Issue using ZC (zerocopy) interface notation

Tue Dec 23 11:37:36 EST 2014

It works for me (at least using zbalance_ipc) with this patch against 3.0.8:

--- argus/ArgusSource.c.orig    2014-07-14 23:51:49.000000000 +0100
+++ argus/ArgusSource.c 2014-09-05 11:09:11.690740097 +0100
@@ -4382,7 +4382,7 @@
    if (device == NULL)
       return;

-   if ((strstr(device->name, "dag")) || (strstr(device->name, "napa"))) {
+   if ((strstr(device->name, "dag")) || (strstr(device->name, "napa"))
|| (strstr(device->name, "dna")) || (strstr(device->name, "zc")) ||
((strstr(device->name, "eth")) && (strstr(device->name, "@")))) {
       for (i = 0; i < src->ArgusInterfaces; i++) {
          if (src->ArgusInterface[i].ArgusPd)
             bzero ((char *)&src->ArgusInterface[i].ifr, sizeof(ifr));

It even manages not to use 100% CPU now, so I guess polling is working
better in ZC than DNA.

Best Wishes,
Chris

On 23/12/14 16:16, Carter Bullard wrote:
> Hey Jesse,
> No, it looks like we try to open the device, but like the other programs, we don’t think there is a device ‘zc:99 at 0’.
> Argus gets the error, and since we don’t have any exceptional logic to look for the device somewhere else, we just chug along.  Maybe the device will appear later.
> 
> I suspect that there is some logic in tcpdump to do something else for PF_RING’s pseudo interfaces ???
> I’ll try to take a look, but its holiday time !!!!!
> 
> Carter
> 
>> On Dec 22, 2014, at 5:00 PM, Jesse Bowling <jessebowling at gmail.com> wrote:
>>
>>
>> On Dec 22, 2014, at 3:06 PM, Carter Bullard <carter at qosient.com> wrote:
>>
>>> Hmmmm, we must need to do something specific for PF_RING….
>>> you say there are examples ???  which version of tcpdump works ??
>>
>> The PF_RING team ships with tcpdump 4.1.1 included in source (which works) and I just successfully compiled the latest version 4.6.2 against the PF_RING provided libpcap in /usr/local/lib and it also works fine.
>>
>> For examples I really only have what’s in the first email (if I understand what you’re asking)...My assumption was that something was choking on the colon used in ‘zc:99 at 0’ since the switch allows for things like ‘ind:’ and ‘dup:’, etc...
>>
>> Here’s a giant wall of debug text in case that’s helpful...
>>
>> Cheers,
>>
>> Jesse
>>
>> # argus -D 6 -i 'zc:99 at 0' -w - |ra -r - 
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.502856 ArgusCalloc (1, 525024) returning 0x7fc6eced4010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.502996 ArgusNewModeler() returning 0x7fc6eced4010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503019 ArgusCalloc (1, 4237776) returning 0x7fc6ebe15010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503034 ArgusNewSource(0x7fc6eced4010) returning 0x7fc6ebe15010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503046 ArgusCalloc (1, 336) returning 0xb080d0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503056 ArgusCalloc (1, 152) returning 0xb08b50
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503064 ArgusNewQueue () returning 0xb08b50
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503073 ArgusCalloc (1, 152) returning 0xb08bf0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503081 ArgusNewList () returning 0xb08bf0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503088 ArgusCalloc (1, 152) returning 0xb08c90
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503095 ArgusNewList () returning 0xb08c90
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503102 ArgusNewOutput() returning retn 0xb080d0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503119 setArgusMarReportInterval(60) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503141 clearArgusDevice(0x7fc6ebe15010) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503151 ArgusCalloc (1, 152) returning 0xb08d30
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503159 ArgusNewList () returning 0xb08d30
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503174 ArgusCalloc (1, 64) returning 0xb08dd0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503183 ArgusPushFrontList (0xb08d30, 0xb08dd0, 1) returning 0x336b
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503192 setArgusDevice(zc:99 at 0 ) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503200 ArgusDeleteList ((nil), 2) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503208 ArgusCalloc (1, 152) returning 0xb08e20
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503216 ArgusNewList () returning 0xb08e20
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503223 ArgusCalloc (1, 24) returning 0xb08230
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503230 ArgusPushFrontList (0xb08e20, 0xb08230, 1) returning 0x336b
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503240 setArgusInterfaceStatus(0x7fc6ebe15010, 1)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.503267 ArgusCalloc (1, 592072) returning 0x7fc6ece43010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516046 ArgusCalloc (1, 128) returning 0xbb8280
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516073 ArgusGenerateInitialMar() returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516082 ArgusCalloc (1, 168) returning 0xbb8310
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516100 ArgusCalloc (1, 262256) returning 0x7fc6ece02010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516109 ArgusCalloc (1, 152) returning 0xbb83c0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516117 ArgusNewList () returning 0xbb83c0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516128 ArgusNewSocket (1) returning 0x7fc6ece02010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516143 ArgusPushBackList (0xb08e20, 0xb08230, 1) returning 1
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516152 ArgusDeleteList (0xb08e20, 2) 1 items on list
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516160 ArgusFree (0xb08230)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516169 ArgusFree (0xb08e20)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516175 ArgusDeleteList (0xb08e20, 2) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516235 ArgusInitOutput() done
>>  ArgusWarning: 22 Dec 14 16:57:12.516258 started
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516277 ArgusCalloc (1, 4237776) returning 0x7fc6eaffd010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516286 ArgusCalloc (1, 152) returning 0xb08e20
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516294 ArgusNewList () returning 0xb08e20
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516305 ArgusCloneSource(0x7fc6ebe15010) returning 0x7fc6eaffd010
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516313 clearArgusDevice(0x7fc6eaffd010) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.516321 ArgusPushBackList (0xb08e20, 0xb08dd0, 1) returning 1
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.516331 ArgusOutputProcess(0xb080d0) starting
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.516367 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.516375 ArgusOutputProcess() waiting for input list
>>    ArgusAlert: 22 Dec 14 16:57:12.535223 ArgusOpenInterface: pcap_open_live zc:99 at 0: No such device exists (SIOCGIFHWADDR: No such device)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.535245 ArgusOpenInterface(0x7fc6eaffd010, 'zc:99 at 0') returning 0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.535258 ArgusPushBackList (0xb08e20, 0xb08dd0, 1) returning 1
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.535266 ArgusInitSource: no packet sources for this device.
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:12.535274 ArgusInitSource(0x7fc6eaffd010) returning 0
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.616511 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.616557 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.616566 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.616573 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.716710 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.716741 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.716753 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.716759 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.816904 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.816935 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.816946 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.816955 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.917083 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.917107 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.917116 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:12.917123 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.017240 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.017270 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.017279 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.017286 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.117440 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.117468 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.117477 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.117484 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.217640 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.217668 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.217677 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.217684 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.317850 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.317878 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.317887 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.317894 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.418016 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.418044 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.418053 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.418060 ArgusOutputProcess() waiting for input list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.518186 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.518209 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.518218 ArgusOutputProcess() looping
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.518225 ArgusOutputProcess() waiting for input list
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535409 main() ArgusSourceProcess returned: shuting down
>>  ArgusWarning: 22 Dec 14 16:57:13.535731 ArgusShutDown(0)
>>  ArgusWarning: 22 Dec 14 16:57:13.535743 argus() [0x40665b]
>>  ArgusWarning: 22 Dec 14 16:57:13.535749 argus() [0x405fea]
>>  ArgusWarning: 22 Dec 14 16:57:13.535754 /lib64/libc.so.6(__libc_start_main+0xf5) [0x7fc6ec241af5]
>>  ArgusWarning: 22 Dec 14 16:57:13.535759 argus() [0x404179]
>>
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535768 ArgusShutDown(Normal Shutdown)
>>
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535809 ArgusCloseSource(0x7fc6ebe15010) starting
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535818 ArgusDeleteList (0xb08d30, 3) 0 items on list
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535826 ArgusFree (0xb08d30)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535834 ArgusDeleteList (0xb08d30, 3) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535843 ArgusModelerCleanUp (0x7fc6eced4010) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535854 ArgusCloseModeler(0x7fc6eced4010) Total Sends 0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535863 ArgusCloseSource(0x7fc6ebe15010) done
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535870 ArgusCloseEvents() done
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535879 ArgusModelerCleanUp (0x7fc6eced4010) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535886 ArgusCloseModeler(0x7fc6eced4010) Total Sends 0
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.535893 ArgusCloseOutput(0xb080d0) scheduling closure after 0 records
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618344 ArgusOutputProcess() checking out clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618373 ArgusOutputProcess() done with clients
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618382 ArgusOutputProcess(0xb080d0) shuting down 0
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618398 ArgusWriteOutSocket (0xb080d0, 0xbb8310) returning 0
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618407 ArgusDeleteList (0xbb83c0, 4) 0 items on list
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618415 ArgusFree (0xbb83c0)
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618421 ArgusDeleteList (0xbb83c0, 4) returning
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618518 ArgusFree (0x7fc6ece02010)
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618526 ArgusDeleteSocket (0x7fc6ece02010) returning
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618535 ArgusFree (0xbb8310)
>> argus[13163.0087c0ebc67f0000]: 22 Dec 14 16:57:13.618540 ArgusOutputProcess(0xb080d0) exiting
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618696 ArgusDeleteList (0xb08c90, 4) 0 items on list
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618729 ArgusFree (0xb08c90)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618741 ArgusDeleteList (0xb08c90, 4) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618750 ArgusDeleteList (0xb08bf0, 4) 0 items on list
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618758 ArgusFree (0xb08bf0)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618765 ArgusDeleteList (0xb08bf0, 4) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618772 ArgusFree (0xb08b50)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618780 ArgusDeleteQueue (0xb08b50) returning
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.618787 ArgusFree (0xbb8280)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619847 ArgusFree (0x7fc6ece43010)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619861 ArgusCloseOutput(0xb080d0) done
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619869 ArgusFree (0xb080d0)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619937 ArgusFree (0x7fc6eced4010)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619947 ArgusDeleteSource(0x7fc6ebe15010) starting
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619961 ArgusFree (0x7fc6ebe15010)
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619970 ArgusCloseSource(0x7fc6ebe15010) done
>> argus[13163.4057f5ecc67f0000]: 22 Dec 14 16:57:13.619986 ArgusShutDown()
>>
>>
> 

-- 
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 2908
Whiteknights, Reading, RG6 6AF, UK              Fax: +44 (0)118 975 3094

