Re: PF_RING FT API implementation

Alfredo Cardigliano <[email protected]> Fri, 22 Jun 2018 09:29:30 +0200
Newsgroups	gmane.linux.ntop.general
Message-ID	<[email protected]>

> On 22 Jun 2018, at 04:32, Harish Patil <[email protected]> wrote:
> 
> Thanks Alfredo/Emanuele.
> 
>  I am seeing the below message:
> 
> #########################################################################
> # ERROR: You do not seem to have a valid PF_RING FT 7.3.0.180617 license [ECFE456A76066A02]
> # ERROR: Please get one at http://shop.ntop.org/ <http://shop.ntop.org/>.
> #########################################################################
> # We're now working in demo mode with packet capture and
> # transmission limited to 5 minutes
> 
> Is there a need to buy a licensed version? Is this newly introduced in the later releases?

Yes, PF_RING FT, included in latest stable, requires a license.

> Few questions regarding the PF_RING FT API behavior:
> 
> 1) Does pfring_ft_process() makes a copy of the packet using the pointer passed to it? If so, does it copy only the header or entire packet including payload?

No packet copy at all.

> 2) Is it safe for me to release/free the buffers after calling pfring_ft_process()?

Yes

> 3) Do you have performance numbers doing inline DPI for 1G or 10G links?

You should be able to do 10Gbit line-rate, however this also depends on your hw. Please note you can use multiple threads (with RSS or ZC software distribution) if 1 core is not enough.

> 4) Does PF_RING FT/nDPI maintain state information to detect a flow OR does it just uses the packet passed to parse L7 info?

It keeps some state, as 1 packet is often not enough.

Regards
Alfredo

> 
> Thanks
> 
> Harish
> 
> 
> 
> On Wed, Jun 13, 2018 at 12:14 AM, Alfredo Cardigliano <[email protected] <mailto:[email protected]>> wrote:
> Hi Harish
> we are currently using those libs to compile our applications on many distributions
> including Ubuntu 14/16/18, Centos 6/7, Debian 7/8/9, please let us know if you
> experience issues with the compilation, and we will find a way to handle that.
> 
> Regards
> Alfredo
> 
> 
>> On 13 Jun 2018, at 01:40, Harish Patil <[email protected] <mailto:[email protected]>> wrote:
>> 
>> Hi Alfredo,
>> 
>> Thanks for the response.
>> We are planning to use PF_RING FT in our projects.
>> We only have shared libs. How can we integrate and make sure it works in all cases (platforms/GCC)?
>> If we had the sources we could compile along with sources and would be much better.
>> 
>> Thanks.
>> Harish
>> 
>> 
>> 
>> On Mon, Jun 11, 2018 at 9:20 AM, Alfredo Cardigliano <[email protected] <mailto:[email protected]>> wrote:
>> Hi Harish
>> no plan atm, however we tried to create a flexible framework, meaning
>> that people should be able to extend it using the API we created.
>> Please let us know if something is missing for your use case.
>> 
>> Thank you
>> Alfredo
>> 
>>> On 11 Jun 2018, at 18:10, Harish Patil <[email protected] <mailto:[email protected]>> wrote:
>>> 
>>> Hi Emanuele,
>>> Thanks for the response.
>>> I didn't know that it was not open sourced and didn't expect it either given that other modules are open sourced.
>>> Are there any plans of open sourcing them?
>>> 
>>> Thanks.
>>> 
>>> 
>>> On Mon, Jun 11, 2018 at 1:37 AM, Emanuele Faranda <[email protected] <mailto:[email protected]>> wrote:
>>> Hello,
>>> 
>>> Sorry but PF_RING FT is not open source.
>>> 
>>> Regards,
>>> Emanuele
>>> 
>>> On 06/08/2018 04:00 AM, Harish Patil wrote:
>>>> Hi,
>>>> 
>>>> I am new to ntop/ndpi.
>>>> I'm looking for source code of PF_RING FT such as implementations of:
>>>>  pfring_ft_create_table() or pfring_ft_process() etc which uses ndpi lib.
>>>> 
>>>> I only see the function defines in userland/lib/pfring_ft.h but not the implementation.
>>>> Could you pls provide some pointers?
>>>> 
>>>> 
>>>> Thanks,
>>>> 
>>>> Harish
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________
>>>> Ntop mailing list
>>>> [email protected] <mailto:[email protected]>
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>
>>> 
>>> _______________________________________________
>>> Ntop mailing list
>>> [email protected] <mailto:[email protected]>
>>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>
>>> 
>>> _______________________________________________
>>> Ntop mailing list
>>> [email protected] <mailto:[email protected]>
>>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>
>> 
>> _______________________________________________
>> Ntop mailing list
>> [email protected] <mailto:[email protected]>
>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>
>> 
>> _______________________________________________
>> Ntop mailing list
>> [email protected] <mailto:[email protected]>
>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>
> 
> _______________________________________________
> Ntop mailing list
> [email protected] <mailto:[email protected]>
> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>
> 
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
signature.asc (application/pgp-signature, 833 B)