Mailing List Archive by Gossamer Threads http://www.gossamer-threads.com/lists/ntop/misc/ en-us (c) Gossamer Threads Inc. All rights reserved. 12 Feb 2012 11:34:40 -0800 120 75 23 http://www.gossamer-threads.com/lists/ntop/misc/ http://www.gossamer-threads.com/images/lists/rss_logo.jpg Hi. I can't get two simultaneous daemons to listen on the same interface. After reading it seems like this is usually due to quick_mode being enabled 10 Feb 2012 12:38:15 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28461 Luca, I noticed that in sessions.c the "#ifdef DEBUG" lines that surround the scanIdleTimedoutSessions message have been commented out, was wonder 10 Feb 2012 10:58:13 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28460 Hi Luca, I am aware you don't have Broadcom NICs, but I was just wondering if some of you had ever encountered this kind of errors: 'struct net_devi 09 Feb 2012 03:16:45 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28455 Hello, I've tried to compile the same problems that other person had earlier with bnx2 driver provided by pf_ring, as per: http://listgateway.unipi.i 09 Feb 2012 02:00:42 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28451 Hello, I got the following kernel oops panic condition while running urlsnarf and tshark. Both of them has the same error. I have no error with tcpdu 08 Feb 2012 07:49:35 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28447 hi, I'm trying to use nprobe/ntop as a netflow collector/analyser. I've followed this simple howto: http://www.ntop.org/nprobe/using-ntop-as-a-flow-c 08 Feb 2012 04:43:10 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28446 Just got another one that I thought you all might want to see and ponder on: Feb 6 18:51:39 ring ntop[21554]: **ERROR** Buffer too short @ session 06 Feb 2012 17:00:59 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28439 Installed NTop from svn on Feb 2: "Welcome to ntop v.4.1.2 (64 bit) [Configured on Feb 2 2012 13:28:28, built on Feb 2 2012 13:30:33]" Worked fine 06 Feb 2012 16:54:39 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28438 Dear All, I would like to capture 128 bits of my packets via pfring. I saw this structure struct pkt_parsing_info but I already used most 05 Feb 2012 19:35:53 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28435 hi you know,  i receive error when i try to compile the nprobe and its plugins source files. I think the package's been written seperately by differe 05 Feb 2012 12:57:23 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28434 Hi all, I remember there was some kind of bloom filtering capability included in pf_ring but seems it has been removed. May I ask why it was 01 Feb 2012 04:54:27 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28405 Dear Sir/Madam I have just run nprobe on my system. without any options. Here's a sample output: bash-3.1# nprobe 30/Jan/2012 20:38:00 [nprobe.c:258 30 Jan 2012 08:13:57 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28399 Hi Luca, I am using the following config pfRing (on my linux version 2.6.18-194.17.1.el5) [root@localhost ~]# cat /proc/net/pf_ring/info PF_RIN 29 Jan 2012 19:20:23 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28395 Fresh install + updates of Fedora 16. e1000 PF_Ring Aware driver: make: make -C /lib/modules/3.1.9-1.fc16.i686/build SUBDIRS=/root/PF_RING/drivers/P 27 Jan 2012 21:10:47 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28388 Has anyone successfully compiled and used the current svn build (5133) with CentOS 6.2 ? When I attempt the /PF_RING/kernel/make, I get : make -C /l 26 Jan 2012 16:48:43 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28379 Hi Luca: I have a small question about your paper "Beyond Device Polling": *In the last month the real-time patch issue has been solved using an 18 Jan 2012 19:17:54 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28348 17 Jan 2012 17:18:59 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28342 Luca, Here is the patch file. Found disagreements between unsigned short and unsigned integers. The unsigned short as a 65535 limit, thus where th 17 Jan 2012 05:23:04 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28331 Hi Luca: I'm using PF_ring to capture packets, so I have to choose using "active waiting", or "passively waiting". My understanding is active waiting 16 Jan 2012 11:48:40 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28323 Luca, I noticed you changed my u_int back to int in prefs.c. I had to change this because I could not get the max sessions, max hash above 65535. 16 Jan 2012 05:09:01 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28314 Hi, I'm running into an issue after configuring nProbe with an unprivileged user. I was able to run autogen.sh without issue but running make runs in 09 Jan 2012 12:06:53 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28273 Hi, I experienced a sudden nprobe CPU raise (from less than 20% to 95%). At about the time this happened, I found this (and only this....) message in 06 Jan 2012 02:54:57 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28265 Hi Luca: I have a problem about multiple PF-ring working on one machine together, so would there be a severe racing between different rings£¿£¿ Since 30 Dec 2011 09:17:42 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28253 Hello, How can I get data through PF_RING using hash filtering to a virtual interface (tun/tap devices) without having to open this interface and re 29 Dec 2011 16:25:47 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28252 Je suis absent(e) du bureau jusqu'au 02/01/2012 I am currently out of office with limited access to e-mail. I will be back on January, 2nd. For urg 28 Dec 2011 07:03:42 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28249 Luca, I have e-mailed you some patches that have corrected some issues for me, and I have not had a segfault with these patches implemented in over a 28 Dec 2011 05:53:25 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28248 Hi everyone, I just installed the more recent (demo) version of PF_RING DNA driver for ixgbe, in order to make stress tests on a new router platform. 15 Dec 2011 03:00:43 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28206 I'm using pf_ring with a Silicom NIC and am having a problem with pfring_send. Sometimes, I get into a situation where all attempts to call pfring_se 12 Dec 2011 12:47:27 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28194 Luca, Looks like I made it two days before a segfault occurred, here is the logs: Dec 8 13:14:59 probe ntop[856]: THREADMGMT[t140664941140320]: 12 Dec 2011 04:19:39 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28192 Hi I am using nprobe in version 6.5.0_052311_pro tying to analyse ICMPv6 traffic. But can't explain to myself how icmpv6 flags and types are generate 10 Dec 2011 03:57:09 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28187 Luca, Just tried to get SSL going, and the server starts it, but when you go to access the site, it instantly segfaults out. I just tried a test 08 Dec 2011 06:57:12 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28180 Hello, I wonder if there is a way to add a custom PF_RING extended packet header with field that can be filled by a PF_Ring plugin. Yann 07 Dec 2011 06:49:42 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28178 Dear mailing lists, I have the follow problem: all my netflow traffic are discarted because: "Flows with Zero Byte Count" somebody knows the reason? 07 Dec 2011 02:02:27 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28176 Luca, I am not sure what quite has happened. But the segfaults have returned. IE: Dec 3 13:13:43 probe ntop[882]: **ERROR** Buffer too short @ r 05 Dec 2011 04:50:59 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28170 I have a couple of non-Silicom Intel 82599 chipset cards and trying to send using DNA over one and receive using TNAPIv2. I am using PF_RING_5.1.0 f 24 Nov 2011 07:11:43 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28113 Dear Luca, I saw in the documentation and also in the pfcount sample the dummyProcessPacket function regarding this const struct pfring 24 Nov 2011 01:04:11 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28110 Dear All, I recently upgrade PF_RING from 5.1.0 to 5.2.0 stable. Everything in the new version seems to be fine but rss rehash cannot be enabled. pfr 23 Nov 2011 20:04:37 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28108 Why is there a dummy pthread_setaffinity_np() in userland/lib/pfring_utils.c? I have (and use) pthread_setaffinity_np(), yet these dummy routines are 21 Nov 2011 10:55:47 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28086 If not installed in the system library "opendpi" should be added to this nprobe.c: [root @ probe-v2 ~] # diff nprobe_6.6.5_110111.1/nprobe.c nprobe 21 Nov 2011 04:17:39 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28079 I am using PF_RING aware ixgbe ( simple "insmod ixgbe.ko" ) on a Dell server(8 core CPU ) for Tx and TNAPIv2 enabled ixgbe on the Rx interface on a HP 19 Nov 2011 05:16:26 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28057 Any idea when the ixgbe-3.6.7 module with FlowDirector will be done? I'd really like the ability to filter flows in hardware using PF_RING 5.1.0. Th 15 Nov 2011 06:53:37 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28033 Hi all, I am considering to use pfring with tnapi on my project, in which I process high amounts of traffic (around 1gbps or 900kpps). The problem 14 Nov 2011 13:06:08 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28020 We got a license for ixgbe with TNAPIv2 and built the PF_RING 5.1.0 kernel module and userland apps ( acquired using svn co ) and ixgbe ok on Debian. 14 Nov 2011 10:43:16 -0800 http://www.gossamer-threads.com/lists/ntop/misc/28018 Hey all, We've recently started to try out probe/ntop for netflow monitoring and we're using the demo version until we've set them both up in an acc 10 Nov 2011 05:50:08 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27970 It’s working fine now. Libpcap and/or pf_ring on the machine where it was compiled was different than the one where it runs... Stupid mistake. Sorr 10 Nov 2011 03:24:57 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27969 Je suis absent(e) du bureau jusqu'au 14/11/2011 I am currently out of office with limited access to e-mail. I will be back on November, 14th. For u 09 Nov 2011 23:11:06 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27967 Dear All, I am a newbie and starting to build a small monitoring application. So what are the libraries that I must minimally include for 09 Nov 2011 17:46:50 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27966 Hello all,I was successful at getting PF_RING enabled for my 82599 Intel card, but i'm having some difficulty getting the hardware filtering enabled. 09 Nov 2011 10:39:12 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27961 Dear All, I am a newbie to PF_RING. So I have tested the ./pfcount it works fine. I am going to start my own codes. I tried to compile usin 09 Nov 2011 06:17:11 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27958 Hi, I have program that works fine with normal libpcap. When using the libpcap.a compiled with pf_ring 5.0 support, I get this error: Warning: Kerne 09 Nov 2011 01:33:19 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27950 Hello, I installed fresh copies of - PF_RING 5.0 - nprobe_6.6.3_091011_proplugins - Using DNA driver o PF_RING/drive 08 Nov 2011 21:06:11 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27946 Additional information as of today... Correct me if I am wrong here, but it appears that the host pointers are stored in the Sessions (mutex???). 08 Nov 2011 12:21:27 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27943 Dear All, I am very new to pf_ring. So I could run ./pfcount and ./pcount as this method. So now I copied pfcount and saved as pftry1. I tr 07 Nov 2011 10:04:37 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27927 Hi Luca: I'm curious about the relation between the capture speed and the CPU usage, is there any resource about the relation, or is always 100% CPU u 06 Nov 2011 18:52:02 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27919 Hello, I have been working for days trying to resolve a segfault issue like the following: Nov 4 10:46:54 NTOP-SC kernel: ntop[25479]: segfault at 04 Nov 2011 09:09:44 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27902 Thanks Luca for the driver update! However, I've been looking at the hardware filtering options and found that my card isn't being recognised as supp 03 Nov 2011 11:29:45 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27895 Hello, Is there a difference between buffer given by libpcap and by libpfring directly ? Are they the same order? Yann 03 Nov 2011 03:56:02 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27892 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In debugging configure time problems with the new version of bro, I discovered a change in the Makefile 02 Nov 2011 19:15:16 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27888 Hi all! I tried to build PF_RING with PF_RING aware ixgbe driver on Ubuntu-11.04 server edition. (3.0.0-12 kernel version) PF_RING itselfs build wi 02 Nov 2011 08:22:24 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27880 Je suis absent(e) du bureau jusqu'au 02/11/2011 I am currently out of office with limited access to e-mail. I will be back on November, 3rd. For ur 31 Oct 2011 14:03:04 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27869 I'm having problems getting pfcount to work. I have two machines connected back-to-back: (A) has a Silicom NIC ; and (B) has a NetEffect 10GbE NIC. 31 Oct 2011 13:21:22 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27868 Hi! i'm triying to use nprobe with mysql. My problem is about the type of the field ipv4_src/dst which is in int, and i need it in format ip (x.y.w.z) 26 Oct 2011 00:44:26 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27846 Hi, I started dumping flow data as well as sending it to ntop as a way to have a fully reliable record of everything in case of network problems and 24 Oct 2011 08:27:41 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27838 Hi, I've just got a couple of Intel X520-DA2 (82599) cards and find that with the PF_RING ixgbe non-DNA driver I get > [267600.170125] Intel(R) 10 G 24 Oct 2011 04:08:20 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27837 Hi, Does anyone know how to set an 82576 multiqued NIC to loadbalance across it's Rx Ques? By default ours favors one que. Thanks, PK 19 Oct 2011 22:34:05 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27798 All, I have pfring version 4.7.0 installed (transparent_mode=1 quick_mode=1) and I'm running pfcount with default options on a Intel Dual Core 1.866 19 Oct 2011 09:18:01 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27784 Hi, i'm trying to compile tcpdump with libpcap-pfring. The libpcap compilation went fine. With tcpdump compilation i get this error: gcc -O2 -DHAVE 18 Oct 2011 06:13:28 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27762 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When attempting to modify the interface MTU for an ixgbe-3.3.9-TNAPI/pf_ring 5.1 I received the followi 15 Oct 2011 20:27:52 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27753 Hi, I am developing an application (a distributed cache server) that will be using UDP protocol to send/receive many small packets at high rate and I 15 Oct 2011 20:26:01 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27752 I'm using ixgbe ports via DNA with pf_ring 5.1.0. My code uses pfring_recv() to receive packets from one ring, then uses pfring_send() to transmit the 14 Oct 2011 12:02:22 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27746 Luca or others, I am currently using nprobe to capture v9 NetFlows from a cisco 6509 and then write the flows into a MySQL database table. Nprobe rece 14 Oct 2011 06:16:48 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27741 Dear all, I am trying to install nprobe 6.0.3 on Centos platform (kernel 2.6.32-71.el6.x86_64). I successfully installed pf_ring and DNA driver for 12 Oct 2011 14:00:41 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27731 I was just wondering if anyone has gotten IPTraf or Trafshow to compile with the pf_ring libs. These are two apps that I haven't been able to get work 10 Oct 2011 19:18:35 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27719 Hi Guys, Has anyone ever seen errors such as this when booting linux after pf_ring has been installed? pci 0000:04:00.0 BAR 1: no parent found for 10 Oct 2011 09:26:10 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27715 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all... Apologies for this being a bit of a cross mailing-list problem - if the trouble doesn't 06 Oct 2011 06:36:06 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27696 [PF_RING] Welcome to PF_RING 5.1.0 ($Revision: 4900$) After running pfsend I received next situation: root@qqq# ./pfsend -i dna1 -l 100 06 Oct 2011 00:30:10 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27693 I'm trying to install PF_RING on Debian 6 to use it with Snort. I've followed many guides and posts but I wasn't able to load it properly. Installatio 04 Oct 2011 05:06:56 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27678 I'd like to enable BPF filtering for PF_RING but don't see how to do that in the manual. _______________________________________________ Ntop-misc mai 03 Oct 2011 15:58:48 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27671 Hello all, I have almost everything set up now. I spent all morning recompiling all my network monitoring tools to use pf_ring and the pf_ring libpca 28 Sep 2011 14:21:38 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27636 Deall all, I am seeing that the flowset count value is being set incorrectly in -V 9 header information. The collector show value as 513 instead of 1 28 Sep 2011 14:04:46 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27634 Hi, this is good idea to install PF_RING + driver to the card network from PF_RING, on router with ipstables, ipset, conntrack and shaping? This brin 28 Sep 2011 03:44:13 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27631 Hello all, I'm was just curious to why the tcpdump application that comes with PF_RING has a maximum snap-length of 8192 bytes. Can this be changed? 27 Sep 2011 19:08:57 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27627 Hi Luca, this is our system setup: * RedHatEnterpriseLinux 6.1 * Kernel 2.6.38.8 * libnl-devel installed * libpcap-1.1.1-ring * PF_RING 5. 26 Sep 2011 03:33:52 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27619 Hi - I am looking at the nprobe source trying to understand if/how ipfix bidirectional flow data is exported. As far as I can tell, I noticed that I 23 Sep 2011 12:29:47 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27607 Hello all, I've spent many hours this morning trying to get the tcpdump application that is included with the PF_RING source to use PF_RING. I've rea 22 Sep 2011 08:06:06 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27583 Hello, I'm trying to compile and install the PF_RING from SVN revision 4870 on CentOS release 5. [root@lboxtest1 PF_RING]# make make -C /lib/module 22 Sep 2011 02:40:09 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27579 patch for resolve issue: vPF_RING/host/qemu-kvm-0.14.1-vpfring-diff/hw/vpfring.h ----------------------------- --- vpfring.h.old 2011-09-2 19 Sep 2011 23:33:48 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27578 Hi Is there a list of silicom adapterss that support the 10G DNA driver? http://www.silicom-usa.com/ProductsList.aspx?Category=49&Section=715&ln=en 13 Sep 2011 21:35:22 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27567 Hello, I was wondering if the Windows Binary version of Nprobe included all the "Pro" plugins. Im specifically after SIP/RTP. Can the Windows Binar 07 Sep 2011 18:36:15 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27529 Hi Luca. Thanks for your kindness. This mail consist 3 part. 1. lspci -vvv 2. before test(ethtool -S eth1) 3. after test(ethtool -S et 07 Sep 2011 01:00:14 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27514 Hi luca I try to evaluate the DNA driver at 10GE adapter. Can you send me the DNA license for evaluation for 1 month?? MAC of eth1: 00:01:2f:ff:05:fd 06 Sep 2011 21:32:00 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27513 I try to use PF_RING_aware driver "ixgbe-3.1.15-FlowDirector" to capture 8Gb packet at wire speed based on adapter intel 82599. driver load command: 06 Sep 2011 21:30:18 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27512 Je suis absent(e) du bureau jusqu'au 08/09/2011 I am currently out of office with limited access to e-mail. I will be back on September, 8th. For u 06 Sep 2011 14:53:15 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27509 Hi, just recently we bought DNA enabled driver for e1000e (Intel 82571EB), and decided to implement pf_ring as part of our test solution. But we ha 06 Sep 2011 13:02:04 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27504 I try to collect a flow data on the collector server. But I couldn't. I used this command. <probe mode> sudo ./nprobe -n 168.111.46.135:2055 -i eth0 06 Sep 2011 05:37:14 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27502 Hello, we have set up pf_ring correctly on a RHEL 6.1 system. We have loaded two pf_ring aware drivers: igb and cxgb4 All the applications works wel 06 Sep 2011 02:44:49 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27500 hi,all Could someone tell me what TNAPI-suitable environment is? Which version is the kernel? Which version is the PF_RING I'm very confused. Wh 01 Sep 2011 00:01:00 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27465 I test TNAPI driver 2.4.12. The performance is very low. About 100Mbit/ sec. 1G flow Why? 31 Aug 2011 21:10:47 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27464 Thanks for your response. I have intel dual port NIC. (82576 chipset) NIC MAC: eth4 00:1b:21:be:8b:94 eth5 00:1b:21:be:8b:9 31 Aug 2011 01:15:11 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27461 I've got a couple of (probably related) problems with PF_RING 4.7.2 1) With PF_RING-enabled libpcap, Suricata would crash and ARGUS complains of out- 26 Aug 2011 04:31:09 -0800 http://www.gossamer-threads.com/lists/ntop/misc/27445