Test mode for pfbridge and zbouce applications

[Serjinyo]

Hello. Tell me if it is possible to test (without a license) applications pfbridge and zbounce (pfring ZC) ?

I get a message about the absence of a license, apparently because two network interfaces are used.

[cardigliano]

It should work in demo mode

[Serjinyo]

I get this result

root@debian:/home/user/PF_RING/userland/examples# ./pfbridge -a zc:enp3s0f1 -b zc:enp3s0f0 -v -p #########################################################################

ERROR: You do not seem to have a valid PF_RING ZC 8.8.0.250320

license for enp3s0f1 (MAC 00:26:55:DC:48:0C) [Intel 1 Gbit e1000e family]

ERROR: Missing license file

ERROR: Please get one at http://shop.ntop.org/

#########################################################################

PF_RING ZC running in demo mode (packet capture and transmission

limited to 5 minutes)

######################################################################### #########################################################################

ERROR: You do not seem to have a valid PF_RING ZC 8.8.0.250320

license for enp3s0f0 (MAC 00:26:55:DC:48:0D) [Intel 1 Gbit e1000e family]

ERROR: Missing license file

ERROR: Please get one at http://shop.ntop.org/

######################################################################### Killed

[cardigliano]

Please note the application is stopping not because of the license, but because it gets "Killed". This usually happens on some modern systems when IOMMU is enabled. Please read https://www.ntop.org/guides/pf_ring/intel.html

[Serjinyo]

Hello. According to your recommendations, I have made the following changes /etc/default/grub GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=off" GRUB_CMDLINE_LINUX="intel_iommu=off" and updated grub

But the problem is not solved. However, some applications are executed: ./zcount -i zc:enp3s0f0

some don't: ./zbounce -i zc:enp3s0f0 -o zc:enp3s0f1 Killed

Is there a way to test the settings?

[cardigliano]

Are you able to run pfcount on both zc:enp3s0f0 and zc:enp3s0f1, and see the packet metadata (ip/port/etc) ?

• pfcount -i zc:enp3s0f0 -v 1
• pfcount -i zc:enp3s0f1 -v 1

[Serjinyo]

Hello. I provide the output of the commands

pfcount -i zc:enp3s0f0 -v 1 #########################################################################

ERROR: You do not seem to have a valid PF_RING ZC 8.8.0.250320

license for enp3s0f0 (MAC 00:26:55:DC:48:0D) [Intel 1 Gbit e1000e family]

ERROR: Missing license file

ERROR: Please get one at http://shop.ntop.org/

#########################################################################

PF_RING ZC running in demo mode (packet capture and transmission

limited to 5 minutes)

######################################################################### Using PF_RING v.8.8.0.250320 kernel module v.8.8.0 Dumping statistics on /proc/net/pf_ring/stats/13644-enp3s0f0.8 Capturing from zc:enp3s0f0 [mac: 00:26:55:DC:48:0D][if_index: 8][speed: 1000Mb/s]

Device RX channels: 1

Polling threads: 1

14:27:03.193533957 [RX][if_index=8][hash=1291569283][3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][140.82.121.4:443 -> 192.168.100.100:59738] [l3_proto=TCP][hash=1291569283][tos=0][tcp_seq_num=2847270136] [caplen=105][len=105][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=66] ........................................................ ........................................................ ^CLeaving...

Absolute Stats: [17 pkts total][0 pkts dropped][0.0% dropped] [17 pkts rcvd][1'791 bytes rcvd]

pfcount -i zc:enp3s0f1 -v 1 #########################################################################

ERROR: You do not seem to have a valid PF_RING ZC 8.8.0.250320

license for enp3s0f1 (MAC 00:26:55:DC:48:0C) [Intel 1 Gbit e1000e family]

ERROR: Missing license file

ERROR: Please get one at http://shop.ntop.org/

#########################################################################

PF_RING ZC running in demo mode (packet capture and transmission

limited to 5 minutes)

######################################################################### Using PF_RING v.8.8.0.250320 kernel module v.8.8.0 Dumping statistics on /proc/net/pf_ring/stats/14012-enp3s0f1.10 Capturing from zc:enp3s0f1 [mac: 00:26:55:DC:48:0C][if_index: 9][speed: 0Mb/s]

Device RX channels: 1

Polling threads: 1

14:31:21.880428847 [RX][if_index=9][hash=1336138155][3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][142.250.203.196:443 -> 192.168.100.100:42946] [l3_proto=TCP][hash=1336138155][tos=0][tcp_seq_num=4117655306] [caplen=139][len=139][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=66] .................................................... 14:31:31.077772800 [RX][if_index=9][hash=1336138155][3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][142.250.203.196:443 -> 192.168.100.100:42946] [l3_proto=TCP][hash=1336138155][tos=0][tcp_seq_num=4117655306] [caplen=139][len=139][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=66] ^CLeaving...

Absolute Stats: [32 pkts total][0 pkts dropped][0.0% dropped] [32 pkts rcvd][4'846 bytes rcvd]

Thank you

[cardigliano]

Ok great. Could you try the same with zcount?

[Serjinyo]

I am sending the result

zcount -i zc:enp3s0f0 -v 1 #########################################################################

ERROR: You do not seem to have a valid PF_RING ZC 8.8.0.250320

license for enp3s0f0 (MAC 00:26:55:DC:48:0D) [Intel 1 Gbit e1000e family]

ERROR: Missing license file

ERROR: Please get one at http://shop.ntop.org/

#########################################################################

PF_RING ZC running in demo mode (packet capture and transmission

limited to 5 minutes)

######################################################################### [1744640001.455008291] [hash=4CFB934E] [3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][140.82.112.25:443 -> 192.168.100.100:48400] [l3_proto=TCP][hash=1291555662][tos=0][tcp_seq_num=1800623458] [caplen=107][len=107][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=66][1744640002.297040148] [hash=4CFB934E] [3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][140.82.112.25:443 -> 192.168.100.100:48400] [l3_proto=TCP][hash=1291555662][tos=0][tcp_seq_num=1800623458] [caplen=107][len=107][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=66][1744640003.983296466] [hash=4CFB934E] [3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][140.82.112.25:443 -> 192.168.100.100:48400] [l3_proto=TCP][hash=1291555662][tos=0][tcp_seq_num=1800623458] [caplen=107][len=107][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=66][1744640007.433182875] [hash=4CFB934E] [3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][140.82.112.25:443 -> 192.168.100.100:48400] [l3_proto=TCP][hash=1291555662][tos=0][tcp_seq_num=1800623458] [c^CLeaving...

Absolute Stats: 5 pkts (0 drops) - 638 bytes

root@debian:/home/alex/PF_RING/drivers/intel/e1000e/e1000e-3.8.7-zc/src# zcount -i zc:enp3s0f1 -v 1 #########################################################################

ERROR: You do not seem to have a valid PF_RING ZC 8.8.0.250320

license for enp3s0f1 (MAC 00:26:55:DC:48:0C) [Intel 1 Gbit e1000e family]

ERROR: Missing license file

ERROR: Please get one at http://shop.ntop.org/

#########################################################################

PF_RING ZC running in demo mode (packet capture and transmission

limited to 5 minutes)

######################################################################### [1744640212.433570739] [hash=7325C707] [3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][178.124.129.18:443 -> 192.168.100.100:57296] [l3_proto=TCP][hash=1931855623][tos=0][tcp_seq_num=3032757194] [caplen=78][len=78][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=54][1744640212.632448457] [hash=1E26B0E6] [3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][93.125.105.193:443 -> 192.168.100.100:57600] [l3_proto=TCP][hash=505852134][tos=0][tcp_seq_num=850117066] [caplen=90][len=90][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=66][1744640212.633353290] [hash=1E26B0E6] [3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][hash=1E26B0E6] [3C:CD:5D:29:91:38 -> 00:26:55:DC:48:0D] [IPv4][93.125.105.193:443 -> 192.168.100.100:57600] [l3_proto=TCP][hash=505852134][tos=0][tcp_seq_num=850117066] [caplen=90][len=90][eth_offset=0][l3_offset=14][l4_offset=34][payload_offset=6^CLeaving...

Absolute Stats: 16 pkts (0 drops) - 1'722 bytes

[cardigliano]

And still getting Killed with zbounce on the same interfaces?

[Serjinyo]

That's the problem. Examples using one interface work (pfcount, zcount, ftflow), but examples using two interfaces don't work (pfbridge, zbounce).

As I understand it, the presence of interface settings doesn't matter (IP addresses, gateway)?

./zbounce -i zc:enp3s0f0 -o zc:enp3s0f1 #########################################################################

ERROR: You do not seem to have a valid PF_RING ZC 8.8.0.250320

license for enp3s0f0 (MAC 00:26:55:DC:48:0D) [Intel 1 Gbit e1000e family]

ERROR: Missing license file

ERROR: Please get one at http://shop.ntop.org/

#########################################################################

PF_RING ZC running in demo mode (packet capture and transmission

limited to 5 minutes)

######################################################################### #########################################################################

ERROR: You do not seem to have a valid PF_RING ZC 8.8.0.250320

license for enp3s0f1 (MAC 00:26:55:DC:48:0C) [Intel 1 Gbit e1000e family]

ERROR: Missing license file

ERROR: Please get one at http://shop.ntop.org/

######################################################################### Killed

PF_RING/package/usr/bin/pf_ringcfg --list-interfaces Name: enp0s31f6 Driver: RSS: 1 [Running ZC]
Name: enp3s0f0 Driver: RSS: 1 [Running ZC]
Name: enp3s0f1 Driver: RSS: 1 [Running ZC]
Name: enp4s0f0 Driver: RSS: 1 [Running ZC]
Name: enp4s0f1 Driver: RSS: 1 [Running ZC]

[cardigliano]

@Serjinyo any chance I can ssh to this system and take a look? Drop me an email in case (cardigliano at ntop.org)

[Serjinyo]

Hello. I wrote to you by email.

Thank you.