Module pf_ring not found.

I followed the steps for configuring load balancing here:

http://www.bro.org/documentation/load-balancing.html

Everything worked great, but I had to restart the server and now I can’t load the PF_RING module.

sudo modprobe pf_ring enable_tx_capture=0 min_num_slots=32768

FATAL: Module pf_ring not found.

When I run:

ldd /bro/bin/bro | grep pcap

It get the following:

libpcap.so.1 => /opt/pfring/lib/libpcap.so.1 (0x00007f3aeb8ff000)

In the instructions it stated:

“Refer to the documentation for your Linux distribution on how to load the pf_ring module at boot time.”

But I wasn’t able to find any details on how to do so.

Any suggestions?

Thanks,
John

Hi John,

FATAL: Module pf_ring not found.

This would seem to indicate that the kernel can't find the PF_RING
module...Did you happen to update your kernel before that reboot? If so,
you'd likely need to re-compile the PF_RING/kernel and PF_RING/driver
sections to work with the new kernel.

Cheers,

Jesse

Did you upgrade your kernel version before the reboot? You may need to
reinstall the kernel module

Try going back into the PF_RING-5.6.1/kernel directory and running

    make install

upstream pf_ring does not use dkms so if you upgrade the kernel you will
need to reinstall the modules..

I went back and re-ran make install from the kernel directory and got the following output:

mkdir -p /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp *.ko /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp linux/pf_ring.h /usr/include/linux

/sbin/depmod 3.8.0-38-generic

Then I re-ran the command:

modprobe pf_ring enable_tx_capture=0 min_num_slots=32768

And got the error:

FATAL: Error inserting pf_ring (/lib/modules/3.8.0-38-generic/kernel/net/pf_ring/pf_ring.ko): Invalid module format

Then, I went back through the steps of re-running make install, beginning with the directoryPF_RING-5.6.1/userland/lib

Still no luck.

I checked the make file for each before re-running the install to make sure that the prefix was still set.

Thanks,
John

I went back and re-ran make install from the kernel directory and got the
following output:

mkdir -p /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp *.ko /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp linux/pf_ring.h /usr/include/linux

/sbin/depmod 3.8.0-38-generic

Then I re-ran the command:

modprobe pf_ring enable_tx_capture=0 min_num_slots=32768

And got the error:

FATAL: Error inserting pf_ring (/lib/modules/3.8.0-38-generic/kernel/net/
pf_ring/pf_ring.ko): Invalid module format

Ah, try doing a make clean and then a make install. That should install
a working module build for the right kernel.

Then, I went back through the steps of re-running make install, beginning with
the directoryPF_RING-5.6.1/userland/lib

Your problem is with the kernel module so reinstalling the stuff in lib/
would not have helped.

PF_RING doesn’t/didn’t support kernel 3.8 and I’m not sure if that is still the case today. You might try a newer version of PF_RING.

I’m using PF_RING 6.0.

The first time I went through the steps it was working. It was only after restarting, that I couldn’t reload the module.