Salih please go ahead and modify the pcap-over-pf_ring library. The trick is to find a place in the pcap library where to call pfring_enable_xxx so that it is called after the filter has been set. Done that please mail me the code patch
Luca On Jun 27, 2011, at 1:20 PM, <[email protected]> <[email protected]> wrote: > Hi, > tried rev4693 and still some packets are received before filter gets control > Regards, > Salih > Salih > tcpdump works via pcap and thus there's an extra layer to take care. I am > currently modifying the library to prevent this behaviour. In fact in pfring > as soon as you open a socket packets are coming, then tcpdump sets a filter > and packets are filtered. However packets in queue are unfiltered. Can you > please try the code in SVN and see if the behaviour changes with the fixes we > did yesterday? > > Thanks Luca > > On Jun 27, 2011, at 11:57 AM, <[email protected]> wrote: > > > Hi, > > I am trying to use pfring on my system with very high traffic load (around > > 600kpps). When I open tcpdump with some filters, first few packets captured > > do not match the filter I set, but after a short while, the filter seems > > working as intended. Its like it takes a while to apply the filter, but > > packets captured during that time are delivered to upper layers nonetheless. > > Anybody else noticed a similar issue?? > > Salih > > _______________________________________________ > > Ntop-dev mailing list > > [email protected] > > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev --- If you can not measure it, you can not improve it - Lord Kelvin
_______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
