Hi Alfredo, I see. I'm running this in conjunction with Bro IDS. Even with Bro active, I'm still seeing my ring count set to zero. I didn't install the supported Intel drivers that come with the PF_RING program, but I am using the latest Intel drivers from the Intel website. Would that be the reason?
Thanks for the reply, On Thu, Mar 16, 2017 at 7:00 AM, <[email protected]> wrote: > Send Ntop-misc mailing list submissions to > [email protected] > > To subscribe or unsubscribe via the World Wide Web, visit > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > or, via email, send a message with subject or body 'help' to > [email protected] > > You can reach the person managing the list at > [email protected] > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Ntop-misc digest..." > > > Today's Topics: > > 1. Issue with '0' total rings in pfring stats file (Espresso Beanies) > 2. Re: Issue with '0' total rings in pfring stats file > (Alfredo Cardigliano) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 15 Mar 2017 11:36:18 -0400 > From: Espresso Beanies <[email protected]> > To: [email protected] > Subject: [Ntop-misc] Issue with '0' total rings in pfring stats file > Message-ID: > <CAOeD16-XbcH8Pmn+NFdV+yL6h+FyONv+J3_f4LKnZ3fnOXe1Qg@mail. > gmail.com> > Content-Type: text/plain; charset="utf-8" > > Good morning, > > If I run a 'cat /proc/net/pf_ring/info' command, I receive the following > output: > > [root@localhost opt]# cat /proc/net/pf_ring/info > PF_RING Version : 6.5.0 > (dev:b947515496b2f18ded1b2b166c1a96ba136bd626) > Total rings : *0* > > Standard (non ZC) Options > Ring slots : 4096 > Slot version : 16 > Capture TX : Yes [RX+TX] > IP Defragment : No > Socket Mode : Standard > Cluster Fragment Queue : 0 > Cluster Fragment Discard : 0 > > My total # of rings is set to zero and it has been this way ever since I > installed pf_ring from source. I created the following file with these > parameters: > > options pf_ring transparent_mode=0 min_num_slots=65534 > > But my ring slots didn't increase. If I run an 'lsmod | grep pf_ring' and I > can see the pf_ring module loaded, but a 'modinfo pf_ring' command fails. > How do I get my total rings up from zero? > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: <http://listgateway.unipi.it/mailman/private/ntop-misc/ > attachments/20170315/15cdc4e4/attachment-0001.htm> > > ------------------------------ > > Message: 2 > Date: Thu, 16 Mar 2017 10:56:55 +0100 > From: Alfredo Cardigliano <[email protected]> > To: [email protected] > Subject: Re: [Ntop-misc] Issue with '0' total rings in pfring stats > file > Message-ID: <[email protected]> > Content-Type: text/plain; charset="utf-8" > > Hi > what if you manually load the module? > > # rmmod pf_ring > # insmod <path>/pf_ring.ko min_num_slots=65534 > # cat /proc/net/pf_ring/info > PF_RING Version : 6.5.0 (dev:002e0bc48dd36335f98f266aa39dbb > 714957a3b2) > Total rings : 0 > > Standard (non ZC) Options > Ring slots : 65534 > Slot version : 16 > Capture TX : Yes [RX+TX] > IP Defragment : No > Socket Mode : Standard > Cluster Fragment Queue : 0 > Cluster Fragment Discard : 0 > > Please note the "total rings? counter is the number of active sockets, did > you run an application to see it increasing? > > # cat /proc/net/pf_ring/info > PF_RING Version : 6.5.0 (dev:002e0bc48dd36335f98f266aa39dbb > 714957a3b2) > Total rings : 1 > > Standard (non ZC) Options > Ring slots : 65534 > Slot version : 16 > Capture TX : Yes [RX+TX] > IP Defragment : No > Socket Mode : Standard > Cluster Fragment Queue : 0 > Cluster Fragment Discard : 0 > > Alfredo > > > On 15 Mar 2017, at 16:36, Espresso Beanies <[email protected]> > wrote: > > > > Good morning, > > > > If I run a 'cat /proc/net/pf_ring/info' command, I receive the following > output: > > > > [root@localhost opt]# cat /proc/net/pf_ring/info > > PF_RING Version : 6.5.0 (dev:b947515496b2f18ded1b2b166c1a96 > ba136bd626) > > Total rings : 0 > > > > Standard (non ZC) Options > > Ring slots : 4096 > > Slot version : 16 > > Capture TX : Yes [RX+TX] > > IP Defragment : No > > Socket Mode : Standard > > Cluster Fragment Queue : 0 > > Cluster Fragment Discard : 0 > > > > My total # of rings is set to zero and it has been this way ever since I > installed pf_ring from source. I created the following file with these > parameters: > > > > options pf_ring transparent_mode=0 min_num_slots=65534 > > > > But my ring slots didn't increase. If I run an 'lsmod | grep pf_ring' > and I can see the pf_ring module loaded, but a 'modinfo pf_ring' command > fails. How do I get my total rings up from zero? > > _______________________________________________ > > Ntop-misc mailing list > > [email protected] > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: <http://listgateway.unipi.it/mailman/private/ntop-misc/ > attachments/20170316/5dca0fc2/attachment-0001.htm> > > ------------------------------ > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > End of Ntop-misc Digest, Vol 153, Issue 9 > ***************************************** >
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
