Module pf_ring not found.

Zeek
1

I followed the steps for configuring load balancing here:

http://www.bro.org/documentation/load-balancing.html

Everything worked great, but I had to restart the server and now I can’t load the PF_RING module.

sudo modprobe pf_ring enable_tx_capture=0 min_num_slots=32768

FATAL: Module pf_ring not found.

When I run:

ldd /bro/bin/bro | grep pcap

It get the following:

libpcap.so.1 => /opt/pfring/lib/libpcap.so.1 (0x00007f3aeb8ff000)

In the instructions it stated:

“Refer to the documentation for your Linux distribution on how to load the pf_ring module at boot time.”

But I wasn’t able to find any details on how to do so.

Any suggestions?

Thanks,
John

2

Hi John,

FATAL: Module pf_ring not found.

This would seem to indicate that the kernel can't find the PF_RING
module...Did you happen to update your kernel before that reboot? If so,
you'd likely need to re-compile the PF_RING/kernel and PF_RING/driver
sections to work with the new kernel.

Cheers,

Jesse

3

Did you upgrade your kernel version before the reboot? You may need to
reinstall the kernel module

Try going back into the PF_RING-5.6.1/kernel directory and running

    make install

upstream pf_ring does not use dkms so if you upgrade the kernel you will
need to reinstall the modules..

4

I went back and re-ran make install from the kernel directory and got the following output:

mkdir -p /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp *.ko /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp linux/pf_ring.h /usr/include/linux

/sbin/depmod 3.8.0-38-generic

Then I re-ran the command:

modprobe pf_ring enable_tx_capture=0 min_num_slots=32768

And got the error:

FATAL: Error inserting pf_ring (/lib/modules/3.8.0-38-generic/kernel/net/pf_ring/pf_ring.ko): Invalid module format

Then, I went back through the steps of re-running make install, beginning with the directoryPF_RING-5.6.1/userland/lib

Still no luck.

I checked the make file for each before re-running the install to make sure that the prefix was still set.

Thanks,
John

5

I went back and re-ran make install from the kernel directory and got the
following output:

mkdir -p /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp *.ko /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp linux/pf_ring.h /usr/include/linux

/sbin/depmod 3.8.0-38-generic

Then I re-ran the command:

modprobe pf_ring enable_tx_capture=0 min_num_slots=32768

And got the error:

FATAL: Error inserting pf_ring (/lib/modules/3.8.0-38-generic/kernel/net/
pf_ring/pf_ring.ko): Invalid module format

Ah, try doing a make clean and then a make install. That should install
a working module build for the right kernel.

Then, I went back through the steps of re-running make install, beginning with
the directoryPF_RING-5.6.1/userland/lib

Your problem is with the kernel module so reinstalling the stuff in lib/
would not have helped.

6

PF_RING doesn’t/didn’t support kernel 3.8 and I’m not sure if that is still the case today. You might try a newer version of PF_RING.

7

I’m using PF_RING 6.0.

The first time I went through the steps it was working. It was only after restarting, that I couldn’t reload the module.