Hi Pavel in kernel-bypass mode (zc) packet parsing happens in userspace anyway (inline in your processing thread), thus you can call pfring_parse_pkt() in your callback. If you want to spread load you should use multiple threads/processes with RSS or custom (software) distribution (zbalance_ipc)
Alfredo > On 21 Oct 2014, at 09:46, Pavel Odintsov <[email protected]> wrote: > > Hello, folks! > > I tried to use zc mode in my AntiDDoS toolkit > (https://github.com/FastVPSEestiOu/fastnetmon) and I use PF_RING > packets parser because it's very fast and reliable. > > I use PF_RING in old fashion way: > pfring_loop(pf_ring_descr, parse_packet_pf_ring, (u_char*)NULL, > wait_for_packet); > > When I enable zc mode (change from eth3 to zc:eth3) I see alŠ“ packets > but PF_RING's packet parser did not work totally. > > I found this in documentation: > pfring_open() flag: Disable packet parsing also when 1-copy is used. > (parsing already disabled in zero-copy) > > But I can't find any way to enable parser in ZC mode. Surely, I can > call parser manually: > pfring_parse_pkt((u_char*)p, (struct pfring_pkthdr*)h, 5, 0, 0); > > But this way is not ok because standard parser work in multiple > threads and correctly spread load for all cores but when I call > pfring_parse_pkt manually it's eat whole core. > > Could I enable PF_RING packet parser for ZC mode? > > -- > Sincerely yours, Pavel Odintsov > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
