PF_RING

1. PF_RING 安装

 

A clean install, no other packages were installed other than mentioned(提到).

 

1. Uninstall libpcap and other dependent applications/library using apt-get

原因?

 

2. Install subversion(Get latest source codes)

flex and bison(Required to recompile pf_ring aware pcap)

ethtool(if not preinstalled, required for some basic Nic info of your computer)

sudo apt-get install subversion flex bison ethtool

  

3. Use Subversion to fetch source codes

svn co https://svn.ntop.org/svn/ntop/trunk/PF_RING/ PF_RING

 

[卸载本机网卡驱动]

4. Check your current network card/driver using ethtool

 #change eth0 to your ethernet card
ethtool -i eth0

 

Sample:

driver: e1000e

version: 1.0.2-k2

firmware-version: 0.4-3

bus-info: 0000:00:19.0

 

Note: The modified device drivers for some of the popular network cards can be found in PF_RING/drivers.

 

5. Unload the ethernet card driver(this is shown in the first line of output of above command)

 

sudo rmmod e1000e

 

 

[编译安装kernel] 

6. Change current working directory to kernel

 

cd PF_RING/kernel

 

 

7. Make the source codes 

 

make

 

 

8. Now install the newly build source

 

sudo make install

 

 

[编译安装用户态库]

9. Change the working directory to PF_RING/userland/lib

cd ../userland/lib

 

10. Again build the source codes

make

 

11. Install the library(This include pfring.h)

sudo make install 

[注意] 在最新版本没有出现pfring_e1000e_dna.c和pfring_e1000e_dna.h这两个文件

12. One bizerre(奇异) thing  that I observed(观察) is that the make install copies pfring.h to /usr/local/include but leaves the other dependent files these are:

 1. pfring_e1000e_dna.c

 2. pfring_e1000e_dna.h

 

13. Although the function in these files are not required in much of the program, they are include in pfring.h and i don't want to mess up with that.So we copy this to /usr/local/include.

 

cp pfring_e1000e_dna.c /usr/local/include
cp pfring_e1000e_dna.h /usr/local/include

 

 

[编译安装PF_RING可用pcap库]

14. Now we have to compile PF_RING aware pcap library. Change the working directory to userland/libpcap-1.0.0-ring

 

cd ../libpcap-1.0.0-ring/

 

 

15. Configure

 

./configure

 

 

16. Build the sources

 

make

 

 

17. Install pf_ring aware(知道) libpcap

 

sudo make install

 

[安装PF_RING可用设备驱动, 选择适合本机的]

18. Now we need to install the device driver(pf_ring aware). Change the working directory to drivers///src

In my case it is "drivers/intel/e1000e-1.0.15/src"

 

cd ../../drivers/intel/e1000e-1.0.15/src

 

 

19. Build the source

 

make

 

 

20. Install the driver

 

sudo make install

 

[激活PF_RING使其加载到内核工作]

21. Now we need to activate PF_RING if its not already activated. You can use Ismod to check if pf_ring is started or not.

Change the working directory to /lib/modules//kernel/net/pf_ring

Use uname -r to get  the kernel version 

 

cd /lib/modules/2.6.31-14-generic/kernel/net/pf_ring

 

 

22. Enable PF_RING(if already enabled you can disable it using sudo rmmod pf_ring)

 

sudo insmod pf_ring.ko transparent_mode=1

 

 

Note:

   • transparent_mode=0 (default)

      Packets are received via the standard Linux interface. Any driver can use this mode.  

   • transparent_mode=1 (Both vanilla and PF_RING-aware drivers)

      Packets are memcpy() to PF_RING and also to the standard Linux path.

   • transparent_mode=2 (PF_RING -aware drivers only)

      Packets are ONLY memcpy() to PF_RING and not to the standard Linux path (i.e. tcpdump won't see

      anything).

The higher is the transparent_mode value, the faster it gets packet capture.

 

 

 

Other parameters:

   • min_num_slots

     Min number of ring slots (default — 4096).

   • enable_tx_capture

     Set to 1 to capture outgoing packets, set to 0 to disable capture outgoing packets (default — RX+TX).

   • enable_ip_defrag

     Set to 1 to enable IP defragmentation, only rx traffic is defragmented.

 

 

More on transparent mode can be found at http://www.ntop.org/blog/?p=56

 

[使驱动开始工作]

23. Now enable to enable your driver go to /lib/modules//kernel/drivers/net/e1000e

 

cd /lib/modules/2.6.31-14-generic/kernel/drivers/net/e1000e

 

 

24. Enable the driver

 

sudo insmod e1000e.ko

 

 

25. Now you can start working on your PF_RING application.

Note: You will have to recompile many applications such as tcpdump(modified included), network manager etc. Google for doing so.

 

2. PF_RING demo

概括来说PF_RING是即简单又有力量的技术，能够使开发者用在少量的时间里创建高速传输监控和应用。

 

Checking PF_RING Device Configuration

When PF_RING is activated, a new entry /proc/net/pf_ring is created.

 

cat /proc/net/pf_ring/info

 

cat /proc/net/pf_ring/plugins_info

 

 

libpfring and libpcap is necessary to link you PF_RING-enabled applications also against the -lpthread library.

 

 

 

使用相关命令来查看抓包情况（userland/examples）

 

dmesg或/var/log/messages可以看到PF_RING的信息