Luca That's exactly what surprises me: the application is the same on both machines.
I'm using libpcap with pfring enabled. When the application starts, it opens a pcap_handle: cap_handle = pcap_open_live(card, 1514, 0, 1000, error); This is done only once for each interface I want to capture, at application startup. As far as I know, via application log, the application has not been stopped, so I was expecting to see the application initializing only one pf_ring per capture interface. The files on /proc/net/pf_ring seems OK, one ***-eth*.* file for each ring opened. These files remain the same while the application is running. The packet count registers work properly. Also, the /proc/net/pf_ring/info file reports the number of interfaces the application initialized. Another strange thing is that I'm getting messages from interfaces the application is not opening, such as: May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ 3475-tun0.278845 tun0 is a virtual interface used for ssh tunneling (VPN). The application is not opening this application for capture. Which system resources could be causing this, exept my application? Any ideas? Em Ter, 2009-05-12 às 22:58 +0200, Luca Deri escreveu: > Paulo > it looks to me that your application is constantly (why?) opening and > closing PF_RING sockets. If its intention is to poll for new network > interfaces, well this is not the best way of doing it. > > Cheers Luca > > On May 12, 2009, at 9:44 PM, Paulo centeno wrote: > > > Hello > > > > I was watching the /var/log/kern.log file on a PF_RING patched > > Debian system . > > > > Every few seconds, it writes a line like these below, allocating and > > removing the rings. > > > > May 12 16:34:32 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:34:32 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-lo.278839 > > > > On another machine, it only writes such lines when I start a libpcap > > application, removing it when I stop the application. > > > > The following lines are a small piece of the whole kernel.log file. > > The file is thousands of lines long. > > > > Is this behaviour correct? > > > > May 12 16:34:32 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:34:32 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-lo.278839 > > May 12 16:34:32 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:34:32 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-eth2.278840 > > May 12 16:34:32 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:34:32 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-eth1.278841 > > May 12 16:34:32 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:34:32 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-eth3.278842 > > May 12 16:34:32 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:34:32 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-eth4.278843 > > May 12 16:34:32 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:34:32 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-eth0.278844 > > May 12 16:34:32 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:34:32 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-tun0.278845 > > May 12 16:34:32 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475.0 > > May 12 16:35:47 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:35:47 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > May 12 16:35:47 myhost kernel: [PF_RING] removed /proc/net/pf_ring/ > > 3475-lo.278846 > > May 12 16:35:47 myhost kernel: [PF_RING] successfully allocated > > 569344 bytes at 0xfab70000 > > May 12 16:35:47 myhost kernel: [PF_RING] allocated 4125 slots > > [slot_len=138][tot_mem=569344] > > > > -- > > Atenciosamente, > > > > Paulo Centeno > > Desenvolvimento > > AGM Telecom > > _______________________________________________ > > Ntop-misc mailing list > > [email protected] > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc -- Atenciosamente, Paulo Centeno Desenvolvimento AGM Telecom _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
