Luca, in pcap-linux.c:5000, there’s a code block that seems to drain packets currently in the queue. But it requires that HAVE_PF_RING be not defined. Isn’t it something similar to this one what we need, to drain packets from the ring. If I try to run this block by commenting #ifndef/#endif sytems locks up and I get a “soft lockup” error. Why can’t we use this when HAVE_PF_RING is defined? Regards From: Luca Deri Sent: Monday, June 27, 2011 3:17 PM To: [email protected] Subject: Re: [Ntop-dev] pf_ring nonfiltered packets Salih please go ahead and modify the pcap-over-pf_ring library. The trick is to find a place in the pcap library where to call pfring_enable_xxx so that it is called after the filter has been set. Done that please mail me the code patch Luca On Jun 27, 2011, at 1:20 PM, <[email protected]> <[email protected]> wrote:
Hi, tried rev4693 and still some packets are received before filter gets control Regards, Salih Salih tcpdump works via pcap and thus there's an extra layer to take care. I am currently modifying the library to prevent this behaviour. In fact in pfring as soon as you open a socket packets are coming, then tcpdump sets a filter and packets are filtered. However packets in queue are unfiltered. Can you please try the code in SVN and see if the behaviour changes with the fixes we did yesterday? Thanks Luca On Jun 27, 2011, at 11:57 AM, <[email protected]> wrote: > Hi, > I am trying to use pfring on my system with very high traffic load (around 600kpps). When I open tcpdump with some filters, first few packets captured do not match the filter I set, but after a short while, the filter seems working as intended. Its like it takes a while to apply the filter, but packets captured during that time are delivered to upper layers nonetheless. > Anybody else noticed a similar issue?? > Salih > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev --- If you can not measure it, you can not improve it - Lord Kelvin -------------------------------------------------------------------------------- _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
_______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
