Argus with PF_RING DNA clusters

[Chris Wakelin]

I've just found in ArgusModeler.c

> ArgusCreateIPv6Flow (struct ArgusModelerStruct *model, struct ip6_hdr *ip)
> {

...

> 
> #ifdef _LITTLE_ENDIAN
>       ip->ip6_plen = ntohs(ip->ip6_plen);
> #endif 

Is that modifying the packet or a copy? It would match my symptoms of
truncated IPv6 packets :-/

Best Wishes,
Chris

On 27/09/12 22:38, Chris Wakelin wrote:
> Yes, 3.0.6.1 with a fix to ArgusSource.c to allow PF_RING DNA interfaces
> and Intel virtual interfaces (ethX at Y):
> 
>> @@ -4182,7 +4187,7 @@
>>     if (device == NULL)
>>        return;
>>  
>> -   if (strstr(device->name, "dag") || strstr(device->name, "nap")) {
>> +   if (strstr(device->name, "dag") || strstr(device->name, "nap") || strstr(device->name, "dna") || (strstr(device->name, "eth") && strstr(device->name, "@"))) {
>>        for (i = 0; i < src->ArgusInterfaces; i++) {
>>           if (src->ArgusInterface[i].ArgusPd && (pcap_fileno(src->ArgusInterface[i].ArgusPd) > 0))
>>              bzero ((char *)&src->ArgusInterface[i].ifr, sizeof(ifr));
> 
> 
> Best Wishes,
> Chris
> 
> On 27/09/12 22:32, Carter Bullard wrote:
>> Hmmmm, not thinking that we modify packets, but will look.  Your
>> running argus-3.0.6+ ?  Thanks for the bug report !!!!
>>
>> Carter
>>
>> On Sep 27, 2012, at 5:00 PM, Chris Wakelin
>> <c.d.wakelin at reading.ac.uk> wrote:
>>
>>> Hi,
>>>
>>> I've been having some more problems with ARGUS and PF_RING DNA
>>> clusters. It turns out that with ARGUS running, the other
>>> applications reading the same packets are seeing truncated IPv6
>>> packets. As soon as ARGUS is stopped, things go back to normal.
>>>
>>> E.g. tcpdump output:
>>>
>>>> 18:45:36.174466600 IP6 truncated-ip6 - 5355 bytes
>>>> missing!2001:630:53:26:5026:29a2:5863:dbaf.65226 >
>>>> 2a00:1450:400c:c06::5d.443: Flags [.], seq 2651079285:2651084641,
>>>> ack 1774208329, win 259, length 5356 18:45:36.174535600 IP6
>>>> truncated-ip6 - 8160 bytes missing!2a00:1450:400c:c06::5d.443 >
>>>> 2001:630:53:26:5026:29a2:5863:dbaf.65226: Flags [.], seq 1:8161,
>>>> ack 1, win 272, options [nop,nop,sack 1 {0:1}], length 8160
>>>
>>> The PF_RING clusters use a zero-copy mechanism which means that
>>> each application is seeing the exact same chunk of memory. Is it
>>> possible that ARGUS is modifying this, in particular for the IPv6
>>> handling?
>>>
>>> The "select() returning immediately" problem is still there, but
>>> the PF_RING authors say they're working on a fix. They don't think
>>> the IPv6 issue is related.
>>>
>>> Best Wishes, Chris
>>>
> 


-- 
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 2908
Whiteknights, Reading, RG6 6AF, UK              Fax: +44 (0)118 975 3094