Global Sources
EE Times-India
Stay in touch with EE Times India
EE Times-India > Embedded

Using the PF_RING for improved lossless packet capturing

Posted: 23 Oct 2009     Print Version  Bookmark and Share

Keywords:kernel PF_RING  lossless capturing packet  network packet 

When the above script gets executed it will automatically download the specified kernel source and apply the PF_RING patch. A new directory with the specified and patched kernel will be available.

The specifier "PF_RING" will appear at the end of the kernel version. For the example of the 2.6.24 kernel, the directory /usr/src/kernels/ the directory $PF_RING/workspace/linux-2.6.24PF_RING will be created.

The top level Makefile needs to be modified to specify a specific kernel build. For the 2.6.24 kernel it needs to be like this:


It was noticed also that the file "net/ring/Kconfig" could give some errors during the kernel configuration and line 12 (blank line) needed to be deleted. Following this, the kernel needs to be configured. The user can do it their preferred way, the authors executed:

make menuconfig

PF_RING needs to be also compiled as a module. The option in the .config file is


The kernel then can be built and installed. The user should not forget to build and install the modules along with the (preferably NAPI enabled) network driver.

Compiling the modified libpcap
The PF_RING package contains a modified libpcap as explained above. It can be found in


where X.Y.Z is the version of the libpcap the downloaded PF_RING version was built to support. In this directory the pcapint. h and pcap-linux.c files can be found.

They need to replace the files with the same name in the original libpcap version X.Y.Z. At the time this work was conducted, libpcap could be downloaded from

After it has been downloaded and unzipped/untarred the two files from the PF_RING version need to replace the original ones as mentioned at the beginning of this section. Also in the pcap-linux.c file, the lines

#define HAVE_PF_RING
//#undef HAVE_PF_RING

need to be uncommented/commented accordingly so HAVE_PF_RING is defined, in order for the PF_RING to be enabled. Following that the library needs to be configured and built.

 First Page Previous Page 1 • 2 • 3 • 4 Next Page Last Page

Comment on "Using the PF_RING for improved lossl..."
*  You can enter [0] more charecters.
*Verify code:


Visit Asia Webinars to learn about the latest in technology and get practical design tips.


Go to top             Connect on Facebook      Follow us on Twitter      Follow us on Orkut

Back to Top