Dear list, the pf_ring interface to the kernel seems to be broken when wordlengths differ between userspace and kernel. In our case we're using a 64-bit kernel with 32-bit userland (x86_64 architecture).
The culprit is the 'ts' field in struct pfring_pkthdr, which is of type struct timeval. The latter's two fields tv_sec and tv_usec are both defined to long on x86 and therefore depend on wordlength. Fixing the problem seems non-trivial, since though there is a struct compat_timeval, detecting 32-bit users is not as easy as with ioctl callbacks. And even if this was known, adding conditionals to all places in pf_ring.c where struct pfring_pkthdr is being used would make it all a bit messy. Using struct compat_timeval for all cases is neither an option, since that should break pcap compatibility with 64-bit userlands. Please advise. Best wishes, Phil Sutter Software Engineer -- Viprinet GmbH Mainzer Str. 43 55411 Bingen am Rhein Germany Phone/Zentrale: +49-6721-49030-0 Direct line/Durchwahl: +49-6721-49030-134 Fax: +49-6721-49030-209 [email protected] http://www.viprinet.com Registered office/Sitz der Gesellschaft: Bingen am Rhein Commercial register/Handelsregister: Amtsgericht Mainz HRB40380 CEO/Geschäftsführer: Simon Kissel _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
