- 浏览: 52206 次
- 性别:
- 来自: 北京
最新评论
-
lehehe:
基站定位,使用接口很方便的,这里有免费的接口,你可以试试,ht ...
google API基站定位 -
donkeyji:
yongqi 写道hi,你好,请教一个问题我在安装python ...
python zeromq 介绍 -
yongqi:
hi,你好,请教一个问题我在安装python的zeromq包时 ...
python zeromq 介绍 -
mimicom:
看着晕乎乎的....
python zeromq 介绍 -
raojl:
不错,好像zeromq就在2011年一夜之间火了,特别的blo ...
python zeromq 介绍
1. PF_RING 安装
A clean install, no other packages were installed other than mentioned(提到).
1. Uninstall libpcap and other dependent applications/library using apt-get
原因?
2. Install subversion(Get latest source codes)
flex and bison(Required to recompile pf_ring aware pcap)
ethtool(if not preinstalled, required for some basic Nic info of your computer)
sudo apt-get install subversion flex bison ethtool
3. Use Subversion to fetch source codes
svn co https://svn.ntop.org/svn/ntop/trunk/PF_RING/ PF_RING
[卸载本机网卡驱动]
4. Check your current network card/driver using ethtool
#change eth0 to your ethernet card ethtool -i eth0
Sample:
driver: e1000e
version: 1.0.2-k2
firmware-version: 0.4-3
bus-info: 0000:00:19.0
Note: The modified device drivers for some of the popular network cards can be found in PF_RING/drivers.
5. Unload the ethernet card driver(this is shown in the first line of output of above command)
sudo rmmod e1000e
[编译安装kernel]
6. Change current working directory to kernel
cd PF_RING/kernel
7. Make the source codes
make
8. Now install the newly build source
sudo make install
[编译安装用户态库]
9. Change the working directory to PF_RING/userland/lib
cd ../userland/lib
10. Again build the source codes
make
11. Install the library(This include pfring.h)
sudo make install
[注意] 在最新版本没有出现pfring_e1000e_dna.c和pfring_e1000e_dna.h这两个文件
12. One bizerre(奇异) thing that I observed(观察) is that the make install copies pfring.h to /usr/local/include but leaves the other dependent files these are:
1. pfring_e1000e_dna.c
2. pfring_e1000e_dna.h
13. Although the function in these files are not required in much of the program, they are include in pfring.h and i don't want to mess up with that.So we copy this to /usr/local/include.
cp pfring_e1000e_dna.c /usr/local/include cp pfring_e1000e_dna.h /usr/local/include
[编译安装PF_RING可用pcap库]
14. Now we have to compile PF_RING aware pcap library. Change the working directory to userland/libpcap-1.0.0-ring
cd ../libpcap-1.0.0-ring/
15. Configure
./configure
16. Build the sources
make
17. Install pf_ring aware(知道) libpcap
sudo make install
[安装PF_RING可用设备驱动, 选择适合本机的]
18. Now we need to install the device driver(pf_ring aware). Change the working directory to drivers///src
In my case it is "drivers/intel/e1000e-1.0.15/src"
cd ../../drivers/intel/e1000e-1.0.15/src
19. Build the source
make
20. Install the driver
sudo make install
[激活PF_RING使其加载到内核工作]
21. Now we need to activate PF_RING if its not already activated. You can use Ismod to check if pf_ring is started or not.
Change the working directory to /lib/modules//kernel/net/pf_ring
Use uname -r to get the kernel version
cd /lib/modules/2.6.31-14-generic/kernel/net/pf_ring
22. Enable PF_RING(if already enabled you can disable it using sudo rmmod pf_ring)
sudo insmod pf_ring.ko transparent_mode=1
Note:
• transparent_mode=0 (default)
Packets are received via the standard Linux interface. Any driver can use this mode.
• transparent_mode=1 (Both vanilla and PF_RING-aware drivers)
Packets are memcpy() to PF_RING and also to the standard Linux path.
• transparent_mode=2 (PF_RING -aware drivers only)
Packets are ONLY memcpy() to PF_RING and not to the standard Linux path (i.e. tcpdump won't see
anything).
The higher is the transparent_mode value, the faster it gets packet capture.
Other parameters:
• min_num_slots
Min number of ring slots (default — 4096).
• enable_tx_capture
Set to 1 to capture outgoing packets, set to 0 to disable capture outgoing packets (default — RX+TX).
• enable_ip_defrag
Set to 1 to enable IP defragmentation, only rx traffic is defragmented.
More on transparent mode can be found at http://www.ntop.org/blog/?p=56
[使驱动开始工作]
23. Now enable to enable your driver go to /lib/modules//kernel/drivers/net/e1000e
cd /lib/modules/2.6.31-14-generic/kernel/drivers/net/e1000e
24. Enable the driver
sudo insmod e1000e.ko
25. Now you can start working on your PF_RING application.
Note: You will have to recompile many applications such as tcpdump(modified included), network manager etc. Google for doing so.
2. PF_RING demo
概括来说PF_RING是即简单又有力量的技术,能够使开发者用在少量的时间里创建高速传输监控和应用。
Checking PF_RING Device Configuration
When PF_RING is activated, a new entry /proc/net/pf_ring is created.
cat /proc/net/pf_ring/info
cat /proc/net/pf_ring/plugins_info
libpfring and libpcap is necessary to link you PF_RING-enabled applications also against the -lpthread library.
使用相关命令来查看抓包情况(userland/examples)
dmesg或/var/log/messages可以看到PF_RING的信息
发表评论
-
rails model best practices
2011-05-11 09:50 0name_scope :active, :conditions ... -
Ruby标准库
2011-05-10 15:02 0ruby标准库一览 文本 base64 yaml ... -
rails3测试理解
2011-04-30 10:23 1299Why RSpec? Clear, concise and ... -
linux系统备注
2011-04-29 10:49 1136bin "Essential binaries&qu ... -
vim备注
2011-04-29 10:03 0vim -
ruby
2011-04-28 10:33 1047Ruby编程基础知识概括: 1. ruby is an ob ... -
Javascript简明手册
2011-04-25 10:07 0Javascript和C++,java,Python一样是一种 ... -
KVM
2011-04-24 09:36 01 kvm安装 前期准备 ... -
Jquery
2011-04-22 16:10 01. jQuery解决了什么样的问题? -
CSS相关知识
2011-04-22 16:02 7091. CSS是一种为结构化文档添加样式的计算机语言 使 ... -
Mysql相关知识
2011-04-22 14:30 11351. Mysql常规使用 安装 server: sudo ... -
thrift实践
2011-04-08 11:52 14511 安装thrift 通过svn获得源码 svn co h ... -
Cmake + protobuf-c + python自定义协议通信
2011-03-29 11:25 4754Cmake是一套跨平台的工程构建工具 sudo apt ... -
清除历史记录
2011-03-18 10:40 01. 选型 [语言] C++ [平台] wind ... -
pyzmq 使用
2011-03-16 16:02 50451. The Socket API Creating an ... -
nginx X-Accel-Redirect实现文件下载权限控制及rails devise实现
2011-03-14 13:52 3264问题1:Nginx的X-Accel-Redirect? 答: ... -
python zeromq 介绍
2011-03-10 10:38 11101简介: ZeroMQ并不是一个对socket的封装,不能用它 ... -
fabric自动部署
2011-03-09 14:00 2591Fabric commands run - run a ... -
nagios的工作场景及使用说明
2011-03-08 10:15 2021问题1:nagios配置文件说明? 答: comman ... -
在ubuntu下安装nagios监控平台
2011-03-07 16:56 1569问题1:Nagios是什么? 答:是一个监视系统运行状态和网 ...
相关推荐
pf_ring捕包代码,支持两种过滤方式
PF_RING_学习笔记,详细描述了PF_RING 设计、PF_RING源代码分析、PF_RING使用等技术,是不可多得的好资料
Linux下PF_RING高速数据包捕获库的使用说明。 版本5.4.4中文翻译版本。
pf_ring 4.5.0 svn同步下来的源代码。
PF_RING是Luca研究出来的基于Linux内核级的高效数据包捕获技术。简单来说PF_RING 是一个高速数据包捕获库,通过它可以实现将通用 PC 计算机变成一个有效且便宜的网络测量工具箱,进行数据包和现网流量的分析和操作。...
PF_RING是一种可显着提高数据包捕获速度新型的网络套接字。
PF_RING用户指南.V5.4.4.pdf 中文版 1.介绍 1.1. PF_RING 用户指南的更新列表 2.欢迎进入 PF_RING 2.1. 数据包过滤 2.2. 数据包流程 2.3. 数据包汇聚 3.PF_RING 驱动家族 4.DNA 的 Libzero 库 5.PF_RING 安装 6....
自己破解的PF_RING DNA 5分钟授权限制的版本。
PF_RING-6.2.0.tar.gz
LINUX系统中基于PF_RING套接字的高性能包捕获技术
在IDS中,传统数据分组的捕获是从网卡复制到内核,再由内核复制到用户空间,这导致了...为了提升捕获包效率,采用多线程思想,通过PF_RING ZC技术实现零拷贝,把PF_RING ZC捕获数据分组的方法做成动态链接库,并集成到Snort中
多核CPU下基于PF_RING和设备轮询机制的高性能包捕获技术研究
PF_RING DNA模式默认免受全授权版本! 1> 本版本免受权暂时只支持X86_64,linux内核版本2.6.32及其以上(我用CentOS6.5-X86_64) 2> ZC模式暂不支持,请使用DNA模式相关驱动 3> 本版本请勿用于商业用途,纯属做性能...
本人对pf_ring 的翻译,希望批评指正,共同提高
pf_ring,通过修改系统内核提高基于Linux和libcap的抓包效率
pfring是一个功能强大的抓包工具,可在10G的线速的线速进行抓包,使用负载均衡的方法可以让你以更高的线速进行抓包甚至可达100G。本文档详细介绍了PF_RING中的多种负载均衡方法。
关于pf_ring的user guide;里面包含pf_ring的结构和配置。
PF RING DNA 破解 Zero copy
为了减少这些因素的影响,提出将PF_RING与NAPI结合应用到捕包过程,以对性能进行整体优化。比较了PF_RING与传统数据包捕获机制的差异,分析了两者结合的优势,搭建实验平台,采用内核发包形式,进行实验仿真。在仿真...