>
>
>> On 30 May 2015, at 15:55, Pavel Odintsov wrote:
>>
>> Hello!
>>
and injecting it to the linux
stack?
Could I achieve wire speed for traffic injection to the Linux network stack?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
&
>>>
>>>>>>>> Capturing from eth3 [00:E0:ED:FE:18:19][ifIndex: 11]
>>>>>>>>
>>>>>>>> # Device RX channels: 6
>>>>>>>>
>>>>>>>> # Polling threads:1
>>>>>>
ute Stats: 0 pkts - 0 bytes
=====
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
/pf_ring.h /usr/include/linux
/sbin/depmod 2.6.32-042stab094.7
On Mon, Apr 13, 2015 at 1:03 PM, Luca Deri wrote:
> Pavel,
> how can we reproduce the issue? please provide a full log
>
> Regards luca
>
> On 04/13/2015 11:53 AM, Pavel Odintsov wrote:
>> Hello!
>>
>&g
h: no svnversion in
(/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin)
Could you fix this complains?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo
Hello!
Any news about checksumm offload for ZC?
On Thu, Apr 2, 2015 at 4:56 PM, Pavel Odintsov wrote:
> Thank you so much! I interested in ZC version because it could work on wire
> speed and offload features are explicit in this case.
>
> I will test offload feature asap ;)
>
Shouldn’t they be filtered by the rule that just as added?
>>>
>>>
>>> (BTW, when I use the command “./pfcount -i eth3 -u 1 -v 1 -r –m” (i.e.
>>> –u is 1 rather than 2), the tester uses hash filters, and in this case, I
>>> get errors:
>>>
>>> 18:53:19.052549112 [RX][if_index=11][00:08:E3:FF:FC:C8 ->
>>> 00:01:02:03:04:05] [vlan 70] [direction 1] [IPv4][10.61.10.9:52311 ->
>>> 10.70.150.108:60189]
>>> [l3_proto=TCP][hash=344283189][tos=0][tcp_seq_num=596847159]
>>> [caplen=128][len=1490][parsed_header_len=0][eth_offset=-14][l3_offset=18][l4_offset=38][payload_offset=58]
>>>
>>> pfring_add_hash_filtering_rule(1) failed)
>>>
>>>
>>> Any help will be appreciated.
>>>
>>>
>>> Thanks,
>>>
>>> Amir
>>>
>>> ___
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>>
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>>
>>>
>>> ___
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>>
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>
>>
>
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Wow! Awesome! Saw it
https://svn.ntop.org/svn/ntop/trunk/PF_RING/userland/lib/libs/ :) Will
test shortly!
On Thu, Apr 2, 2015 at 6:36 PM, Alfredo Cardigliano
wrote:
> Hi Pavel
> just added to SVN
>
> Alfredo
>
>> On 02 Apr 2015, at 16:12, Pavel Odintsov wrote:
>>
&g
Hello!
I have modern cpu with avx 2 support (e5 2697v3). Do you have any plans for
supporting it in zc library? I checked zc libs and descided you have only
avx 1 support.
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc
sum offload enabled) */
>
> We will add support for this also to ZC ASAP.
>
> Alfredo
>
> On 02 Apr 2015, at 08:28, Pavel Odintsov > wrote:
>
> Hello, folks!
>
> I'm working on user space tcp/ip implementation now. I have modern network
> cards with many types o
ksumm validation. But
checksumm offliad is definitely working and I coukd see counter values in
network card stats.
Nic offload features provide huge performance benefits and will be fine if
you provide code and examples fir they.
Thank you for your attention!
--
Sincerely yours, Pavel Odi
nt was scrubbed...
>> URL:
>> <http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20150326/014d0569/attachment-0001.htm>
>>
>> --
>>
>> Message: 5
>> Date: Thu, 26 Mar 2015 12:50:14 +0300
>> From: Pavel Odintsov
>> To: "
flag --disable-zc ?
>
> ____
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Alfredo
>
>> On 25 Mar 2015, at 17:00, Pavel Odintsov wrote:
>>
>> Hello, folks!
>>
>> I need open only one NIC hardware queue with PF_RING ZC. Another 7
>> queues should be handled by Linux kernel for normal traffic.
>&
Hello, folks!
I need open only one NIC hardware queue with PF_RING ZC. Another 7
queues should be handled by Linux kernel for normal traffic.
Is it possible with PF_RING/ZC?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc
]
Type=oneshot
RemainAfterExit=yes
ExecStart=modprobe pfring
ExecStop=rmmod pfring
[Install]
WantedBy=multi-user.target
On Tue, Mar 24, 2015 at 3:35 PM, Pavel Odintsov
wrote:
> Hello, again!
>
> I switched to use night build version: http://www.nmon.net/centos/ and
> it works good.
s because you do not add this path to ldconfig configuration.
It could be fixed with:
echo "/usr/local/lib" > /etc/ld.so.conf.d/pfring.conf
ldconfig
Thank you! :)
On Mon, Mar 23, 2015 at 11:19 PM, Pavel Odintsov
wrote:
> Hello again!
>
> I'm so sorry! I found librar
two day and I think this
>> is about version mismatch, but I can't go through...
>>
>> (I'm completely new in make file writing, I'm in a deep water now so I'm
>> grateful for any help.)
>>
>> Thanks,
>> András Kónya
>> kandras585 a
gt; András Kónya
> kandras...@gmail.com
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
g.ko
/usr/local/pfring/README.FIRST
/usr/local/include/pfring.h
On Mon, Mar 23, 2015 at 11:06 PM, Pavel Odintsov
wrote:
> Hello, folks!
>
> I'm an author of open source toolkit which linked with PF_RING library
> (yes, it also support ZC mode but I could disable it).
>
> And
ge galaxy of PF_RING enabled tools. But in each case
speedup need few days in manual compilation and configuration.
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Thank you so much! It fixed in svn. Everything works exciting!
On Thu, Mar 19, 2015 at 2:56 PM, Alfredo Cardigliano
wrote:
> Hi Pavel
> this looks like an issue we fixed in svn, did you try with latest code?
>
> Alfredo
>
>> On 18 Mar 2015, at 17:12, Pavel Odintsov wrot
Hello, folks!
I tried to open "any" device with pfring_open and got error:
Can't create PF_RING descriptor: No such device
But if I specify physical device eth0 or even bonding device bond0 all
works fine.
My interfaces list looks like:
https://gist.github.com
Hello, folks!
6.0.2 version is not enough stable and many customers complains about
problems with it :( All problems solved with update from SVN but I
can't rely on development tree.
Do you have any estimations about release?
--
Sincerely yours, Pavel Odi
Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
> _______
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely
;> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>>
>>
>> ___
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
> -BEGIN PGP SIGNATURE-
> Version: GnuPG v1
>
> iF4EAREIAAYFAlT8oHUACgkQCGX2wHRYUXSyOAD/RVrAXRhGr60itInjHR/JQM53
> 3TnpCWq0KzFIfnt4XbUA/2XJrikcUX1OWh62wP6979xfcoPMSzBkrDcTsMQBGWM1
> =D65Q
> -END PGP SIGNATURE-
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Good, thanks Alfredo!
On Thu, Feb 26, 2015 at 5:11 PM, Alfredo Cardigliano
wrote:
> Hi Pavel
> you can use zsend as example for stack injection, it works in the same way
> pfsend does, just use the “stack:” prefix opening a device.
>
> Alfredo
>
>> On 26 Feb 2015,
o linux network stack injection for ZC API?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
ay.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
ucture/).
> If that is what you have you may be out of luck unless you can get their
> admins to load the modules for you.
>
> My issue ended up being a bit more straight-forward once I dug into the
> Makefile and was fixed with by adding my custom location to $PATH.
>
> Regards
Hello, folks!
I found very interesting code for runtime linking to PF_RING (if we
found it on machine):
https://github.com/robertdavidgraham/robdns/blob/master/src/rawsock-pfring.c
Do you have any plans to add support of this approach in upstream
PF_RING library?
--
Sincerely yours, Pavel
Thank you, Alfredo!
On Sat, Jan 10, 2015 at 12:55 PM, Alfredo Cardigliano
wrote:
> Hi Pavel
> the max() definition has been removed in SVN because it seems to be not
> needed anymore.
>
> Alfredo
>
>> On 09 Jan 2015, at 23:28, Pavel Odintsov wrote:
>>
>&
> b ? a : b)
#endif
Maybe you can rename your internal max for compatibility?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
ng the device?
>
> Alfredo
>
> On 20 Dec 2014, at 22:29, Pavel Odintsov wrote:
>
> Hello, Alfredo!
>
> I switched to svn version of PF_RING and integrated
> pfring_zc_check_license call to my tool
> https://github.com/FastVPSEestiOu/fastnetmon/commit/3ab7bf50229148ff9cb
full
>> ZC is running,
>> you can terminate the application correctly handling SIGTERM.
>>
>> Alfredo
>>
>>> On 14 Dec 2014, at 19:19, Pavel Odintsov wrote:
>>>
>>> Hello, folks!
>>>
>>> My tool woking with ZC. And sometimes cust
Excellent! Thank you!
On Fri, Dec 19, 2014 at 8:49 PM, Alfredo Cardigliano
wrote:
> ZC works in zero-copy (no packet copy), thus capturing the whole packet or
> just a snaplen does not affect performance.
>
> Alfredo
>
>> On 19 Dec 2014, at 17:57, Pavel Odintsov wrote:
>
you need
> you should call:
> pfring_parse_pkt(pkt /* u_char* */, &hdr /* struct pfring_pkthdr* */, 3 /* up
> to L3 */, 0 /* no timestamp */, 0 /* no hash */);
>
> Alfredo
>
>> On 23 Oct 2014, at 20:00, Pavel Odintsov wrote:
>>
>> Hello, folks!
improvements using the bursts version in
> your application.
>
> Alfredo
>
>> On 19 Dec 2014, at 14:04, Pavel Odintsov wrote:
>>
>> Hello, folks!
>>
>> I integrated PF_RING ZC API and everything works perfectly! I can
>> handle about 6M
y and round_robin_bursts_policy.
In all examples you used round_robin_bursts_policy but I can't
understand why did you do this :(
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.
ruct pfring_pkthdr’
>> declared inside parameter list
>> /nsm/pfring/include/pfring.h:1253: warning: ‘struct pfring_pkthdr’
>> declared inside parameter list
>> /nsm/pfring/include/pfring.h:1299: warning: ‘struct pfring_pkthdr’
>> declared inside parameter list
>
tly handling SIGTERM.
>
> Alfredo
>
>> On 14 Dec 2014, at 19:19, Pavel Odintsov wrote:
>>
>> Hello, folks!
>>
>> My tool woking with ZC. And sometimes customers use it with trial ZC
>> license (only for 5 minutes).
>>
>> But I can't che
interface need one license.
>
> greetings,
> Peter
>
>
>
> W dniu 2014-12-15 12:37, Pavel Odintsov pisze:
>
>> Hello!
>>
>> But why don't you can open both interfaces separately? Bonding is very
>> simple round-robin balancer. And it didn't
ome limit, feature or i'm doing something wrong ?
>
> thanks for help
> Peter
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
__
ssible for production use.
Finally, I suggest two features:
1) API call for checking "is this ZC license is valid or trial?"
2) Ability to provide callback for finishing my toolkit correctly when
trial time is expired.
Thank you for a great
Thank you!
On Sat, Dec 13, 2014 at 6:33 PM, Alfredo Cardigliano
wrote:
> Hi Pavel
> fixed, thank you
>
> Alfredo
>
>> On 13 Dec 2014, at 13:31, Pavel Odintsov wrote:
>>
>> Hello!
>>
>> Please add this umount command before mount -t hugetlbfs:
&g
_create_cluster error [No buffer space available] Please
check that pf_ring.ko is loaded and hugetlb fs is mounted
Thank you!
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
stgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Cardigliano
wrote:
> Hi Pavel
> when you open an interface in ZC mode (zc:ethX) it gets disconnected from the
> linux stack
>
> Alfredo
>
>> On 12 Dec 2014, at 18:42, Pavel Odintsov wrote:
>>
>> Hello!
>>
>> But how I can disable passing packets to syst
Hello!
But how I can disable passing packets to system? I need this packets
only at PF_RING level :)
On Fri, Dec 12, 2014 at 8:03 PM, Luca Deri wrote:
> Good to know ZC works as expected
>
> Luca
>
>> On 12 Dec 2014, at 17:33, Pavel Odintsov wrote:
>>
>> Yep, I
t;
> Luca
>
> On 12 Dec 2014, at 17:23, Pavel Odintsov wrote:
>
> Maybe it will be relevant and I have 2 NIC's with 2 ports each in this
> server:
>
> 0a:00.0 Ethernet controller: Intel Corporation 82599EB 10-Gigabit
> SFI/SFP+ Network Connection (rev 01)
> 0a:00.1 Et
:00.0 Ethernet controller: Intel Corporation 82599EB 10-Gigabit
SFI/SFP+ Network Connection (rev 01)
0d:00.1 Ethernet controller: Intel Corporation 82599EB 10-Gigabit
SFI/SFP+ Network Connection (rev 01)
On Fri, Dec 12, 2014 at 7:16 PM, Pavel Odintsov
wrote:
> Oh, very strange!
>
> In tran
.10.200.0: UDP, length 0
19:15:19.916741 IP 10.10.10.100.41744 > 10.10.10.200.0: UDP, length 0
19:15:19.916742 IP 10.10.10.100.30049 > 10.10.10.200.0: UDP, length 0
10 packets captured
2980 packets received by filter
2839 packets dropped by kernel
On Fri, Dec 12, 2014 at 7:11 PM, Pavel
, I believe you are not using ZC. Please explain what
> you are doing?
>
>
> Luca
>
> On 12 Dec 2014, at 16:24, Pavel Odintsov wrote:
>
> Total number of generated packets per second flood was about 1million
> packets per second, CPU E5-2407 0 @ 2.20GHz.
>
> On
Total number of generated packets per second flood was about 1million
packets per second, CPU E5-2407 0 @ 2.20GHz.
On Fri, Dec 12, 2014 at 6:19 PM, Pavel Odintsov
wrote:
> Hello!
>
> I'm using PF_RING 6.0.2 with Debian 7 Wheezy 3.2.0-4-amd64. I
> installed ixgbe driver with ZC s
61/32207MB]
Swp[ 0/8190MB]
I even tried to enable quick_mode=1 but ksoftirqd consuming almost
whole CPU core.
Thank you for your attention!
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing
arse_pkt() call with the below?
>
> memset(&h->extended_hdr.parsed_pkt, 0, sizeof(h->extended_hdr.parsed_pkt));
> pfring_parse_pkt((u_char*)p, (struct pfring_pkthdr*)h, 4, 1, 0);
>
> Alfredo
>
>> On 11 Dec 2014, at 15:30, Pavel Odintsov wrote:
>>
>>
I tried to find fix for this issue but have no success in it :(
On Thu, Dec 11, 2014 at 5:23 PM, Alfredo Cardigliano
wrote:
> Hi Pavel
> why do you expect a difference?
>
> Alfredo
>
> On 11 Dec 2014, at 15:11, Pavel Odintsov wrote:
>
> I read diff between 6.0.3 and curr
I read diff between 6.0.3 and current SVN and do not found any changes
in parser :( Can you help me?
On Wed, Dec 10, 2014 at 6:37 PM, Pavel Odintsov
wrote:
> Hello!
>
> I tried to do manual parsing and it failed with very strange results.
> I tried do manual parser with vanilla PF
[payload_offset=54]
[90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [vlan 100]
[IPv4][159.253.20.133:80 -> 178.18.208.229:41361]
[l3_proto=TCP][hash=1376814929][tos=0][tcp_seq_num=1451307525]
[caplen=128][len=1522][parsed_header_len=0][eth_offset=-14][l3_offset=18][l4_offset=38][payload_offset=58]
Could you h
Hello, folks!
I added support for L2TP decapsulation over IP with recursive call of
pfring_parse_pkt. You can check this example:
https://gist.github.com/pavel-odintsov/21e9831fec2895990196
On Tue, Dec 9, 2014 at 2:12 PM, Pavel Odintsov wrote:
> Hello, Alfredo!
>
> Thank you for your
ty per user? because I build and
> compile the application over and over an each time I need root access again
> to set the capability.
>
> Thanks,
>
> On Tue, Dec 9, 2014 at 12:22 PM, Pavel Odintsov
> wrote:
>>
>> Hello!
>>
>> You should grant cap_net
n pf_ring applications without root permission?
>
> Thanks,
> --
> Behrooz
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
ket length, thus pfring_parse_pkt() is not able
> parsing the packet as expected.
>
> Alfredo
>
>> On 09 Dec 2014, at 12:46, Pavel Odintsov wrote:
>>
>> Hello!
>>
>> I'm trying to do L2TP packet parser and want to do something like this
>> for pasring nes
s=0][tcp_seq_num=0]
[caplen=0][len=0][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=0][payload_offset=0]
As you can see second call on same packet with zeroed struct
pfring_pkthdr struct produces completely incorrect data.
How I should initilize struct pfring_pkthdr correctly for pfring_pa
velopment.
>
> Alfredo
>
>> On 08 Dec 2014, at 11:43, Pavel Odintsov wrote:
>>
>> Hello, folks!
>>
>> I suggest new feature for L2TP decapsulation. It's very useful in
>> modern decentralized networks.
>>
>> I tried with current PF_RING and got
3_proto=115][hash=2784721876][tos=32][tcp_seq_num=0]
[caplen=128][len=873][parsed_header_len=0][eth_offset=-14][l3_offset=14][l4_offset=34][payload_offset=0]
Could you extract information about packet in tunnel?
Thank you so much!
--
Sincerely yours, Pav
e you can
move this .h file to library?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
er using script load_driver_2.sh
>
>
>
> Can you help us determine what are we doing wrong?
>
>
>
> Thank you in advance,
>
> Katarina Valent
>
>
>
> Best Regards
>
> Alfredo
>
>
>
>
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
e attached output from dmesg after using script load_driver_2.sh
>
>
>
> Can you help us determine what are we doing wrong?
>
>
>
> Thank you in advance,
>
> Katarina Valent
>
>
>
> Best Regards
>
> Alfredo
>
>
>
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
error :(
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Hello!
Subject!
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
Can anyone
> help me what might have gone wrong?
>
> PS. I use pfring in normal mode not DNA
>
>
> Thanks,
> --
> Behrooz
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
&
gwul8ka7ww/htoppng.png?dl=0
Is it possible to process more packets on non-zc PF_RING or I should
go to ZC mode? :(
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
col: tcp flags: ack size: 70 bytes
2014-10-23 17:12:08.442047 194.126.108.76:80 > 46.36.217.105:59468
protocol: tcp flags: ack size: 10202 bytes
On Wed, Oct 22, 2014 at 2:06 AM, Pavel Odintsov
wrote:
> Thank you so much! I will check it!
>
> On Wed, Oct 22, 2014 at 2:05 AM, Alfredo Car
83 e2 07 f3 48 a5 89 d1 f3 a4 c3 20 4c 8b 06
4c 8b
[13086.286116] RIP [] memcpy+0x6/0x110
[13086.287102] RSP
[13086.288042] CR2: c90022b0b000
Can you fix this issues?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc
Thank you so much! I will check it!
On Wed, Oct 22, 2014 at 2:05 AM, Alfredo Cardigliano
wrote:
> You should disable them if you need real packets.
>
> Alfredo
>
>> On 22 Oct 2014, at 00:00, Pavel Odintsov wrote:
>>
>> Hello!
>>
>> Yep, it enabled :(
21 Oct 2014, at 11:19, Pavel Odintsov wrote:
>>
>> Hello!
>>
>> I use PF_RING packets parser and got very strange packets size in
>> network with stadnard MTU (1500):
>> 2014-10-16 03:32:50.483384 188.120.233.239:39393 > 5.45.118.135:80
>> protocol: tcp
size: 66 bytes
Full list: https://gist.github.com/pavel-odintsov/6aac022b8f6eebd284ff
I got h->len from pfring_pkthdr *h struct with no processing. How it possible?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.
Thank you for fast and useful answer! :)
On Tue, Oct 21, 2014 at 12:14 PM, Alfredo Cardigliano
wrote:
> No, with standard drivers it uses kernel threads (ksoftirq)
>
> Alfredo
>
>> On 21 Oct 2014, at 10:00, Pavel Odintsov wrote:
>>
>> Hello!
>>
>>
Hello!
Yep, I can run it in my tool but standard parser with no-zc mode
spread for all cores. It uses additional threads inside pf_ring?
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
whole core.
Could I enable PF_RING packet parser for ZC mode?
--
Sincerely yours, Pavel Odintsov
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
again and let us know (cut&paste again the dmesg output)
>
> Thank you
> Alfredo
>
> On 12 Jul 2014, at 22:15, Pavel Odintsov wrote:
>
> Hello!
>
> We got same error with svn version of PF_RING:
>
>
> [130426.881833] NET: Unregistered protocol family
t+0x0/0x37c [pf_ring]
[130446.637399] [] ? ring_init+0x2bd/0x37c [pf_ring]
[130446.637464] [] ? do_one_initcall+0x3c/0x1d0
[130446.637526] [] ? sys_init_module+0xe1/0x250
[130446.637588] [] ? system_call_fastpath+0x16/0x1b
On Fri, Jul 11, 2014 at 3:51 PM, Pavel Odintsov
wrote:
> Thank you!
&
Thank you!
I will check it soon.
On Fri, Jul 11, 2014 at 2:26 PM, Alfredo Cardigliano
wrote:
> Hi Pavel
> please try updating from svn and let us know. Cut&paste dmesg and ifconfig
> output if possible.
>
> Thank you
> Alfredo
>
> On 11 Jul 2014, at 09:09, Pavel
Right!
On Fri, Jul 11, 2014 at 11:08 AM, Alfredo Cardigliano
wrote:
> Ok now I understand. Is this happening *only* when GRE is up?
>
> Alfredo
>
> On 11 Jul 2014, at 08:58, Pavel Odintsov wrote:
>
>> Not, we only start PF_RING module on node with running GRE tunnel.
i Pavel
>>> can you provide us a small .pcap file we can use to reproduce the issue?
>>>
>>> Alfredo
>>>
>>> On 11 Jul 2014, at 08:32, Pavel Odintsov wrote:
>>>
>>>> Hello!
>>>>
>>>> I'm using GRE t
1 - 100 of 104 matches
Mail list logo
