PF_RING 7.0.0 release

PF_RING Library

• Flow offload support
  • New PF_RING_FLOW_OFFLOAD pfring_open() flag to enable hw flow offload on supported cards (received buffers are native metadata)
  • New PF_RING_FLOW_OFFLOAD_NOUPDATES pfring_open() flag to disable flow updates with hw flow offload enabled: only standard raw packets with a flow id are received
  • New PKT_FLAGS_FLOW_OFFLOAD_UPDATE packet flag to indicate flow metadata in the received buffer (generic_flow_update struct)
  • New PKT_FLAGS_FLOW_OFFLOAD_PACKET packet flag to indicate raw packet with flow_id in pkt_hash
  • New PKT_FLAGS_FLOW_OFFLOAD_MARKER packet flag to indicate marked raw packet
• Fixes for ARM systems

ZC Library

• New pfring_zc_set_app_name API
• PF_RING_ZC_PKT_FLAGS_FLOW_OFFLOAD flag to enable hw flow offload
• Fixed BPF filters in SPSC queues
• Fixed hugepages cleanup in case of application dropping privileges
• Fixed sigbus error on hugepages allocation failure on numa systems
• Fixed multiple clusters allocation in a single process

PF_RING-aware Libpcap/Tcpdump

• Libpcap update v.1.8.1
• Tcpdump update v.4.9.2

PF_RING Kernel Module

• Docker/containers namespaces isolation support
• Fixed capture on Raspberry Pi
• Implemented support for VLAN filtering based on interface name (., where ID = 0 accepts only untagged packets)
• New cluster types cluster_per_flow_ip_5_tuple/cluster_per_inner_flow_ip_5_tuple to balance 5 tuple with IP traffic, src/dst mac otherwise
• Fixed hash rule last match, new hash_filtering_rule_stats.inactivity stats

PF_RING Capture Modules

• Accolade flow offload support
  • New hw_filtering_rule type accolade_flow_filter_rule to discard or mark a flow
• Netcope support
  • New hw_filtering_rule type netcope_flow_filter_rule to discard a flow
• Improved Fiberblaze support
  • pfring_get_device_clock support
  • Ability to set native filters by setting as BPF string 'fbcard:'
  • Fixed TX memory management
  • Fixed subnet BPF filters
  • Fixed drop counter
  • Fixed capture mode
  • Fixed sockets not enabled
  • FPGA error detection
• Endace DAG update
• npcap/timeline module compressed pcap extraction fix

Drivers

• ixgbe-zc driver update v.5.0.4
• i40e-zc driver update v.2.2.4

nBPF

• Fixed nBPF parser memory leak

Examples

• New pfsend option -L to forge VLAN IDs
• zbalance_ipc improvements
  • Ability to dump output to log file (-l)
  • Fixed privileges drop (-D)

Misc

• Fixed systemd dependencies, renamed pfring.service to pf_ring.service
• New /etc/pf_ring/interfaces.conf configuration file for configuring management and capture interfaces

PF_RING 6.6.0 release

PF_RING Library

• New pfring_findalldevs/pfring_freealldevs API for listing all interfaces supported by pf_ring
• New timeline module based on libnpcap for seamlessly extracting traffic from a n2disk dumpset using the pf_ring API
• Dynamic capture modules loading with dlopen support
• Improved pfring_set_bpf_filter to set hw rules when supported by the network card thanks to the nBPF engine

ZC Library

• New pfring_zc_set_bpf_filter/pfring_zc_remove_bpf_filter API for setting BPF filters to device queues
• Fixed pfring_zc_queue_is_full for device queues
• Flushing SPSC queues when a consumer attaches (RX only)

PF_RING-aware Libpcap/Tcpdump

• Support for extracting traffix from a n2disk dumpset using libpcap
• tcpdump upgrade to v.4.9.0

PF_RING kernel module

• Support for latest ubuntu and centos stable kernels
• Support for SCTP and ICMP packet parsing
• Packet hash improvements
• Added tunneled IP version to packet metadata
• Added IP version to sw filters
• New kernel cluster hash types for tunneled traffic
• QinQ VLAN parsing
• Removed deprecated kernel plugins support
• Promisc fix in case of multiple devices in a single socket

Drivers

• Support for latest ubuntu and centos stable kernels
• FPGA modules/libraries are now loaded at runtime using dlopen
• RSS support on Intel i211
• Jumbo frames support on i40e
• i40e tx optimisations
• i40e interrupts fixes in case of RSS
• Fiberblaze capture module with chunk mode support
• Exablaze capture module
• Accolade improvements
• Endace DAG update and support for streams
• Myricom ports aggregation fixes, new syntax myri:,

nBPF

• New nBPF filtering engine supporting an extended subset of the BPF syntax (tunneled traffic and l7 protocols are supported)
• nBPF support for hw filtering on Fiberblaze cards
• nBPF support for hw filtering on Intel FM10K cards (Silicom PE3100G2DQIR)
• nBPF support for hw filtering on Exablaze cards
• nBPF support for hw filtering on Napatech cards and NTPL generation
• Support for "start and end and " when extracting from a n2disk timeline
• Support for vlan [id], mpls [label], gtp

Examples

• pfcount:
  • ability to list interfaces with -L (-v 1 for more info)
  • ability to dump traffic on PCAP file with -o
• psend:
  • option to force flush per packet (-F)
  • options to specify src/dst IP for packet forging (-S/-D)
  • option to forge packets on the fly instead of at preprocessing time (-O)
  • option to randomize generated ips sequence (-z)
  • ability to generate IPv6 traffic (-V 6)
  • ability to generate mixed v4 and v6 traffic (-V 0)
  • TCP/UDP checksum when reforging
• zbalance_ipc
  • option to use hw aggregation when supported by the card (-w)
  • IP-based filtering with ZMQ support for rules injection

Wireshark

• New extcap module 'ntopdump' for Wireshark 2.x

Misc

• Improved systemd support (Ubuntu 16)

PF_RING 6.4.1 release

---

2016-06-16 PF_RING 6.4.1

• PF_RING Library
  • Fixed pfring_get_interface_speed on several capture modules
• PF_RING kernel module
  • Fixed packet corruption with standard pf_ring sockets in case of slow consumer
• Drivers
  • Fixed 'tx hang' on all drivers

---

2016-06-07 PF_RING 6.4

• PF_RING Library
  • Improved Myricom support, new naming scheme to improve usability
  • Improved Napatech support, 100G support
  • Improved Accolade support
  • New Invea-Tech support
  • New API pfring_get_metadata to read ZC metadata
  • New pfring_get_interface_speed API
  • New API pfring_version_noring()
  • C++ wrapper improvements
  • Removed DNA legacy
• ZC Library
  • New API pfring_zc_set_device_proc_stats to write /proc stats per device
  • New API pfring_zc_set_device_app_name to write the application name under /proc
  • New API pfring_zc_get_cluster_id to get the cluster ID from a queue
  • New API pfring_zc_check_device_license for reading interface license status
  • New API pfring_zc_get_queue_settings to read buffer len and metadata len from queue
  • New API pfring_zc_get_queue_speed to read the link speed
  • New pfring_zc_open_device flag PF_RING_ZC_DEVICE_NOT_PROMISC to open the device without setting promisc mode
  • New packet metadata flags, including IP/L4 checksum (when available from card offloads)
  • Improved pfring_zc_builtin_gtp_hash
• PF_RING-aware Libpcap/Tcpdump
  • New libpcap v.1.7.4
  • New tcpdump v.4.7.4
  • Libnpcap support to let libpcap-based applications (i.e. tcpdump) read compressed .npcap files produced by n2disk
  • Native nanosecond timestamps support
  • Tcpdump patch to close the pcap handle in case of errors (this avoids breaking ZC queues)
• PF_RING kernel module
  • Fixed BPF support on kernel 4.4.x
  • Fixed RSS support on Centos 6 (it was reporting the wrong number of queues, affecting RSS rehash)
  • Reworked promisc support: handling promisc through the pf_ring kernel module in order to automatically remove it even when applications drop privileges
  • VLAN ID fix in case of vlan stripping offload enabled (it was including priority bits)
• Drivers
  • New i40e-zc v.1.5.18
  • New fm10k-zc v.0.20.1
  • Support for latest Ubuntu 16, RHEL 6.8, Centos 7
  • Fixed i40e-zc initialisation failures due to promisc reset
  • Fixed i40e-zc 'transmit queue 0 timed out'
  • Fixed e1000e-zc memory leak
• Examples
  • Added ability to reforge MAC/IP also when reading packets from pcap file/stdin in pfsend
  • Added -f option for replaying packets from pcap file in zsend
  • Added -o option to pfsend to specify an offset to be used with -b
  • Added -r option to use egress interfaces instead of queues in zbalance_ipc
• Snort DAQ
  • Fixed DAQ-ZC buffer leak in IPC mode
  • Fixed DAQ_DP_ADD_DC support
  • Fixed support for DAQ < 2.0.6

PF_RING 6.4.0 release

v6.4.0

Merge branch 'dev' of https://github.com/ntop/PF_RING into dev