I read diff between 6.0.3 and current SVN and do not found any changes in parser :( Can you help me?
On Wed, Dec 10, 2014 at 6:37 PM, Pavel Odintsov <[email protected]> wrote: > Hello! > > I tried to do manual parsing and it failed with very strange results. > I tried do manual parser with vanilla PF_RING and it work perfectly. > But when I move to zc:eth4 everything goes weird. > > You can look at code example here: > https://github.com/FastVPSEestiOu/fastnetmon/blob/master/pfring_parser_zc_issue.c > > Here you can find examples of broken packets generated in ZC mode: > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=2697283473][tos=0][tcp_seq_num=0] > [caplen=101][len=101][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=2427859156][tos=0][tcp_seq_num=0] > [caplen=128][len=1494][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=785972458][tos=0][tcp_seq_num=0] > [caplen=128][len=899][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=235012324][tos=0][tcp_seq_num=0] > [caplen=128][len=1514][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=235012324][tos=0][tcp_seq_num=0] > [caplen=128][len=1514][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=2452494655][tos=0][tcp_seq_num=0] > [caplen=128][len=669][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=3004425024][tos=0][tcp_seq_num=0] > [caplen=62][len=62][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=1947699452][tos=0][tcp_seq_num=0] > [caplen=82][len=82][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=4270253576][tos=0][tcp_seq_num=0] > [caplen=128][len=214][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [IPv4][5.45.121.206:0 -> > 71.237.183.84:0] [l3_proto=TCP][hash=2404904871][tos=0][tcp_seq_num=0] > [caplen=74][len=74][parsed_header_len=0][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=0] > > > When I remove zc prefix everything goes OK: > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [vlan 100] > [IPv4][46.36.217.163:60425 -> 66.212.227.177:80] > [l3_proto=TCP][hash=1895475635][tos=0][tcp_seq_num=3109618290] > [caplen=74][len=74][parsed_header_len=0][eth_offset=-14][l3_offset=18][l4_offset=38][payload_offset=70] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [vlan 100] > [IPv4][185.4.74.46:80 -> 79.104.202.167:29676] > [l3_proto=TCP][hash=141396247][tos=0][tcp_seq_num=2414040755] > [caplen=128][len=1422][parsed_header_len=0][eth_offset=-14][l3_offset=18][l4_offset=38][payload_offset=58] > [90:E2:BA:49:85:C8 -> 00:19:E2:B1:EF:C1] [vlan 103] > [IPv4][5.45.125.197:80 -> 94.19.227.237:19226] > [l3_proto=TCP][hash=1665248546][tos=0][tcp_seq_num=3106769437] > [caplen=128][len=1322][parsed_header_len=0][eth_offset=-14][l3_offset=18][l4_offset=38][payload_offset=58] > [00:19:E2:B1:EF:C1 -> 90:E2:BA:49:85:C8] [IPv4][188.123.252.42:54821 > -> 5.45.117.243:80] > [l3_proto=TCP][hash=3249162392][tos=0][tcp_seq_num=3384753169] > [caplen=64][len=64][parsed_header_len=0][eth_offset=-14][l3_offset=14][l4_offset=34][payload_offset=54] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [vlan 100] > [IPv4][159.253.23.8:443 -> 93.80.68.118:52364] > [l3_proto=TCP][hash=4249758155][tos=0][tcp_seq_num=4188560676] > [caplen=128][len=320][parsed_header_len=0][eth_offset=-14][l3_offset=18][l4_offset=38][payload_offset=58] > [5C:5E:AB:24:0F:C0 -> 90:E2:BA:49:85:C8] [IPv4][54.231.136.26:80 -> > 159.253.18.81:36360] > [l3_proto=TCP][hash=3605342409][tos=0][tcp_seq_num=2042671898] > [caplen=64][len=64][parsed_header_len=0][eth_offset=-14][l3_offset=14][l4_offset=34][payload_offset=54] > [90:E2:BA:49:85:C8 -> 5C:5E:AB:24:0F:C0] [vlan 100] > [IPv4][159.253.20.133:80 -> 178.18.208.229:41361] > [l3_proto=TCP][hash=1376814929][tos=0][tcp_seq_num=1451307525] > [caplen=128][len=1522][parsed_header_len=0][eth_offset=-14][l3_offset=18][l4_offset=38][payload_offset=58] > > Could you help me? > > Thank you! > > On Tue, Oct 21, 2014 at 12:20 PM, Pavel Odintsov > <[email protected]> wrote: >> Thank you for fast and useful answer! :) >> >> On Tue, Oct 21, 2014 at 12:14 PM, Alfredo Cardigliano >> <[email protected]> wrote: >>> No, with standard drivers it uses kernel threads (ksoftirq) >>> >>> Alfredo >>> >>>> On 21 Oct 2014, at 10:00, Pavel Odintsov <[email protected]> wrote: >>>> >>>> Hello! >>>> >>>> Yep, I can run it in my tool but standard parser with no-zc mode >>>> spread for all cores. It uses additional threads inside pf_ring? >>>> _______________________________________________ >>>> Ntop-misc mailing list >>>> [email protected] >>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> >> >> >> -- >> Sincerely yours, Pavel Odintsov > > > > -- > Sincerely yours, Pavel Odintsov -- Sincerely yours, Pavel Odintsov _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
