Issue using ZC (zerocopy) interface notation
Carter Bullard
carter at qosient.com
Tue Dec 23 11:16:10 EST 2014
Hey Jesse,
No, it looks like we try to open the device, but like the other programs, we don’t think there is a device ‘zc:99 at 0’.
Argus gets the error, and since we don’t have any exceptional logic to look for the device somewhere else, we just chug along. Maybe the device will appear later.
I suspect that there is some logic in tcpdump to do something else for PF_RING’s pseudo interfaces ???
I’ll try to take a look, but its holiday time !!!!!
Carter
> On Dec 22, 2014, at 5:00 PM, Jesse Bowling <jessebowling at gmail.com> wrote:
>
>
> On Dec 22, 2014, at 3:06 PM, Carter Bullard <carter at qosient.com> wrote:
>
>> Hmmmm, we must need to do something specific for PF_RING….
>> you say there are examples ??? which version of tcpdump works ??
>
> The PF_RING team ships with tcpdump 4.1.1 included in source (which works) and I just successfully compiled the latest version 4.6.2 against the PF_RING provided libpcap in /usr/local/lib and it also works fine.
>
> For examples I really only have what’s in the first email (if I understand what you’re asking)...My assumption was that something was choking on the colon used in ‘zc:99 at 0’ since the switch allows for things like ‘ind:’ and ‘dup:’, etc...
>
> Here’s a giant wall of debug text in case that’s helpful...
>
> Cheers,
>
> Jesse
>
> # argus -D 6 -i 'zc:99 at 0' -w - |ra -r -
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.502856 ArgusCalloc (1, 525024) returning 0x7fc6eced4010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.502996 ArgusNewModeler() returning 0x7fc6eced4010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503019 ArgusCalloc (1, 4237776) returning 0x7fc6ebe15010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503034 ArgusNewSource(0x7fc6eced4010) returning 0x7fc6ebe15010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503046 ArgusCalloc (1, 336) returning 0xb080d0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503056 ArgusCalloc (1, 152) returning 0xb08b50
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503064 ArgusNewQueue () returning 0xb08b50
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503073 ArgusCalloc (1, 152) returning 0xb08bf0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503081 ArgusNewList () returning 0xb08bf0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503088 ArgusCalloc (1, 152) returning 0xb08c90
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503095 ArgusNewList () returning 0xb08c90
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503102 ArgusNewOutput() returning retn 0xb080d0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503119 setArgusMarReportInterval(60) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503141 clearArgusDevice(0x7fc6ebe15010) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503151 ArgusCalloc (1, 152) returning 0xb08d30
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503159 ArgusNewList () returning 0xb08d30
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503174 ArgusCalloc (1, 64) returning 0xb08dd0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503183 ArgusPushFrontList (0xb08d30, 0xb08dd0, 1) returning 0x336b
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503192 setArgusDevice(zc:99 at 0 ) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503200 ArgusDeleteList ((nil), 2) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503208 ArgusCalloc (1, 152) returning 0xb08e20
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503216 ArgusNewList () returning 0xb08e20
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503223 ArgusCalloc (1, 24) returning 0xb08230
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503230 ArgusPushFrontList (0xb08e20, 0xb08230, 1) returning 0x336b
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503240 setArgusInterfaceStatus(0x7fc6ebe15010, 1)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503267 ArgusCalloc (1, 592072) returning 0x7fc6ece43010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516046 ArgusCalloc (1, 128) returning 0xbb8280
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516073 ArgusGenerateInitialMar() returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516082 ArgusCalloc (1, 168) returning 0xbb8310
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516100 ArgusCalloc (1, 262256) returning 0x7fc6ece02010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516109 ArgusCalloc (1, 152) returning 0xbb83c0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516117 ArgusNewList () returning 0xbb83c0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516128 ArgusNewSocket (1) returning 0x7fc6ece02010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516143 ArgusPushBackList (0xb08e20, 0xb08230, 1) returning 1
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516152 ArgusDeleteList (0xb08e20, 2) 1 items on list
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516160 ArgusFree (0xb08230)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516169 ArgusFree (0xb08e20)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516175 ArgusDeleteList (0xb08e20, 2) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516235 ArgusInitOutput() done
> ArgusWarning: 22 Dec 14 16:57:12.516258 started
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516277 ArgusCalloc (1, 4237776) returning 0x7fc6eaffd010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516286 ArgusCalloc (1, 152) returning 0xb08e20
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516294 ArgusNewList () returning 0xb08e20
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516305 ArgusCloneSource(0x7fc6ebe15010) returning 0x7fc6eaffd010
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516313 clearArgusDevice(0x7fc6eaffd010) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516321 ArgusPushBackList (0xb08e20, 0xb08dd0, 1) returning 1
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.516331 ArgusOutputProcess(0xb080d0) starting
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.516367 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.516375 ArgusOutputProcess() waiting for input list
> ArgusAlert: 22 Dec 14 16:57:12.535223 ArgusOpenInterface: pcap_open_live zc:99 at 0: No such device exists (SIOCGIFHWADDR: No such device)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.535245 ArgusOpenInterface(0x7fc6eaffd010, 'zc:99 at 0') returning 0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.535258 ArgusPushBackList (0xb08e20, 0xb08dd0, 1) returning 1
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.535266 ArgusInitSource: no packet sources for this device.
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.535274 ArgusInitSource(0x7fc6eaffd010) returning 0
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.616511 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.616557 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.616566 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.616573 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.716710 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.716741 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.716753 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.716759 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.816904 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.816935 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.816946 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.816955 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.917083 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.917107 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.917116 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.917123 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.017240 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.017270 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.017279 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.017286 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.117440 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.117468 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.117477 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.117484 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.217640 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.217668 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.217677 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.217684 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.317850 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.317878 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.317887 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.317894 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.418016 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.418044 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.418053 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.418060 ArgusOutputProcess() waiting for input list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.518186 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.518209 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.518218 ArgusOutputProcess() looping
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.518225 ArgusOutputProcess() waiting for input list
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535409 main() ArgusSourceProcess returned: shuting down
> ArgusWarning: 22 Dec 14 16:57:13.535731 ArgusShutDown(0)
> ArgusWarning: 22 Dec 14 16:57:13.535743 argus() [0x40665b]
> ArgusWarning: 22 Dec 14 16:57:13.535749 argus() [0x405fea]
> ArgusWarning: 22 Dec 14 16:57:13.535754 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fc6ec241af5]
> ArgusWarning: 22 Dec 14 16:57:13.535759 argus() [0x404179]
>
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535768 ArgusShutDown(Normal Shutdown)
>
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535809 ArgusCloseSource(0x7fc6ebe15010) starting
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535818 ArgusDeleteList (0xb08d30, 3) 0 items on list
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535826 ArgusFree (0xb08d30)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535834 ArgusDeleteList (0xb08d30, 3) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535843 ArgusModelerCleanUp (0x7fc6eced4010) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535854 ArgusCloseModeler(0x7fc6eced4010) Total Sends 0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535863 ArgusCloseSource(0x7fc6ebe15010) done
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535870 ArgusCloseEvents() done
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535879 ArgusModelerCleanUp (0x7fc6eced4010) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535886 ArgusCloseModeler(0x7fc6eced4010) Total Sends 0
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535893 ArgusCloseOutput(0xb080d0) scheduling closure after 0 records
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618344 ArgusOutputProcess() checking out clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618373 ArgusOutputProcess() done with clients
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618382 ArgusOutputProcess(0xb080d0) shuting down 0
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618398 ArgusWriteOutSocket (0xb080d0, 0xbb8310) returning 0
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618407 ArgusDeleteList (0xbb83c0, 4) 0 items on list
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618415 ArgusFree (0xbb83c0)
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618421 ArgusDeleteList (0xbb83c0, 4) returning
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618518 ArgusFree (0x7fc6ece02010)
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618526 ArgusDeleteSocket (0x7fc6ece02010) returning
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618535 ArgusFree (0xbb8310)
> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618540 ArgusOutputProcess(0xb080d0) exiting
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618696 ArgusDeleteList (0xb08c90, 4) 0 items on list
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618729 ArgusFree (0xb08c90)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618741 ArgusDeleteList (0xb08c90, 4) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618750 ArgusDeleteList (0xb08bf0, 4) 0 items on list
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618758 ArgusFree (0xb08bf0)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618765 ArgusDeleteList (0xb08bf0, 4) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618772 ArgusFree (0xb08b50)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618780 ArgusDeleteQueue (0xb08b50) returning
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618787 ArgusFree (0xbb8280)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619847 ArgusFree (0x7fc6ece43010)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619861 ArgusCloseOutput(0xb080d0) done
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619869 ArgusFree (0xb080d0)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619937 ArgusFree (0x7fc6eced4010)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619947 ArgusDeleteSource(0x7fc6ebe15010) starting
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619961 ArgusFree (0x7fc6ebe15010)
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619970 ArgusCloseSource(0x7fc6ebe15010) done
> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619986 ArgusShutDown()
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20141223/bc1fe781/attachment.bin>
More information about the argus
mailing list