Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NTop: Misc

Problem with PF_Ring 2.3

 

 

NTop misc RSS feed   Index | Next | Previous | View Threaded


Eric.Daras at nbb

Jun 14, 2004, 1:39 AM

Post #1 of 7 (772 views)
Permalink
Problem with PF_Ring 2.3

Dear all,

I 'm trying to use PF_RING for a tcpdump tracing box but I always get this error :

[root [at] idbpld0 root]# /usr/local/sbin/tcpdump -i eth2 -s 1500 -w /dev/null
Open RING [fd=3]
tcpdump: Wrong RING version: kernel is 4, libpcap was compiled with 2

[root [at] idbpld0 root]#

I compiled a new kernel (based on fedora core 2 kernel - 2.6.5), a new lipcap 0.8.1 and tcpdump 3.8.1 with PF_RING 2.3. What is the problem ? What does "kernel is , libpcap.." mean ?

Thx

--
Eric Daras
National Bank of Belgium

Tel: + 32 (2) 221.49.74

-----------------------------------------
Visit our website! http://www.nbb.be

"DISCLAIMER: The content of this e-mail message should not be construed as binding on the part of the National Bank of Belgium (NBB) unless otherwise and previously stated. The opinions expressed in this message are solely those of the author and do not necessarily reflect NBB viewpoints, particularly when the content of this message, or part thereof, is private by nature or does not fall within the professional scope of its author."


deri at ntop

Jun 14, 2004, 11:19 PM

Post #2 of 7 (732 views)
Permalink
Re: Problem with PF_Ring 2.3 [In reply to]

Eric,
it means that your /usr/local/sbin/tcpdump has probably been linked
with the 2.3 version (version 4) but it probably uses a shared pcap
library so at runtime it loads the old version. Try to statically link
tcpdump to make sure you're using the correct library.

Cheers, Luca

Daras Eric wrote:

>Dear all,
>
>I 'm trying to use PF_RING for a tcpdump tracing box but I always get this error :
>
>[root [at] idbpld0 root]# /usr/local/sbin/tcpdump -i eth2 -s 1500 -w /dev/null
>Open RING [fd=3]
>tcpdump: Wrong RING version: kernel is 4, libpcap was compiled with 2
>
>[root [at] idbpld0 root]#
>
>I compiled a new kernel (based on fedora core 2 kernel - 2.6.5), a new lipcap 0.8.1 and tcpdump 3.8.1 with PF_RING 2.3. What is the problem ? What does "kernel is , libpcap.." mean ?
>
>Thx
>
>--
> Eric Daras
> National Bank of Belgium
>
> Tel: + 32 (2) 221.49.74
>
>-----------------------------------------
>Visit our website! http://www.nbb.be
>
>"DISCLAIMER: The content of this e-mail message should not be construed as binding on the part of the National Bank of Belgium (NBB) unless otherwise and previously stated. The opinions expressed in this message are solely those of the author and do not necessarily reflect NBB viewpoints, particularly when the content of this message, or part thereof, is private by nature or does not fall within the professional scope of its author."
>
>_______________________________________________
>Ntop-misc mailing list
>Ntop-misc [at] listgateway
>http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>


--
Luca Deri <deri [at] ntop> http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman


Eric.Daras at nbb

Jun 14, 2004, 11:44 PM

Post #3 of 7 (723 views)
Permalink
RE: Problem with PF_Ring 2.3 [In reply to]

Dear Luca,

Thx for you answer. Just one another question (for dummies) : how can I have a statically linked tcpdump ?

--
Eric Daras
National Bank of Belgium

Tel: + 32 (2) 221.49.74


> -----Original Message-----
> From: Luca Deri [mailto:deri [at] ntop]
> Sent: mardi 15 juin 2004 08:19
> To: ntop-misc [at] listgateway
> Subject: Re: [Ntop-misc] Problem with PF_Ring 2.3
>
>
> Eric,
> it means that your /usr/local/sbin/tcpdump has probably been linked
> with the 2.3 version (version 4) but it probably uses a shared pcap
> library so at runtime it loads the old version. Try to
> statically link
> tcpdump to make sure you're using the correct library.
>
> Cheers, Luca
>
> Daras Eric wrote:
>
> >Dear all,
> >
> >I 'm trying to use PF_RING for a tcpdump tracing box but I
> always get
> >this error :
> >
> >[root [at] idbpld0 root]# /usr/local/sbin/tcpdump -i eth2 -s 1500 -w
> >/dev/null Open RING [fd=3]
> >tcpdump: Wrong RING version: kernel is 4, libpcap was compiled with 2
> >
> >[root [at] idbpld0 root]#
> >
> >I compiled a new kernel (based on fedora core 2 kernel -
> 2.6.5), a new
> >lipcap 0.8.1 and tcpdump 3.8.1 with PF_RING 2.3. What is
> the problem ?
> >What does "kernel is , libpcap.." mean ?
> >
> >Thx
> >
> >--
> > Eric Daras
> > National Bank of Belgium
> >
> > Tel: + 32 (2) 221.49.74
> >
> >-----------------------------------------
> >Visit our website! http://www.nbb.be
> >
> >"DISCLAIMER: The content of this e-mail message should not
> be construed
> >as binding on the part of the National Bank of Belgium (NBB) unless
> >otherwise and previously stated. The opinions expressed in
> this message
> >are solely those of the author and do not necessarily reflect NBB
> >viewpoints, particularly when the content of this message, or part
> >thereof, is private by nature or does not fall within the
> professional
> >scope of its author."
> >
> >_______________________________________________
> >Ntop-misc mailing list
> >Ntop-misc [at] listgateway
> >http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> >
> >
>
>
> --
> Luca Deri <deri [at] ntop> http://luca.ntop.org/
> Hacker: someone who loves to program and enjoys being
> clever about it - Richard Stallman
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/n> top-misc
>

-----------------------------------------
Visit our website! http://www.nbb.be

"DISCLAIMER: The content of this e-mail message should not be construed as binding on the part of the National Bank of Belgium (NBB) unless otherwise and previously stated. The opinions expressed in this message are solely those of the author and do not necessarily reflect NBB viewpoints, particularly when the content of this message, or part thereof, is private by nature or does not fall within the professional scope of its author."


deri at ntop

Jun 15, 2004, 3:27 AM

Post #4 of 7 (725 views)
Permalink
Re: Problem with PF_Ring 2.3 [In reply to]

Eric,
add --static to the flags you pass to the linker/gcc

Luca

Daras Eric wrote:

>Dear Luca,
>
>Thx for you answer. Just one another question (for dummies) : how can I have a statically linked tcpdump ?
>
>--
> Eric Daras
> National Bank of Belgium
>
> Tel: + 32 (2) 221.49.74
>
>
>
>
>>-----Original Message-----
>>From: Luca Deri [mailto:deri [at] ntop]
>>Sent: mardi 15 juin 2004 08:19
>>To: ntop-misc [at] listgateway
>>Subject: Re: [Ntop-misc] Problem with PF_Ring 2.3
>>
>>
>>Eric,
>>it means that your /usr/local/sbin/tcpdump has probably been linked
>>with the 2.3 version (version 4) but it probably uses a shared pcap
>>library so at runtime it loads the old version. Try to
>>statically link
>>tcpdump to make sure you're using the correct library.
>>
>>Cheers, Luca
>>
>>Daras Eric wrote:
>>
>>
>>
>>>Dear all,
>>>
>>>I 'm trying to use PF_RING for a tcpdump tracing box but I
>>>
>>>
>>always get
>>
>>
>>>this error :
>>>
>>>[root [at] idbpld0 root]# /usr/local/sbin/tcpdump -i eth2 -s 1500 -w
>>>/dev/null Open RING [fd=3]
>>>tcpdump: Wrong RING version: kernel is 4, libpcap was compiled with 2
>>>
>>>[root [at] idbpld0 root]#
>>>
>>>I compiled a new kernel (based on fedora core 2 kernel -
>>>
>>>
>>2.6.5), a new
>>
>>
>>>lipcap 0.8.1 and tcpdump 3.8.1 with PF_RING 2.3. What is
>>>
>>>
>>the problem ?
>>
>>
>>>What does "kernel is , libpcap.." mean ?
>>>
>>>Thx
>>>
>>>--
>>>Eric Daras
>>>National Bank of Belgium
>>>
>>>Tel: + 32 (2) 221.49.74
>>>
>>>-----------------------------------------
>>>Visit our website! http://www.nbb.be
>>>
>>>"DISCLAIMER: The content of this e-mail message should not
>>>
>>>
>>be construed
>>
>>
>>>as binding on the part of the National Bank of Belgium (NBB) unless
>>>otherwise and previously stated. The opinions expressed in
>>>
>>>
>>this message
>>
>>
>>>are solely those of the author and do not necessarily reflect NBB
>>>viewpoints, particularly when the content of this message, or part
>>>thereof, is private by nature or does not fall within the
>>>
>>>
>>professional
>>
>>
>>>scope of its author."
>>>
>>>_______________________________________________
>>>Ntop-misc mailin
>>>
>>>
> >Ntop-misc [at] listgateway
>
>
>>>http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>>
>>>
>>>
>>--
>>Luca Deri <deri [at] ntop> http://luca.ntop.org/
>>Hacker: someone who loves to program and enjoys being
>>clever about it - Richard Stallman
>>
>>_______________________________________________
>>Ntop-misc mailing list
>>Ntop-misc [at] listgateway
>>http://listgateway.unipi.it/mailman/listinfo/n> top-misc
>>
>>
>>
>
>-----------------------------------------
>Visit our website! http://www.nbb.be
>
>"DISCLAIMER: The content of this e-mail message should not be construed as binding on the part of the National Bank of Belgium (NBB) unless otherwise and previously stated. The opinions expressed in this message are solely those of the author and do not necessarily reflect NBB viewpoints, particularly when the content of this message, or part thereof, is private by nature or does not fall within the professional scope of its author."
>
>_______________________________________________
>Ntop-misc mailing list
>Ntop-misc [at] listgateway
>http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>


--
Luca Deri <deri [at] ntop> http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman


Eric.Daras at nbb

Jun 15, 2004, 4:54 AM

Post #5 of 7 (724 views)
Permalink
RE: Problem with PF_Ring 2.3 [In reply to]

I statically linked tcdpump but I have always the same problem...


--
Eric Daras
National Bank of Belgium

Tel: + 32 (2) 221.49.74


> -----Original Message-----
> From: Luca Deri [mailto:deri [at] ntop]
> Sent: mardi 15 juin 2004 12:28
> To: ntop-misc [at] listgateway
> Subject: Re: [Ntop-misc] Problem with PF_Ring 2.3
>
>
> Eric,
> add --static to the flags you pass to the linker/gcc
>
> Luca
>
> Daras Eric wrote:
>
> >Dear Luca,
> >
> >Thx for you answer. Just one another question (for dummies)
> : how can
> >I have a statically linked tcpdump ?
> >
> >--
> > Eric Daras
> > National Bank of Belgium
> >
> > Tel: + 32 (2) 221.49.74
> >
> >
> >
> >
> >>-----Original Message-----
> >>From: Luca Deri [mailto:deri [at] ntop]
> >>Sent: mardi 15 juin 2004 08:19
> >>To: ntop-misc [at] listgateway
> >>Subject: Re: [Ntop-misc] Problem with PF_Ring 2.3
> >>
> >>
> >>Eric,
> >>it means that your /usr/local/sbin/tcpdump has probably been linked
> >>with the 2.3 version (version 4) but it probably uses a shared pcap
> >>library so at runtime it loads the old version. Try to
> >>statically link
> >>tcpdump to make sure you're using the correct library.
> >>
> >>Cheers, Luca
> >>
> >>Daras Eric wrote:
> >>
> >>
> >>
> >>>Dear all,
> >>>
> >>>I 'm trying to use PF_RING for a tcpdump tracing box but I
> >>>
> >>>
> >>always get
> >>
> >>
> >>>this error :
> >>>
> >>>[root [at] idbpld0 root]# /usr/local/sbin/tcpdump -i eth2 -s 1500 -w
> >>>/dev/null Open RING [fd=3]
> >>>tcpdump: Wrong RING version: kernel is 4, libpcap was
> compiled with 2
> >>>
> >>>[root [at] idbpld0 root]#
> >>>
> >>>I compiled a new kernel (based on fedora core 2 kernel -
> >>>
> >>>
> >>2.6.5), a new
> >>
> >>
> >>>lipcap 0.8.1 and tcpdump 3.8.1 with PF_RING 2.3. What is
> >>>
> >>>
> >>the problem ?
> >>
> >>
> >>>What does "kernel is , libpcap.." mean ?
> >>>
> >>>Thx
> >>>
> >>>--
> >>>Eric Daras
> >>>National Bank of Belgium
> >>>
> >>>Tel: + 32 (2) 221.49.74
> >>>
> >>>-----------------------------------------
> >>>Visit our website! http://www.nbb.be
> >>>
> >>>"DISCLAIMER: The content of this e-mail message should not
> >>>
> >>>
> >>be construed
> >>
> >>
> >>>as binding on the part of the National Bank of Belgium (NBB) unless
> >>>otherwise and previously stated. The opinions expressed in
> >>>
> >>>
> >>this message
> >>
> >>
> >>>are solely those of the author and do not necessarily reflect NBB
> >>>viewpoints, particularly when the content of this message, or part
> >>>thereof, is private by nature or does not fall within the
> >>>
> >>>
> >>professional
> >>
> >>
> >>>scope of its author."
> >>>
> >>>_______________________________________________
> >>>Ntop-misc mailin
> >>>
> >>>
> > >Ntop-misc [at] listgateway
> >
> >
> >>>http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> >>>
> >>>
> >>>
> >>>
> >>--
> >>Luca Deri <deri [at] ntop> http://luca.ntop.org/
> >>Hacker: someone who loves to program and enjoys being
> >>clever about it - Richard Stallman
> >>
> >>_______________________________________________
> >>Ntop-misc mailing list
> >>Ntop-misc [at] listgateway
> >>http://listgateway.unipi.it/mailman/listinfo/n> top-misc
> >>
> >>
> >>
> >
> >-----------------------------------------
> >Visit our website! http://www.nbb.be
> >
> >"DISCLAIMER: The content of this e-mail message should not
> be construed
> >as binding on the part of the National Bank of Belgium (NBB) unless
> >otherwise and previously stated. The opinions expressed in
> this message
> >are solely those of the author and do not necessarily reflect NBB
> >viewpoints, particularly when the content of this message, or part
> >thereof, is private by nature or does not fall within the
> professional
> >scope of its author."
> >
> >_______________________________________________
> >Ntop-misc mailing list
> >Ntop-misc [at] listgateway
> >http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> >
> >
>
>
> --
> Luca Deri <deri [at] ntop> http://luca.ntop.org/
> Hacker: someone who loves to program and enjoys being
> clever about it - Richard Stallman
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/n> top-misc
>

-----------------------------------------
Visit our website! http://www.nbb.be

"DISCLAIMER: The content of this e-mail message should not be construed as binding on the part of the National Bank of Belgium (NBB) unless otherwise and previously stated. The opinions expressed in this message are solely those of the author and do not necessarily reflect NBB viewpoints, particularly when the content of this message, or part thereof, is private by nature or does not fall within the professional scope of its author."


deri at ntop

Jun 15, 2004, 6:19 AM

Post #6 of 7 (727 views)
Permalink
Re: Problem with PF_Ring 2.3 [In reply to]

Eric,
- are you sure you're using the 2.3 version?
- did you compile libpcap against the ring.h file part of
include/linux/kernel?

Luca



Daras Eric wrote:

>I statically linked tcdpump but I have always the same problem...
>
>
>--
> Eric Daras
> National Bank of Belgium
>
> Tel: + 32 (2) 221.49.74
>
>
>

--
Luca Deri <deri [at] ntop> http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman


Eric.Daras at nbb

Jul 1, 2004, 1:23 AM

Post #7 of 7 (728 views)
Permalink
RE: Problem with PF_Ring 2.3 [In reply to]

Luca,

I'm shameful ! I made a mismatch between ring packages : My kernel was compiled with 2.2 version and libpcap with 2.3... Thx

--
Eric Daras
National Bank of Belgium

Tel: + 32 (2) 221.49.74


> -----Original Message-----
> From: Luca Deri [mailto:deri [at] ntop]
> Sent: mardi 15 juin 2004 15:20
> To: ntop-misc [at] listgateway
> Subject: Re: [Ntop-misc] Problem with PF_Ring 2.3
>
>
> Eric,
> - are you sure you're using the 2.3 version?
> - did you compile libpcap against the ring.h file part of
> include/linux/kernel?
>
> Luca
>
>
>
> Daras Eric wrote:
>
> >I statically linked tcdpump but I have always the same problem...
> >
> >
> >--
> > Eric Daras
> > National Bank of Belgium
> >
> > Tel: + 32 (2) 221.49.74
> >
> >
> >
>
> --
> Luca Deri <deri [at] ntop> http://luca.ntop.org/
> Hacker: someone who loves to program and enjoys being
> clever about it - Richard Stallman
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/n> top-misc
>

-----------------------------------------
Visit our website! http://www.nbb.be "DISCLAIMER: The content of this
e-mail message should not be construed as binding on the part of the
National Bank of Belgium (NBB) unless otherwise and previously stated. The
opinions expressed in this message are solely those of the author and do
not necessarily reflect NBB viewpoints, particularly when the content of
this message, or part thereof, is private by nature or does not fall within
the professional scope of its author."

NTop misc RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.