Mailing List Archive: NTop: Misc

process killed with pf_ring module

Index | Next | Previous | View Threaded

dreamgirl314 at gmail

May 13, 2011, 9:16 PM

Post #1 of 4 (443 views)
Permalink

process killed with pf_ring module

Hi,

I configured justniffer application to be used with pf_ring. However, when I
insert the kernel module and run the application, it gets killed:

xen02:/home/archana/PF_RING-4.6.0/kernel# insmod pf_ring.ko

xen02:/home/archana/PF_RING-4.6.0/kernel# justniffer -i eth0
-l"%connection.time"

Killed

But when I do:

xen02:/home/archana/PF_RING-4.6.0/kernel# rmmod pf_ring.ko

xen02:/home/archana/PF_RING-4.6.0/kernel# justniffer -i eth0
-l"%connection.time"

0.000080

JUstniffer works well when the pf_ring module is not inserted. I did strace
to find out the error. Below is the part of strace which shows the error:

uname({sys="Linux", node="xen02.das3.cs.vu.nl", ...}) = 0

futex(0xb760da04, FUTEX_WAKE_PRIVATE, 2147483647) = 0

brk(0) = 0x9af5000

brk(0x9b16000) = 0x9b16000

socket(0x1b /* PF_??? */, SOCK_RAW, 768) = 3

setsockopt(3, SOL_IP, 0x6b /* IP_??? */, [16384], 4) = 0

bind(3, {sa_family=0x1b /* AF_??? */, sa_data="eth0\0\0\2647x\267\20l\3\0"},
16) = 0

mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, 3, 0) = -1 EINVAL
(Invalid argument)

+++ killed by SIGKILL +++

Killed

Does anybody have any idea why this happens.

Regards

Archana

deri at ntop

May 14, 2011, 12:43 AM

Post #2 of 4 (425 views)
Permalink

Re: process killed with pf_ring module [In reply to]

Archana
we can support on PF_RING but not on non-PF_RING apps. Thus if you can boil down this problem to something we can do on the PF_RING size we would be willing to help you

Luca

On May 14, 2011, at 6:16 AM, Archana N wrote:

> Hi,
>
> I configured justniffer application to be used with pf_ring. However, when I insert the kernel module and run the application, it gets killed:
>
> xen02:/home/archana/PF_RING-4.6.0/kernel# insmod pf_ring.ko
> xen02:/home/archana/PF_RING-4.6.0/kernel# justniffer -i eth0 -l"%connection.time"
> Killed
>
> But when I do:
> xen02:/home/archana/PF_RING-4.6.0/kernel# rmmod pf_ring.ko
> xen02:/home/archana/PF_RING-4.6.0/kernel# justniffer -i eth0 -l"%connection.time"
> 0.000080
>
> JUstniffer works well when the pf_ring module is not inserted. I did strace to find out the error. Below is the part of strace which shows the error:
> uname({sys="Linux", node="xen02.das3.cs.vu.nl", ...}) = 0
> futex(0xb760da04, FUTEX_WAKE_PRIVATE, 2147483647) = 0
> brk(0) = 0x9af5000
> brk(0x9b16000) = 0x9b16000
> socket(0x1b /* PF_??? */, SOCK_RAW, 768) = 3
> setsockopt(3, SOL_IP, 0x6b /* IP_??? */, [16384], 4) = 0
> bind(3, {sa_family=0x1b /* AF_??? */, sa_data="eth0\0\0\2647x\267\20l\3\0"}, 16) = 0
> mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, 3, 0) = -1 EINVAL (Invalid argument)
> +++ killed by SIGKILL +++
> Killed
>
>
>
> Does anybody have any idea why this happens.
>
> Regards
> Archana
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

---
Keep looking, don't settle - Steve Jobs

_______________________________________________
Ntop-misc mailing list
Ntop-misc [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

dreamgirl314 at gmail

May 14, 2011, 5:48 AM

Post #3 of 4 (430 views)
Permalink

Re: process killed with pf_ring module [In reply to]

Hi Luca,

I looked more into the issue and it seems that there is not enough memory
for the ring. I am attaching the tail of the log below. Could you tell me
how I can allocate more memory.

[ 270.221805] lowmem_reserve[]: 0 0 0 0
[ 270.221812] DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB
0*1024kB 0*2048kB 0*4096kB = 0kB
[ 270.221831] Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB
0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[ 270.221847] 11 total pagecache pages
[ 270.221850] Swap cache: add 900, delete 900, find 0/8
[ 270.221855] Free swap = 128648kB
[ 270.221857] Total swap = 131064kB
[ 270.222702] 34816 pages of RAM
[ 270.222707] 0 pages of HIGHMEM
[ 270.222710] 1208 reserved pages
[ 270.222712] 19 pages shared
[ 270.222714] 0 pages swap cached
[ 270.222715] 0 pages dirty
[ 270.222717] 0 pages writeback
[ 270.222719] 1 pages mapped
[ 270.222724] 678 pages slab
[ 270.222725] 0 pages pagetables
[ 270.228622] [PF_RING] ERROR: not enough memory for ring
[ 270.228629] [PF_RING] ring_mmap(): unable to allocate memory
[ 270.228716] [PF_RING] Removing /proc/net/pf_ring/1164-eth0.3
Killed

deri at ntop

May 15, 2011, 1:36 AM

Post #4 of 4 (410 views)
Permalink

Re: process killed with pf_ring module [In reply to]

Archana
1. please update to the current SVN code
2. see how the lib you use calls pf_ring. I believe they want to use a 65k (or more) snaplen in pcap_open_live

Luca

On May 14, 2011, at 2:48 PM, Archana N wrote:

> Hi Luca,
>
> I looked more into the issue and it seems that there is not enough memory for the ring. I am attaching the tail of the log below. Could you tell me how I can allocate more memory.
>
> [ 270.221805] lowmem_reserve[]: 0 0 0 0
> [ 270.221812] DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
> [ 270.221831] Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
> [ 270.221847] 11 total pagecache pages
> [ 270.221850] Swap cache: add 900, delete 900, find 0/8
> [ 270.221855] Free swap = 128648kB
> [ 270.221857] Total swap = 131064kB
> [ 270.222702] 34816 pages of RAM
> [ 270.222707] 0 pages of HIGHMEM
> [ 270.222710] 1208 reserved pages
> [ 270.222712] 19 pages shared
> [ 270.222714] 0 pages swap cached
> [ 270.222715] 0 pages dirty
> [ 270.222717] 0 pages writeback
> [ 270.222719] 1 pages mapped
> [ 270.222724] 678 pages slab
> [ 270.222725] 0 pages pagetables
> [ 270.228622] [PF_RING] ERROR: not enough memory for ring
> [ 270.228629] [PF_RING] ring_mmap(): unable to allocate memory
> [ 270.228716] [PF_RING] Removing /proc/net/pf_ring/1164-eth0.3
> Killed
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

---

"Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it. - Brian W. Kernighan

_______________________________________________
Ntop-misc mailing list
Ntop-misc [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads