Skip to content

Releases: ntop/PF_RING

PF_RING 8.8.0

05 Aug 11:05
Compare
Choose a tag to compare

Key Features

  • Support for Napatech Flow Manager
  • Support for NVIDIA BlueField 2/3

PF_RING Library

  • Add pfring_flow_update struct and pfring_recv_flow
  • Add PF_RING_FLOW_OFFLOAD flag to enable Flow Table offload on supported adapters
  • Add PF_RING_FLOW_OFFLOAD_AUTO_UNLEARN to control tcp auto unlearn
  • Add PF_RING_KEEP_CRC flag (required by Napatech)
  • Fix pfring_zc_send_pkt_multi return code

PF_RING Kernel Module

  • Add flow_id to generic_flow_tuple_hw_rule
  • Fix crash with more than 64 rss queues
  • Various minor fixes

FT Library

  • Add pfring_ft_zmq_get_stats API
  • Add slice action

PF_RING Capture Modules and ZC Drivers

  • Add support for Napatech Flow Manager (Flow Table offload)
  • Add support for NVIDIA BlueField (ARM64)
  • Add jumbo support for ice-zc
  • Add support for Napatech zero-copy forwarding (pfring_send_last_rx_packet)
  • Fix all Intel drivers compilation on latest kernels (including Ubuntu 24)
    • ixgbevf-zc driver update v.4.18.9
    • i40e-zc driver update v.2.24.6
    • iavf-zc driver update v.4.9.5
  • Extend Napatech interface name to support adapter ID
  • Fix drop counter on NVIDIA/Mellanox Connect-X (read phy discards in addition to buffer discards)
  • Fix crash with more than 64 rss queues
  • Fix iavf (i40e VF) ring initialization
  • Fix driver dependency intel_auxiliary

PF_RING-aware Libpcap/Tcpdump

  • New pfring-aware tcpdump 4.99.4

Examples

  • New pfflow_offload sample app with support for Napatech Flow Manager
  • pfsend
    • Fix ipv6 packet forging
    • Add eth header when replaying RAW capture files
    • Add -U / -K options to control flow distribution
    • Fix on the fly packets generation
    • Fix -A when -O is used
  • pfsend_multichannel
    • Add -C to support multiple TX channels with Napatech
  • pfbridge
    • Add support for Napatech zero-copy forwarding

Misc

  • Improve pf_ringctl to auto generate hugepages.conf based on numa nodes
  • Change MAX_CAPLEN to 65600 to correctly handle max jumbo packet size
  • Remove deprecated code for Accolade and fm10k

PF_RING 8.6.1

23 Oct 15:45
Compare
Choose a tag to compare
  • PF_RING Library
  • New pfring_set_cluster_consumer API to set a kernel cluster with (optional) consumer queue id and support for options (pfring_set_cluster() is set as deprecated)
  • PF_RING Kernel Module
  • Implement 'relaxed' distribution mode in the kernel cluster to deliver packets to the first available queue if a consumer is down (CLUSTER_OPTION_RELAXED_DISTRIBUTION)
  • Support for kernel 6.4+
  • PF_RING Capture Modules and ZC Drivers
  • New ice zc driver v.1.12.7
  • New ixgbe zc driver v.5.19.6
  • New igb zc driver v.5.14.16
  • Add auto DDP install in ice dkms packages
  • Examples
  • pfsend:
    • Add -G for seding traffic on two interfaces (one per direcion)
    • Improve TX rate precision adjust the transmission rate to compensate cpu freq fluctuations
  • pfcount: print both lib and kernel module versions
  • Misc
  • Fix hugepages file parsing (/etc/hugepages.conf)

PF_RING 8.6 Release

23 Oct 15:22
Compare
Choose a tag to compare
  • PF_RING Library
  • New Runtime Manager for injecting and removing filtering rules to the socket via Redis
  • Fix memory leaks in PCAP module
  • Fix caplen/MTU on loopback capture
  • PF_RING Kernel Module
  • Add support for probabilistic sampling with kernel capture
  • FT Library
  • Improve application protocol guess with nDPI
  • PF_RING Capture Modules and ZC Drivers
  • Add initial support for NVIDIA/Mellanox BlueField
  • Add Napatech ns timestamp in PCAP mode
  • Add support for probabilistic sampling with userspace capture
  • Optimize hw timestamping on ice adapters (Intel E810)
  • Fix timestamp support when using the ZC burst API with ice adapters
  • Fix drivers compilation on Kernel 6.x
  • Fix drivers compilation on RH 8.8
  • nPCAP
  • Fix memory corruption with big index files
  • PF_RING-aware Libpcap/Tcpdump
  • Add PF_RING support to pcap_inject
  • Fix pcap_read_pf_ring return code (number of packets)
  • Examples
  • zbalance_ipc: add support for multiple balancer threads when using NVIDIA/Mellanox adapters
  • pfsend: add -c option to balance on dest ip rather than src up
  • pfcount: compute drop rate in packet mode only
  • pfcount: report expired licenses
  • Fix ftflow_dpdk compilation on DPDK 22 or later
  • Fix memory leaks in pcount, alldevs, preflect, ftflow_pcap,
  • Misc
  • Add support for Debian 12
  • Add libelf and libbpf dependencies to packages
  • Add sbsigntool dependency which includes kmodsign required by dkms
  • Add revision to pfring-dkms dependency in packages
  • Fix check for init/systemd presence
  • Cleanup support for legacy adapters

PF_RING 8.4 Release

31 Jan 09:21
Compare
Choose a tag to compare

PF_RING Library

  • New API pfring_get_ethtool_link_speed
  • Add vlan_id to flow rule struct
  • Add optimization flags to BPF filters compiled with pcap_compile
  • Fix pfring_open_multichannel

PF_RING Kernel Module

  • Add keep_vlan_offload option to avoid reinserting VLAN header on VLAN interfaces when used inline

ZC Library

  • New ZC APIs (available on supported adapters)
    • pfring_zc_get_device_clock
    • pfring_zc_set_device_clock
    • pfring_zc_adjust_device_clock
    • pfring_zc_send_pkt_get_time
  • Add new pfring_zc_run_fanout_v3 API to support more than 64 fan-out queues
  • Add support for capturing stack packets, used by zcount and zbalance_ipc

PF_RING Capture Modules and ZC Drivers

  • New iavf-zc driver to support i40e and ice Virtual Functions
    • Support for VF trust mode on ice adapters (promisc with SR-IOV)
  • Improve ice driver (E810 adapters)
    • Update ice driver to v.1.9.11
    • Add support to get time, set time, adjust time, send get time
  • Improvei the NVIDIA/Mellanox (mlx) driver
    • Extend hardware rules
    • Add support for VLAN filtering
    • Add set_default_hw_action API
    • Fix reported link speed
    • Fix bidirectional rules
    • Fix pfring_poll support
  • Improve the Napatech driver
    • Add nanosecond timestamp capture when using the packet API in PCAP chunk mode
  • Improve the ZC drivers API to support more callbacks
  • Add socket extensions (getsockopt/setsockopt):
    • SO_GET_DEV_STATS (get_stats ZC drivers callback)
    • SO_GET_DEV_TX_TIME (get_tx_time ZC drivers callback)
    • SO_SET_DEV_TIME (set_time ZC drivers callback)
    • SO_SET_ADJ_TIME (adjust_time ZC drivers callback)
  • Add management_only_mode to allow opening multiple sockets on the same ZC interface
  • Update drivers to support latest RH 9.1, Ubuntu 22, Debian kernels

FT Library

  • Fix double free

nBPF

  • Add icmp protocol primitive support

nPCAP

  • Update npcap lib to support for nanosecond time in packet extraction

PF_RING-aware Libpcap/Tcpdump

  • Update tcpdump to v.4.99.1
  • Update libpcap to v.1.10.1

Examples

  • Add ztime example
    • Ability to set/adjust the card clock without capturing/transmitting traffic (external process)
    • Test for the send-get-time feature
  • pfsend
    • Flush queued packets when waiting at real pcap rate and on shutdown
    • Fix headers ranzomization
    • Fix crash with -z
  • pfsend_multichannel
    • Add support for controlling IPs generated
  • pfcount
    • Add -I option to print interface info in JSON format
  • pfcount_multichannel
    • Print full packet metadata with -v
  • zbalance_ipc
    • Add support for up to 128 queues with -m 1 and -m 2 (new v3 api)
    • Add -X option to capture TX traffic (standard driver only)
    • Fix check for queues limit
  • zdelay
    • Fix queue size (power of 2)

Misc

  • Add pfcount_multichannel and pfsend_multichannel to packages
  • Service script (pf_ringctl)
    • Add support for configuring RSS via ethtool
    • Add pre/post scripts for ZC drivers
    • Handle multi-line driver conf file
  • Removed obsolete fm10k driver

PF_RING 8.2 Release

30 Jun 14:12
Compare
Choose a tag to compare

PF_RING Library

  • New new pfring_get_caplen API
  • New pfring_get_link_type API
  • Add src_ip_mask and dst_ip_mask to generic_flow_rule
  • Add priority to hw_filtering_rule
  • Add module version to device info returned by pfring_findalldevs
  • Refactor device name parsing
  • Use sockaddr_ll in bind (to supports interface names longer than 14 chars)

ZC Library

  • New Mellanox support for ConnectX 4/5/6 adapters, including hardware offloads for timestamp, filtering, RSS
  • Fix pfring_zc_numa_get_cpu_node

FT Library

  • Add native support for flow export over ZMQ

PF_RING Kernel Module

  • Add support for VXLAN
  • Add support for both sockaddr and sockaddr_ll in bind
  • Refactor kernel locking
  • Discard VLAN in hash cluster_per_flow_ip_with_dup_tuple calculation
  • Detect when a process owning a PF_RING socket changes the PID (e.g. fork)
  • Export process PID to userspace
  • Fix compilation on latest kernels for Rocky Linux and RH 8.5, Debian 9, 10, 11, Ubuntu 18, 20, 22
  • Fix net namespace handling
  • Fix crash when renaming /proc entries

PF_RING Capture Modules

Fix drop statistics on Napatech with HBA set

ZC Drivers

  • New igb-zc driver v.5.10.2
  • New i40e-zc driver v.2.17.4
  • New ice-zc driver v.1.8.8

nBPF

  • Fix double free

Examples

  • New sample application pfsend_multichannel to send traffic using RSS
  • New zdelay application to forward traffic between interfaces, adding a configurable delay
  • pfcount_multichannel: remove limit on number of threads
  • zbalance_ipc: improve hashing modes (e.g. add -Y to control eth type)
  • pfcount:
    • Add -0 to steer all traffic to RSS queueu 0
    • Add -P to set rule priority
  • ftflow_dpdk:
    • Set RSS mode/hf (required on some adapters e.g. Mellanox)
    • Use time from hardware timestamp when available

Misc

  • Add support for Ubuntu 22
  • Remove nBroker support (fm10k adapters are EOL)

PF_RING 8.0 Release

19 Aug 07:21
Compare
Choose a tag to compare

PF_RING Library

  • Add pfring_recv_burst API allowing batch receive (when supported by the capture module/adapter)
  • New zero-copy AF_XDP support (reworked), including pfring_recv_burst support
  • Fix breakloop when using pfring_loop

ZC Library

  • New pfring_zc_pkt_buff_data_from_cluster API to get the packet buffer providing packet handle and cluster
  • New pfring_zc_pkt_data_buff API to get the packet handle providing packet buffer and cluster
  • New pfring_zc_pkt_buff_pull_only API to remove data from the head room of a packet
  • Add PF_RING_ZC_BUFFER_HEAD_ROOM define (buffer head room size)
  • Add PF_RING_ZC_SEND_PKT_MULTI_MAX_QUEUES define (max number of queues in queues_mask)

FT Library

  • New pfring_ft_api_version API to get the API version
  • New pfring_zc_precompute_cluster_settings API to get memory information before allocating resources
  • Add VXLAN encapsulation support
  • Add tunnel_id to flow metadata
  • Add support for compiling examples with DPDK >=20
  • Fix L7 metadata with short flows

PF_RING-aware Libpcap/Tcpdump

  • Set 5-tuple clustering as default when using clustering with libpcap

PF_RING Kernel Module

  • Support for kernel >=5.9
  • Add more info to /proc, including promisc mode and ZC slots info
  • Handle long interface name (error on interface length bigger than 14-char as supported by bind)
  • Fix channel selection when channel is unknown (e.g. VM)
  • Fix triple VLAN tags with hw offload/acceleration
  • Fix check on mapped memory size
  • Fix potential data race in SO_SET_APPL_NAME
  • Fix OOB access

PF_RING Capture Modules

  • Accolade library update (SDK 1_2_20210714)
  • Napatech library update (SDK 12.7.2.1)
  • Silicom/Fiberblaze library update (SDK 3_5_9_1)
  • Add steer_to_ring and ring_id fields to Accolade rules (accolade_hw_rule)
  • Add support for recv burst on Napatech adapters in chunk mode
  • Add PF_RING_PACKET_CAPTURE_PRIO env var to set hostBufferAllowance on Napatech adapters
  • Rename ACCOLADE_RING_BLOCKS env var to ANIC_RING_BLOCKS on Accolade adapters (default is now 16)
  • Fix Accolade drop counter when capturing from rings
  • Fix extraction of packets with nsec timestamps on Timeline module (n2disk dump)

ZC Drivers

  • New ice ZC driver v.1.3.2 (Intel Columbiaville / E810 adapters) with symmetric RSS support
  • Support latest kernels, including RH/CentOS 8.4 and Ubuntu 20, for all ZC drivers
  • i40e ZC driver update (v.2.13.10)
  • e1000e ZC driver update (v.3.8.7)

nBPF

  • New nBPF primitives 'device ' and 'interface ' to match metadata from Arista MetaWatch devices
  • Examples
  • pfcount
    • Add -B option (burst mode)
  • pfsend
    • Add -n support with -f
    • Add support to reforge src/dst IP from pcap with -S and -D
  • ftflow
    • Add -E option to run extra DPI dissection (e.g. to print JA3 info)
  • zbalance_ipc
    • Add runtime reload of nDPI protocol configuration file
    • Add -m 7 option (sample distribution based on eth type)
    • Add default configuration file /etc/cluster/cluster.conf (when no option is specified)

Misc

  • Move libraries and utility scripts from /usr/local to /usr
  • Install pfring-aware tcpdump with packages
  • Add revision to pfring-dkms version

PF_RING 7.8.0 release

19 Oct 12:45
Compare
Choose a tag to compare

PF_RING Library

  • Add support for Device ID and Port ID to the extended packet header
  • Add Arista 7150 Series hw timestamps support (keyframes and packet trailer parsing and stripping)
  • Add Metawatch Metamako hw timestamps support (packet trailer parsing and stripping)
  • errno EINTR is now returned on breakloop
  • Improve XDP support
  • Replace configure --enable-xdp with --disable-xdp (XDP enabled by default when supported)

ZC Library

  • New PF_RING_ZC_DEVICE_METAWATCH_TIMESTAMP flag to enable Metawatch hw timestamps
  • New pfring_zc_get_pool_id API to get the Pool ID
  • New pfring_zc_run_balancer_v2 pfring_zc_run_fanout_v2 APIs to support filtering functions
  • BPF support in ZC interfaces, standard interfaces and SPSC queues
  • Add support for BPF in TX queues
  • Builtin GTP hash now expose GTP info (flags)
  • Fix CRC strip on ixgbevf
  • FT Library
  • New pfring_ft_flow_get_id API to get the flow ID
  • New PFRING_FT_IGNORE_HW_HASH flag to ignore hw packet hash
  • New PKT_FLAGS_FLOW_OFFLOAD_1ST packet flag (first packet of a flow)
  • Add support for flow slicing
  • New API pfring_ft_flow_get_users to get flow users (in case of slicing)
  • Improve application protocol detection
  • Fix bogus-IP headers parsing

PF_RING-aware Libpcap/Tcpdump

  • New libpcap v.191
  • New tcpdump v.4.9.3
  • stats.ps_recv now includes packets dropped due to out of buffer space

PF_RING Kernel Module

  • Fix channels with standard drivers
  • Fix 64-bit channel mask
  • Fix defragmentation of packets with ethernet padding
  • Fix unnecessary device mapping causing ifindex exhaustion

PF_RING Capture Modules

  • Update support for Fiberblaze adapters
  • Fix filtering with Accolade adapters

ZC Drivers

  • New ice ZC driver supporting E800 Series Intel adapters
  • Support for Ubuntu 20 LTS
  • Support for CentOS/RedHat 8.2
  • Fix queue attach/detach in ixgbe-zc
  • Support for kernel 5.4

nBPF

  • Add support for matching Local/Remote IP (new extended-BPF primitives)
  • Support uppercase AND/OR in extended-BPF filters
  • Fix extended-BPF grammar

Examples

  • New zfilter_mq_ipc sample app (packet filtering with multiple threads and fanout to multiple consumer processes)
  • ftflow:
    • New -H option to ignore hw hash setting PFRING_FT_IGNORE_HW_HASH
    • New -t option to print stats only
  • ftflow_dpdk
    • New -l option to run loopback tests
    • Add RX/TX ring size configuration
  • pfsend:
    • New -z option to precompute randomized sequence
    • New -W ID[,ID] option to forge VLAN and QinQ VLAN
  • zbalance_ipc:
    • New -x option to filter by VLAN ID
    • Add ability to set BPF to egress queues
    • Add ability to refresh BPF filters at runtime
    • New -G : option to forward GTP-C traffic to a specific queue
  • New zcount -f option to set BPF filters
  • New pfcount -F option (do not strip FCS)
  • New zcount/zcount_ipc -t option to read the packet payload
  • New pcount -e option to set the capture direction
  • Add VLAN to the flows dumped by ftflow
  • Fix transmission of small packets (less than 60 bytes)
  • Fix CPU affinity in ZC sample applications

Misc

  • Handle failures in service restart during package updates
  • Add linux headers dependency to the pfring-dkms package
  • Add actual version/revision to pfring-drivers-zc-dkms packages
  • Fix installed .so library and links
  • Fix ZC DAQ compilation and API update
  • Fix service scripts to avoid command injections

PF_RING 7.6.0 release

21 Feb 08:57
Compare
Choose a tag to compare

PF_RING Library

  • New pfring_open flag PF_RING_TX_BPF to evaluate the BPF filter also for TX
  • New pfring_open flag PF_RING_FLOW_OFFLOAD_TUNNEL to dissect tunneled traffic in flow-offload mode
  • New pfring_open flag PF_RING_DISCARD_INJECTED_PKTS to discard stack-injected packets

ZC Library

  • New API call pfring_zc_close_device to close a ZC interface
  • New 'flags' parameter to pfring_zc_create_cluster
  • Fixed memory allocation in case of more than 4GB of buffer size

FT Library

  • New API call pfring_ft_set_filter_all_protocols to reset all filtering rules
  • New API call pfring_ft_set_license to set a license at runtime
  • New API call pfring_ft_flow_get_ndpi_handle to access the flow nDPI handle
  • New pfring_ft_l7_protocol_id, pfring_ft_get_ndpi_handle to access the nDPI handle
  • New pfring_ft_flow_value status field to get flow termination reason
  • New PFRING_FT_TABLE_FLAGS_DPI_EXTRA flag to enable extra metadata extraction
  • New PFRING_FT_DECODE_TUNNELS flag to decode tunnels, new tunnel_type item in the flow value
  • New flow slicing support (pfring_ft_flow_set_flow_slicing API)
  • Added CAPWAP support
  • Added flow metadata for HTTP/DNS/SSL
  • Added global 'default' section to the rules configuration file
  • Added dpi_min_num_tcp_packets / dpi_min_num_udp_packets to the configuration file
  • Added flow_idle_timeout / flow_lifetime_timeout to the configuration file
  • Added src/dst mac to the exported flow key
  • Added ICMP type/code to flow metadata
  • Added flags to flow metadata
  • Added custom flow actions to be defined by the user
  • Added pfring_ft_load_configuration_ext API
  • Improved protocol detection for some protocols like Skype
  • Improved metadata extraction for some protocols like Telnet
  • Improved pfring_ft_license to return the duration also in demo mode
  • Changed l7_detected callback: this is called before the flow_packet callback now
  • Changed pfring_ft_create_table and pfring_ft_flow_value to allocate user metadata as part of the flow structure
  • Fixed filtering/shunting of custom protocols
  • Fixed protocol detection in case of guess
  • Fixed pfring_ft_set_l7_detected_callback user parameter handling

PF_RING-aware Libpcap

  • Fixed device name check during socket initialization to handle long interface names
  • Fixed loop break

PF_RING Kernel Module

  • Added new clustering mode cluster_per_flow_ip_with_dup_tuple
  • Allow any to capture from any namespace (on the host only)
  • Remapping ifindex to an internal device index to handle ifindex growing indefinitely
  • Fixed kernel crash parsing malformed packets (12 nested QinQ VLAN headers with GRE)
  • Fixed possible race condition
  • Fixed QinQ VLAN and VLAN offload support
  • Fixed concurrent access to the ring in case of loopback device and bridge
  • Compilation fixes for kernel 5.x
  • Reworked max ring size check to handle cases like jumbo frames
  • Improved promisc management

PF_RING Capture Modules

  • New AF_XDP capture module
  • Napatech library update, fixed findalldev
  • Accolade library update, fixed caplen vs orig len, new env var ACCOLADE_FLOW_IDLE_TIMEOUT
  • Myricom library update, license fix with port aggregation
  • DAG library update

ZC Drivers

  • New ixgbe-zc driver v.5.5.3
  • Support for Intel X550
  • Compilation fixes for kernel 5.x
  • Handling if up/down when the interface is in use by ZC

nBPF

  • Added support to match custom fields through a callback (nbpf_set_custom_callback)

Examples

  • zcount improvements:
    • Added -T option to capture TX
  • zbalance_ipc improvements:
    • Fixed -m 4/5/6 with multiple applications and more than 32 queues
    • New -E option to enable debug mode
    • New -C and -O options
  • ftflow_dpdk improvements:
    • More stats: drops, hw stats, per-queue throughput
    • New options to control the link status, flow control, autoneg, port speed, checksum offload
    • New -P option to set the TX rate
    • New TX test mode and -T option to set the packet len
    • New -F option to enable forwarding
    • New -m option to set the mtu
    • Capture-only mode
    • Forward optimizations
  • ftflow_pcap improvements:
    • Support for processing a PCAP file
    • New -p <proto.txt> option
    • New -F option to configure filtering/shunting rules
  • pfsend improvements:
    • New -8 option to send the same packets times before moving to the next
    • New -B option to set a BPF filter
    • New -t option to forge N different source port
    • New -A option to generate increasing number of flows
  • pfcount improvements:
    • New -R option to disable RSS reprogramming
  • pfbridge now discards injected packets

Misc

  • New pf_ringcfg script to automatically configure pf_ring and drivers
  • New pre/post scripts executed by systemd before/after loading pf_ring and drivers
  • Improved hugepages configuration with multiple nodes
  • npcap lib update, storage utility functions fix for NFS

PF_RING 7.4.0 release

21 Dec 17:40
Compare
Choose a tag to compare

PF_RING Library

  • New pfring_open PF_RING_DO_NOT_STRIP_FCS flag to disable FCS/CRC stripping (when supported by the adapter)
  • Improved support for cross-compilation
  • New PF_RING_FT_CONF environment variable to enable PF_RING FT support and load L7 filtering rules
  • New PF_RING_FT_PROTOCOLS environment variable to load L7 protocols when PF_RING FT for L7 filtering is enabled

ZC Library

  • New pfring_zc_open_device flag PF_RING_ZC_DO_NOT_STRIP_FCS to disable FCS/CRC stripping (when supported by the adapter)
  • New builtin hash function pfring_zc_builtin_5tuple_hash based on 5-tuple
  • Fixed SPSC queues BPF support
  • Fixed KVM/ivshmem support on Ubuntu 16
  • Fixed pfring_zc_recv_pkt_burst with ixgbe-zc drivers

FT Library

  • New pfring_ft_set_l7_detected_callback API to set a callback for classified flows/packets (L7 protocol detected)
  • New pfring_ft_set_default_action API to set the default action for classified L7 flows
  • New pfring_ft_flow_get_action API to get the computed/actual flow action asyncronously
  • New pfring_ft_create_table flow_lifetime_timeout parameter to configure the maximum flow duration
  • New pfring_ft_load_ndpi_protocols API to load custom nDPI protocols from a configuration file
  • New pfring_ft_is_ndpi_available API to check nDPI availability
  • Added active_flows to pfring_ft_stats to get the number of currently active flows

PF_RING-aware Libpcap

  • New pcap_get_pfring_handle API to get the PF_RING handle used by Libpcap
  • New PCAP_PF_RING_ALWAYS_SYNC_FD environment variable for applications not using the fd provided by pcap_get_selectable_fd
  • Fix for applications polling from the pcap selectable fd when ZC drivers are used

PF_RING Kernel Module

  • Updates to support kernel 4.18 or older
  • Fixed 'stack' TX capture in ZC mode
  • Fixed ifindex lookup
  • Fixed promiscuous mode corner cases
  • Fixed arm32 support
  • Fixed IPv6 support in software filtering rules
  • Fixed software hash rules
  • Fixed kernel clustering in case of non-IP packets (sporadically recognized as IP fragments when the fragments cache was enabled)

PF_RING Capture Modules

  • Timeline module fixes:
  • Fixed extraction of non-IP packets
  • Fixed permissions check when running as unprivileges user, when the user has permissions on the filesystem
  • Accolade module update to support latest SDK API and features
  • Fixed Fiberblaze module bulk mode

ZC Drivers

  • New ixgbevf ZC driver
  • Drivers updates to support kernel 4.18 or older
  • Fixed sporadic crashes during application startup on high traffic rates
  • Fixed the DKMS packages
  • i40e ZC driver improvements:
    • Forcing symmetric RSS hash on old firmwares
    • Improved interrupts management to fix packets delivered in batches
    • Fixed interrupts management when multiple sockets are active on the same interface (RX+TX or RSS)
  • ixgbe ZC driver improvements:
    • Increased max MTU length to 16K
    • Fixed card reset due to kernel-space TX packets pending while the interface is in use by ZC
  • Improved hardware timestamp support for igb ZC (i350/82580 adapters)

nBPF 

  • Fixed 'portrange' token in BPF-like filters

Examples

  • New pftimeline example to extract traffic from a n2disk dump set using the pf_ring API
  • New pfsend -M option to forge the source MAC address
  • zbalance_ipc improvements:
    • Added -m 6 distribution function (interface X to queue X)
    • Added queues and TX interface stats under /proc (-p)
    • Fixed multiapp (fanout) distribution for more than 32 egress queues
  • ftflow improvements:
    • New -F option to load rules from a configuration file
    • New -p option to load custom protocols
    • Improved output (e.g. printing information including the flow action)
  • Improved ftflow_dpdk example, added bridging support
  • Fixed software filtering in pfcount (enabling full headers when filtering is enabled)

IDS Support (Snort/Bro)

  • Fixed Snort DAQ filtering API
  • Fixed cluster issues on Bro (due to a libpcap symbols issue)

Misc

  • CoreOS support, pf_ring module and drivers installation scripts
  • Improved 'zbalance_ipc' clusters management with systemd:
    • Service improvements to set the status after the cluster process is actually up and running
    • Fixed hugepages memory allocation in case of clusters not using ZC drivers
  • Improved service dependencies with systemd with respect to other ntop applications
  • Added GID to the hugepages configuration file to allow nonprivileged users to use ZC applications

PF_RING 7.2.0 release

13 Jun 09:59
Compare
Choose a tag to compare
  • ZC Library

    • New API pfring_zc_pkt_buff_pull / pfring_zc_pkt_buff_push to manage buffer head room
    • New builtin hash pfring_zc_builtin_gre_hash with support for GRE tunneling
      • zbalance_ipc -m 5 option for enabling GRE hashing
    • Support for up to 64 queues in pfring_zc_send_pkt_multi and pfring_zc_distribution_func
    • Fix for attaching to ZC IPC queues from containers
  • FT Library (New)

    • L7 flow classification and filtering library
    • Event-driven capture-agnostic API
    • Sample applications
      • ftflow: flow records generation with PF_RING capture
      • ftflow_pcap: flow records generation with PCAP capture
      • ftflow_dpdk: flow records generation with DPDK capture
      • fttest: performance benchmarking tool
      • zbalance_ipc extension to process flows and filter packets
  • nBroker (New)

    • Traffic steering and filtering on Intel RRC (FM10K adapters)
    • Daemon to drive the adapter (nbrokerd)
    • API to configure the adapter using a C library (nbrokerlib)
    • Command-line tool with auto-completion to configure the adapter using scripts (nbroker-cli)
    • Low-level library used by nbrokerd to drive the adapter (rrclib)
  • PF_RING-aware Libpcap

    • PCAP_PF_RING_USERSPACE_BPF env var to force userspace filtering instead of kernel filtering
  • PF_RING Kernel Module

    • Full support for namespaces and containers
    • Fixed skbuff forwarding with fast-tx using reflect_packet
    • Fixed VLAN support in BPF with kernel extensions
    • Fixed support for NetXtreme cards with multiple queues
    • Fixed sw hash filtering for IPv6
    • Fixed intel_82599_perfect_filter_hw_rule VLAN byte order
    • Fixed huge rings (high number of slots or huge slot size)
    • Fixed VLAN offset and packet hash in case of QinQ and VLAN offload
    • Support for Ubuntu 18
    • Support for latest Centos 7 kernel
    • Support for latest Debian 8 kernel
  • PF_RING Capture Modules

    • Released source code for FPGA capture modules including Endace, Exablaze, Inveatech, Mellanox, Netcope
    • Accolade lib updates
      • New flag PF_RING_FLOW_OFFLOAD_NOUP to enable flow offload without flow updates (standard raw packets are received, flow id is in the packet hash)
      • Automatically generate the rule ID using rule_id = FILTERING_RULE_AUTO_RULE_ID
      • Support for accolade 200Ku Flex adapters
    • Fiberblaze lib updates
      • Packet recv in chunk mode
    • Fixed extraction from npcap/timeline in case of empty PCAP files in the dump set
    • Endace DAG updates
      • Setting extended_hdr.pkt_hash from ERF FlowID or Packet Signature extension headers if available
      • Support for pfring_set_application_name
      • Support for pfring_dag_findalldevs
    • Napatech lib updates
      • Support for sdk v10
  • Drivers

    • e1000e zc driver update v.3.4.0.2
    • i40e zc driver update v.2.4.6
    • ixgbe zc driver update v.5.3.7
    • igb zc driver update v.5.3.5.18
    • Fixed interrupts handling on i40e when in zc mode, this fixes the case where packets are received in batches of 4/8 packets
    • Using nbrokerd for initializing FM10K adapters and configuring the RRC switch
  • nBPF

    • Fixed rules constraints
  • Misc

    • Reworked init.d systemd support
    • New pf_ringctl script to manage pf_ring and drivers (this is used by init.d/systemd)
    • Documentation improvements, Doxygen integration with "read the docs"