Re: pfring-daq-module

[Russ Combs <rcombs () sourcefire com>]

On Wed, Dec 12, 2012 at 12:05 PM, Lawrence R. Hughes, Sr. <
lhughes () safemedia com> wrote:

> **
> Thanks Russ.. Can you please tell me who wrote the code for the daq-2.0.0?

That would be Sourcefire.

> ----- Original Message -----
> *From:* Russ Combs <rcombs () sourcefire com>
> *To:* snort-sers <snort-users () lists sourceforge net> ;
> lhughes () safemedia com
> *Sent:* Wednesday, December 12, 2012 9:56 AM
> *Subject:* Fwd: pfring-daq-module
>
> Luca usually responds to questions about the PFRING DAQ.
>
> If you are having performance issues with Snort 294 we will need more info
> like CPU usage, profiling stats, etc. but it looks like you need to rule
> out DAQ issues first.
>
> ---------- Forwarded message ----------
> From: Joel Esler <jesler () sourcefire com>
> Date: Tue, Dec 11, 2012 at 6:48 PM
> Subject: Re: pfring-daq-module
> To: "Lawrence R. Hughes, Sr." <lhughes () safemedia com>
> Cc: safwat fahmy <safwat.fahmy () safemedia com>, "<bugs () snort org>" <
> bugs () snort org>
>
>
>  Unfortunately Larry, I can't troubleshoot this for you by myself.  I try
> to answer as many emails as I can, but I can't get to them all.
>
> Cc'ing bugs () snort org where this stuff should go.
>
> --
> *Joel Esler*
> Sent from my iPhone 
>
> On Dec 11, 2012, at 6:00 PM, "Lawrence R. Hughes, Sr." <
> lhughes () safemedia com> wrote:
>
>  Joel,
>
> We downloaded the following pfring-daq-module from your site:
>
>
>  PFRING External DAQ
>
> Made popular by Luca Deri, Sourcefire’s Michael Altizer ported Luca’s
> PFRING DAQ Module to the above framework.
>
> pfring-daq-module-0.1.tar.gz<http://s3.amazonaws.com/snort-org/www/assets/162/pfring-daq-module-0.1.tar.gz>
>
> It does not appear to be compatible with NTOP's latest release of PF_Ring
> 5.5.1 and daq-2.0.0 or snort-2.9.4
>
> We want to use the pf_ring module with snort 2.9.4 but PF_Ring 5.5.1 is
> giving us major packet drops?
>
> We were using an earlier version of PF_Ring with daq-0.6.2 and
> snort-2.9.3.1 and had zero packet drops running at 900meg (packet gen)?
>
> Another fallback, is the new pfring-daq-module does not allow br0 while in
> inline mode it requires: eth0:eth1
>
> Is this problem with snort-2.9.4?
>
> Please help us out on this please?
>
> Thanks,
>
> Larry
------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!