PF_RING
PF_RING copied to clipboard
ntop
Driver dkms failure on kernel update
Interfaces with active pf_ring are not present anymore.
> uname -r
6.8.0-53-generic
> lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 24.04.1 LTS
Release: 24.04
Codename: noble
> dpkg -l | grep pf_ring
ii e1000e-zc-dkms 3.8.7.9712 all e1000e-zc driver in DKMS format (http://www.ntop.org/pf_ring/).
ii i40e-zc-dkms 2.24.6.9712 all i40e-zc driver in DKMS format (http://www.ntop.org/pf_ring/).
ii ice-zc-dkms 1.12.7.9712 all ice-zc driver in DKMS format (http://www.ntop.org/pf_ring/).
ii igb-zc-dkms 5.14.16.9712 all igb-zc driver in DKMS format (http://www.ntop.org/pf_ring/).
ii ixgbe-zc-dkms 5.19.6.9712 all ixgbe-zc driver in DKMS format (http://www.ntop.org/pf_ring/).
ii pfring 8.8.0-9712 amd64 PF_RING (http://www.ntop.org/pf_ring/) [8.8.0-stable:a5a5068b239e2f5ee1c9e759b94d7f1c937adc8c]
ii pfring-drivers-zc-dkms 8.8.0-9712 all Virtual package for ZC drivers in DKMS format (http://www.ntop.org/pf_ring/).
> dmesg -h
...
[ +0,001719] [PF_RING] Welcome to PF_RING 8.8.0 ($Revision: 8.8.0-stable:a5a5068b239e2f5ee1c9e759b94d7f1c937adc8c$)
(C) 2004-24 ntop
[ +0,000006] LINUX_VERSION_CODE 0006080C
[ +0,000003] [PF_RING] Min # ring slots 65536
[ +0,000003] [PF_RING] Slot version 21
[ +0,000002] [PF_RING] Capture TX Yes [RX+TX]
[ +0,000002] [PF_RING] IP Defragment No
[ +0,000014] NET: Registered PF_IB protocol family
[ +0,000631] [PF_RING] pf_ring initialized correctly
[ +0,047677] gnss: GNSS driver registered with major 236
[ +0,040491] i40e 0000:3b:00.1: i40e_ptp_stop: removed PHC on enp59s0f1np1
[ +0,179947] loop0: detected capacity change from 0 to 8
[ +0,388650] i40e 0000:3b:00.0: i40e_ptp_stop: removed PHC on enp59s0f0np0
[ +0,403287] i40e 0000:19:00.1: i40e_ptp_stop: removed PHC on eno2np1
[ +0,342696] igb 0000:01:00.1 eno4: igb: eno4 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
[ +0,050073] i40e 0000:19:00.0: i40e_ptp_stop: removed PHC on eno1np0
[ +0,439414] i40e_zc: disagrees about version of symbol module_layout
[Feb11 15:05] systemd-journald[915]: /var/log/journal/f6b79c3bee624e8e99b5df1396ce12c1/user-1001.journal: Journal file uses a different sequence number ID, rotating.
[ +3,383914] kauditd_printk_skb: 117 callbacks suppressed
[ +0,000007] audit: type=1400 audit(1739282710.911:129): apparmor="DENIED" operation="open" class="file" profile="ubuntu_pro_esm_cache_systemd_detect_virt" name="/sys/firmware/dmi/e>
[ +0,961478] i40e_zc: disagrees about version of symbol pf_ring_zc_dev_handler
[ +0,000006] i40e_zc: Unknown symbol pf_ring_zc_dev_handler (err -22)
[ +4,694136] [qede_link_update:2629(enp94s0f1)]Link is up
[ +0,344352] [qede_link_update:2629(enp216s0f0)]Link is up
[ +0,330288] [qede_link_update:2629(enp216s0f1)]Link is up
[ +1,791660] igb 0000:01:00.0 eth0: igb: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
...
Something went wrong recompiling the dkms modules. Please 1. remove the packages, 2. reboot the machine to the latest kernel, 3. reinstall the drivers
Deleting, restarting and then reinstalling has helped. How do I ensure that a kernel update does not ‘break’ pf_ring?
dkms should automatically recompile the kernel modules when updating the kernel, however if the kernel update is installed, but the kernel is not activated with a reboot, under some circumstances the makefile picks the wrong symbol creating this issue. We will dig more to check when this happens and try to avoid that.