Releases: ntop/PF_RING
Releases · ntop/PF_RING
PF_RING 7.0.0 release
PF_RING Library
- Flow offload support
- New PF_RING_FLOW_OFFLOAD pfring_open() flag to enable hw flow offload on supported cards (received buffers are native metadata)
- New PF_RING_FLOW_OFFLOAD_NOUPDATES pfring_open() flag to disable flow updates with hw flow offload enabled: only standard raw packets with a flow id are received
- New PKT_FLAGS_FLOW_OFFLOAD_UPDATE packet flag to indicate flow metadata in the received buffer (generic_flow_update struct)
- New PKT_FLAGS_FLOW_OFFLOAD_PACKET packet flag to indicate raw packet with flow_id in pkt_hash
- New PKT_FLAGS_FLOW_OFFLOAD_MARKER packet flag to indicate marked raw packet
- Fixes for ARM systems
ZC Library
- New pfring_zc_set_app_name API
- PF_RING_ZC_PKT_FLAGS_FLOW_OFFLOAD flag to enable hw flow offload
- Fixed BPF filters in SPSC queues
- Fixed hugepages cleanup in case of application dropping privileges
- Fixed sigbus error on hugepages allocation failure on numa systems
- Fixed multiple clusters allocation in a single process
PF_RING-aware Libpcap/Tcpdump
- Libpcap update v.1.8.1
- Tcpdump update v.4.9.2
PF_RING Kernel Module
- Docker/containers namespaces isolation support
- Fixed capture on Raspberry Pi
- Implemented support for VLAN filtering based on interface name (., where ID = 0 accepts only untagged packets)
- New cluster types cluster_per_flow_ip_5_tuple/cluster_per_inner_flow_ip_5_tuple to balance 5 tuple with IP traffic, src/dst mac otherwise
- Fixed hash rule last match, new hash_filtering_rule_stats.inactivity stats
PF_RING Capture Modules
- Accolade flow offload support
- New hw_filtering_rule type accolade_flow_filter_rule to discard or mark a flow
- Netcope support
- New hw_filtering_rule type netcope_flow_filter_rule to discard a flow
- Improved Fiberblaze support
- pfring_get_device_clock support
- Ability to set native filters by setting as BPF string 'fbcard:'
- Fixed TX memory management
- Fixed subnet BPF filters
- Fixed drop counter
- Fixed capture mode
- Fixed sockets not enabled
- FPGA error detection
- Endace DAG update
- npcap/timeline module compressed pcap extraction fix
Drivers
- ixgbe-zc driver update v.5.0.4
- i40e-zc driver update v.2.2.4
nBPF
- Fixed nBPF parser memory leak
Examples
- New pfsend option -L to forge VLAN IDs
- zbalance_ipc improvements
- Ability to dump output to log file (-l)
- Fixed privileges drop (-D)
Misc
- Fixed systemd dependencies, renamed pfring.service to pf_ring.service
- New /etc/pf_ring/interfaces.conf configuration file for configuring management and capture interfaces
PF_RING 6.6.0 release
PF_RING Library
- New pfring_findalldevs/pfring_freealldevs API for listing all interfaces supported by pf_ring
- New timeline module based on libnpcap for seamlessly extracting traffic from a n2disk dumpset using the pf_ring API
- Dynamic capture modules loading with dlopen support
- Improved pfring_set_bpf_filter to set hw rules when supported by the network card thanks to the nBPF engine
ZC Library
- New pfring_zc_set_bpf_filter/pfring_zc_remove_bpf_filter API for setting BPF filters to device queues
- Fixed pfring_zc_queue_is_full for device queues
- Flushing SPSC queues when a consumer attaches (RX only)
PF_RING-aware Libpcap/Tcpdump
- Support for extracting traffix from a n2disk dumpset using libpcap
- tcpdump upgrade to v.4.9.0
PF_RING kernel module
- Support for latest ubuntu and centos stable kernels
- Support for SCTP and ICMP packet parsing
- Packet hash improvements
- Added tunneled IP version to packet metadata
- Added IP version to sw filters
- New kernel cluster hash types for tunneled traffic
- QinQ VLAN parsing
- Removed deprecated kernel plugins support
- Promisc fix in case of multiple devices in a single socket
Drivers
- Support for latest ubuntu and centos stable kernels
- FPGA modules/libraries are now loaded at runtime using dlopen
- RSS support on Intel i211
- Jumbo frames support on i40e
- i40e tx optimisations
- i40e interrupts fixes in case of RSS
- Fiberblaze capture module with chunk mode support
- Exablaze capture module
- Accolade improvements
- Endace DAG update and support for streams
- Myricom ports aggregation fixes, new syntax myri:,
nBPF
- New nBPF filtering engine supporting an extended subset of the BPF syntax (tunneled traffic and l7 protocols are supported)
- nBPF support for hw filtering on Fiberblaze cards
- nBPF support for hw filtering on Intel FM10K cards (Silicom PE3100G2DQIR)
- nBPF support for hw filtering on Exablaze cards
- nBPF support for hw filtering on Napatech cards and NTPL generation
- Support for "start and end and " when extracting from a n2disk timeline
- Support for vlan [id], mpls [label], gtp
Examples
- pfcount:
- ability to list interfaces with -L (-v 1 for more info)
- ability to dump traffic on PCAP file with -o
- psend:
- option to force flush per packet (-F)
- options to specify src/dst IP for packet forging (-S/-D)
- option to forge packets on the fly instead of at preprocessing time (-O)
- option to randomize generated ips sequence (-z)
- ability to generate IPv6 traffic (-V 6)
- ability to generate mixed v4 and v6 traffic (-V 0)
- TCP/UDP checksum when reforging
- zbalance_ipc
- option to use hw aggregation when supported by the card (-w)
- IP-based filtering with ZMQ support for rules injection
Wireshark
- New extcap module 'ntopdump' for Wireshark 2.x
Misc
- Improved systemd support (Ubuntu 16)
PF_RING 6.4.1 release
2016-06-16 PF_RING 6.4.1
- PF_RING Library
- Fixed pfring_get_interface_speed on several capture modules
- PF_RING kernel module
- Fixed packet corruption with standard pf_ring sockets in case of slow consumer
- Drivers
- Fixed 'tx hang' on all drivers
2016-06-07 PF_RING 6.4
- PF_RING Library
- Improved Myricom support, new naming scheme to improve usability
- Improved Napatech support, 100G support
- Improved Accolade support
- New Invea-Tech support
- New API pfring_get_metadata to read ZC metadata
- New pfring_get_interface_speed API
- New API pfring_version_noring()
- C++ wrapper improvements
- Removed DNA legacy
- ZC Library
- New API pfring_zc_set_device_proc_stats to write /proc stats per device
- New API pfring_zc_set_device_app_name to write the application name under /proc
- New API pfring_zc_get_cluster_id to get the cluster ID from a queue
- New API pfring_zc_check_device_license for reading interface license status
- New API pfring_zc_get_queue_settings to read buffer len and metadata len from queue
- New API pfring_zc_get_queue_speed to read the link speed
- New pfring_zc_open_device flag PF_RING_ZC_DEVICE_NOT_PROMISC to open the device without setting promisc mode
- New packet metadata flags, including IP/L4 checksum (when available from card offloads)
- Improved pfring_zc_builtin_gtp_hash
- PF_RING-aware Libpcap/Tcpdump
- New libpcap v.1.7.4
- New tcpdump v.4.7.4
- Libnpcap support to let libpcap-based applications (i.e. tcpdump) read compressed .npcap files produced by n2disk
- Native nanosecond timestamps support
- Tcpdump patch to close the pcap handle in case of errors (this avoids breaking ZC queues)
- PF_RING kernel module
- Fixed BPF support on kernel 4.4.x
- Fixed RSS support on Centos 6 (it was reporting the wrong number of queues, affecting RSS rehash)
- Reworked promisc support: handling promisc through the pf_ring kernel module in order to automatically remove it even when applications drop privileges
- VLAN ID fix in case of vlan stripping offload enabled (it was including priority bits)
- Drivers
- New i40e-zc v.1.5.18
- New fm10k-zc v.0.20.1
- Support for latest Ubuntu 16, RHEL 6.8, Centos 7
- Fixed i40e-zc initialisation failures due to promisc reset
- Fixed i40e-zc 'transmit queue 0 timed out'
- Fixed e1000e-zc memory leak
- Examples
- Added ability to reforge MAC/IP also when reading packets from pcap file/stdin in pfsend
- Added -f option for replaying packets from pcap file in zsend
- Added -o option to pfsend to specify an offset to be used with -b
- Added -r option to use egress interfaces instead of queues in zbalance_ipc
- Snort DAQ
- Fixed DAQ-ZC buffer leak in IPC mode
- Fixed DAQ_DP_ADD_DC support
- Fixed support for DAQ < 2.0.6
PF_RING 6.4.0 release
v6.4.0 Merge branch 'dev' of https://github.com/ntop/PF_RING into dev