PF_RING 8.8.0

Key Features

• Support for Napatech Flow Manager
• Support for NVIDIA BlueField 2/3

PF_RING Library

• Add pfring_flow_update struct and pfring_recv_flow
• Add PF_RING_FLOW_OFFLOAD flag to enable Flow Table offload on supported adapters
• Add PF_RING_FLOW_OFFLOAD_AUTO_UNLEARN to control tcp auto unlearn
• Add PF_RING_KEEP_CRC flag (required by Napatech)
• Fix pfring_zc_send_pkt_multi return code

PF_RING Kernel Module

• Add flow_id to generic_flow_tuple_hw_rule
• Fix crash with more than 64 rss queues
• Various minor fixes

FT Library

• Add pfring_ft_zmq_get_stats API
• Add slice action

PF_RING Capture Modules and ZC Drivers

• Add support for Napatech Flow Manager (Flow Table offload)
• Add support for NVIDIA BlueField (ARM64)
• Add jumbo support for ice-zc
• Add support for Napatech zero-copy forwarding (pfring_send_last_rx_packet)
• Fix all Intel drivers compilation on latest kernels (including Ubuntu 24)
  • ixgbevf-zc driver update v.4.18.9
  • i40e-zc driver update v.2.24.6
  • iavf-zc driver update v.4.9.5
• Extend Napatech interface name to support adapter ID
• Fix drop counter on NVIDIA/Mellanox Connect-X (read phy discards in addition to buffer discards)
• Fix crash with more than 64 rss queues
• Fix iavf (i40e VF) ring initialization
• Fix driver dependency intel_auxiliary

PF_RING-aware Libpcap/Tcpdump

• New pfring-aware tcpdump 4.99.4

Examples

• New pfflow_offload sample app with support for Napatech Flow Manager
• pfsend
  • Fix ipv6 packet forging
  • Add eth header when replaying RAW capture files
  • Add -U / -K options to control flow distribution
  • Fix on the fly packets generation
  • Fix -A when -O is used
• pfsend_multichannel
  • Add -C to support multiple TX channels with Napatech
• pfbridge
  • Add support for Napatech zero-copy forwarding

Misc

• Improve pf_ringctl to auto generate hugepages.conf based on numa nodes
• Change MAX_CAPLEN to 65600 to correctly handle max jumbo packet size
• Remove deprecated code for Accolade and fm10k

PF_RING 8.6.1

• PF_RING Library

• New pfring_set_cluster_consumer API to set a kernel cluster with (optional) consumer queue id and support for options (pfring_set_cluster() is set as deprecated)

• PF_RING Kernel Module

• Implement 'relaxed' distribution mode in the kernel cluster to deliver packets to the first available queue if a consumer is down (CLUSTER_OPTION_RELAXED_DISTRIBUTION)
• Support for kernel 6.4+

• PF_RING Capture Modules and ZC Drivers

• New ice zc driver v.1.12.7
• New ixgbe zc driver v.5.19.6
• New igb zc driver v.5.14.16
• Add auto DDP install in ice dkms packages

• Examples

• pfsend:
  • Add -G for seding traffic on two interfaces (one per direcion)
  • Improve TX rate precision adjust the transmission rate to compensate cpu freq fluctuations
• pfcount: print both lib and kernel module versions

• Misc

• Fix hugepages file parsing (/etc/hugepages.conf)

PF_RING 8.6 Release

• PF_RING Library

• New Runtime Manager for injecting and removing filtering rules to the socket via Redis
• Fix memory leaks in PCAP module
• Fix caplen/MTU on loopback capture

• PF_RING Kernel Module

• Add support for probabilistic sampling with kernel capture

• FT Library

• Improve application protocol guess with nDPI

• PF_RING Capture Modules and ZC Drivers

• Add initial support for NVIDIA/Mellanox BlueField
• Add Napatech ns timestamp in PCAP mode
• Add support for probabilistic sampling with userspace capture
• Optimize hw timestamping on ice adapters (Intel E810)
• Fix timestamp support when using the ZC burst API with ice adapters
• Fix drivers compilation on Kernel 6.x
• Fix drivers compilation on RH 8.8

• nPCAP

• Fix memory corruption with big index files

• PF_RING-aware Libpcap/Tcpdump

• Add PF_RING support to pcap_inject
• Fix pcap_read_pf_ring return code (number of packets)

• Examples

• zbalance_ipc: add support for multiple balancer threads when using NVIDIA/Mellanox adapters
• pfsend: add -c option to balance on dest ip rather than src up
• pfcount: compute drop rate in packet mode only
• pfcount: report expired licenses
• Fix ftflow_dpdk compilation on DPDK 22 or later
• Fix memory leaks in pcount, alldevs, preflect, ftflow_pcap,

• Misc

• Add support for Debian 12
• Add libelf and libbpf dependencies to packages
• Add sbsigntool dependency which includes kmodsign required by dkms
• Add revision to pfring-dkms dependency in packages
• Fix check for init/systemd presence
• Cleanup support for legacy adapters

PF_RING 8.4 Release

PF_RING Library

• New API pfring_get_ethtool_link_speed
• Add vlan_id to flow rule struct
• Add optimization flags to BPF filters compiled with pcap_compile
• Fix pfring_open_multichannel

PF_RING Kernel Module

• Add keep_vlan_offload option to avoid reinserting VLAN header on VLAN interfaces when used inline

ZC Library

• New ZC APIs (available on supported adapters)
  • pfring_zc_get_device_clock
  • pfring_zc_set_device_clock
  • pfring_zc_adjust_device_clock
  • pfring_zc_send_pkt_get_time
• Add new pfring_zc_run_fanout_v3 API to support more than 64 fan-out queues
• Add support for capturing stack packets, used by zcount and zbalance_ipc

PF_RING Capture Modules and ZC Drivers

• New iavf-zc driver to support i40e and ice Virtual Functions
  • Support for VF trust mode on ice adapters (promisc with SR-IOV)
• Improve ice driver (E810 adapters)
  • Update ice driver to v.1.9.11
  • Add support to get time, set time, adjust time, send get time
• Improvei the NVIDIA/Mellanox (mlx) driver
  • Extend hardware rules
  • Add support for VLAN filtering
  • Add set_default_hw_action API
  • Fix reported link speed
  • Fix bidirectional rules
  • Fix pfring_poll support
• Improve the Napatech driver
  • Add nanosecond timestamp capture when using the packet API in PCAP chunk mode
• Improve the ZC drivers API to support more callbacks
• Add socket extensions (getsockopt/setsockopt):
  • SO_GET_DEV_STATS (get_stats ZC drivers callback)
  • SO_GET_DEV_TX_TIME (get_tx_time ZC drivers callback)
  • SO_SET_DEV_TIME (set_time ZC drivers callback)
  • SO_SET_ADJ_TIME (adjust_time ZC drivers callback)
• Add management_only_mode to allow opening multiple sockets on the same ZC interface
• Update drivers to support latest RH 9.1, Ubuntu 22, Debian kernels

FT Library

• Fix double free

nBPF

• Add icmp protocol primitive support

nPCAP

• Update npcap lib to support for nanosecond time in packet extraction

PF_RING-aware Libpcap/Tcpdump

• Update tcpdump to v.4.99.1
• Update libpcap to v.1.10.1

Examples

• Add ztime example
  • Ability to set/adjust the card clock without capturing/transmitting traffic (external process)
  • Test for the send-get-time feature
• pfsend
  • Flush queued packets when waiting at real pcap rate and on shutdown
  • Fix headers ranzomization
  • Fix crash with -z
• pfsend_multichannel
  • Add support for controlling IPs generated
• pfcount
  • Add -I option to print interface info in JSON format
• pfcount_multichannel
  • Print full packet metadata with -v
• zbalance_ipc
  • Add support for up to 128 queues with -m 1 and -m 2 (new v3 api)
  • Add -X option to capture TX traffic (standard driver only)
  • Fix check for queues limit
• zdelay
  • Fix queue size (power of 2)

Misc

• Add pfcount_multichannel and pfsend_multichannel to packages
• Service script (pf_ringctl)
  • Add support for configuring RSS via ethtool
  • Add pre/post scripts for ZC drivers
  • Handle multi-line driver conf file
• Removed obsolete fm10k driver

PF_RING 8.2 Release

PF_RING Library

• New new pfring_get_caplen API
• New pfring_get_link_type API
• Add src_ip_mask and dst_ip_mask to generic_flow_rule
• Add priority to hw_filtering_rule
• Add module version to device info returned by pfring_findalldevs
• Refactor device name parsing
• Use sockaddr_ll in bind (to supports interface names longer than 14 chars)

ZC Library

• New Mellanox support for ConnectX 4/5/6 adapters, including hardware offloads for timestamp, filtering, RSS
• Fix pfring_zc_numa_get_cpu_node

FT Library

• Add native support for flow export over ZMQ

PF_RING Kernel Module

• Add support for VXLAN
• Add support for both sockaddr and sockaddr_ll in bind
• Refactor kernel locking
• Discard VLAN in hash cluster_per_flow_ip_with_dup_tuple calculation
• Detect when a process owning a PF_RING socket changes the PID (e.g. fork)
• Export process PID to userspace
• Fix compilation on latest kernels for Rocky Linux and RH 8.5, Debian 9, 10, 11, Ubuntu 18, 20, 22
• Fix net namespace handling
• Fix crash when renaming /proc entries

PF_RING Capture Modules

Fix drop statistics on Napatech with HBA set

ZC Drivers

• New igb-zc driver v.5.10.2
• New i40e-zc driver v.2.17.4
• New ice-zc driver v.1.8.8

nBPF

• Fix double free

Examples

• New sample application pfsend_multichannel to send traffic using RSS
• New zdelay application to forward traffic between interfaces, adding a configurable delay
• pfcount_multichannel: remove limit on number of threads
• zbalance_ipc: improve hashing modes (e.g. add -Y to control eth type)
• pfcount:
  • Add -0 to steer all traffic to RSS queueu 0
  • Add -P to set rule priority
• ftflow_dpdk:
  • Set RSS mode/hf (required on some adapters e.g. Mellanox)
  • Use time from hardware timestamp when available

Misc

• Add support for Ubuntu 22
• Remove nBroker support (fm10k adapters are EOL)

PF_RING 8.0 Release

PF_RING Library

• Add pfring_recv_burst API allowing batch receive (when supported by the capture module/adapter)
• New zero-copy AF_XDP support (reworked), including pfring_recv_burst support
• Fix breakloop when using pfring_loop

ZC Library

• New pfring_zc_pkt_buff_data_from_cluster API to get the packet buffer providing packet handle and cluster
• New pfring_zc_pkt_data_buff API to get the packet handle providing packet buffer and cluster
• New pfring_zc_pkt_buff_pull_only API to remove data from the head room of a packet
• Add PF_RING_ZC_BUFFER_HEAD_ROOM define (buffer head room size)
• Add PF_RING_ZC_SEND_PKT_MULTI_MAX_QUEUES define (max number of queues in queues_mask)

FT Library

• New pfring_ft_api_version API to get the API version
• New pfring_zc_precompute_cluster_settings API to get memory information before allocating resources
• Add VXLAN encapsulation support
• Add tunnel_id to flow metadata
• Add support for compiling examples with DPDK >=20
• Fix L7 metadata with short flows

PF_RING-aware Libpcap/Tcpdump

• Set 5-tuple clustering as default when using clustering with libpcap

PF_RING Kernel Module

• Support for kernel >=5.9
• Add more info to /proc, including promisc mode and ZC slots info
• Handle long interface name (error on interface length bigger than 14-char as supported by bind)
• Fix channel selection when channel is unknown (e.g. VM)
• Fix triple VLAN tags with hw offload/acceleration
• Fix check on mapped memory size
• Fix potential data race in SO_SET_APPL_NAME
• Fix OOB access

PF_RING Capture Modules

• Accolade library update (SDK 1_2_20210714)
• Napatech library update (SDK 12.7.2.1)
• Silicom/Fiberblaze library update (SDK 3_5_9_1)
• Add steer_to_ring and ring_id fields to Accolade rules (accolade_hw_rule)
• Add support for recv burst on Napatech adapters in chunk mode
• Add PF_RING_PACKET_CAPTURE_PRIO env var to set hostBufferAllowance on Napatech adapters
• Rename ACCOLADE_RING_BLOCKS env var to ANIC_RING_BLOCKS on Accolade adapters (default is now 16)
• Fix Accolade drop counter when capturing from rings
• Fix extraction of packets with nsec timestamps on Timeline module (n2disk dump)

ZC Drivers

• New ice ZC driver v.1.3.2 (Intel Columbiaville / E810 adapters) with symmetric RSS support
• Support latest kernels, including RH/CentOS 8.4 and Ubuntu 20, for all ZC drivers
• i40e ZC driver update (v.2.13.10)
• e1000e ZC driver update (v.3.8.7)

nBPF

• New nBPF primitives 'device ' and 'interface ' to match metadata from Arista MetaWatch devices

• Examples

• pfcount
  • Add -B option (burst mode)
• pfsend
  • Add -n support with -f
  • Add support to reforge src/dst IP from pcap with -S and -D
• ftflow
  • Add -E option to run extra DPI dissection (e.g. to print JA3 info)
• zbalance_ipc
  • Add runtime reload of nDPI protocol configuration file
  • Add -m 7 option (sample distribution based on eth type)
  • Add default configuration file /etc/cluster/cluster.conf (when no option is specified)

Misc

• Move libraries and utility scripts from /usr/local to /usr
• Install pfring-aware tcpdump with packages
• Add revision to pfring-dkms version

PF_RING 7.8.0 release

PF_RING Library

• Add support for Device ID and Port ID to the extended packet header
• Add Arista 7150 Series hw timestamps support (keyframes and packet trailer parsing and stripping)
• Add Metawatch Metamako hw timestamps support (packet trailer parsing and stripping)
• errno EINTR is now returned on breakloop
• Improve XDP support
• Replace configure --enable-xdp with --disable-xdp (XDP enabled by default when supported)

ZC Library

• New PF_RING_ZC_DEVICE_METAWATCH_TIMESTAMP flag to enable Metawatch hw timestamps
• New pfring_zc_get_pool_id API to get the Pool ID
• New pfring_zc_run_balancer_v2 pfring_zc_run_fanout_v2 APIs to support filtering functions
• BPF support in ZC interfaces, standard interfaces and SPSC queues
• Add support for BPF in TX queues
• Builtin GTP hash now expose GTP info (flags)
• Fix CRC strip on ixgbevf

• FT Library

• New pfring_ft_flow_get_id API to get the flow ID
• New PFRING_FT_IGNORE_HW_HASH flag to ignore hw packet hash
• New PKT_FLAGS_FLOW_OFFLOAD_1ST packet flag (first packet of a flow)
• Add support for flow slicing
• New API pfring_ft_flow_get_users to get flow users (in case of slicing)
• Improve application protocol detection
• Fix bogus-IP headers parsing

PF_RING-aware Libpcap/Tcpdump

• New libpcap v.191
• New tcpdump v.4.9.3
• stats.ps_recv now includes packets dropped due to out of buffer space

PF_RING Kernel Module

• Fix channels with standard drivers
• Fix 64-bit channel mask
• Fix defragmentation of packets with ethernet padding
• Fix unnecessary device mapping causing ifindex exhaustion

PF_RING Capture Modules

• Update support for Fiberblaze adapters
• Fix filtering with Accolade adapters

ZC Drivers

• New ice ZC driver supporting E800 Series Intel adapters
• Support for Ubuntu 20 LTS
• Support for CentOS/RedHat 8.2
• Fix queue attach/detach in ixgbe-zc
• Support for kernel 5.4

nBPF

• Add support for matching Local/Remote IP (new extended-BPF primitives)
• Support uppercase AND/OR in extended-BPF filters
• Fix extended-BPF grammar

Examples

• New zfilter_mq_ipc sample app (packet filtering with multiple threads and fanout to multiple consumer processes)
• ftflow:
  • New -H option to ignore hw hash setting PFRING_FT_IGNORE_HW_HASH
  • New -t option to print stats only
• ftflow_dpdk
  • New -l option to run loopback tests
  • Add RX/TX ring size configuration
• pfsend:
  • New -z option to precompute randomized sequence
  • New -W ID[,ID] option to forge VLAN and QinQ VLAN
• zbalance_ipc:
  • New -x option to filter by VLAN ID
  • Add ability to set BPF to egress queues
  • Add ability to refresh BPF filters at runtime
  • New -G : option to forward GTP-C traffic to a specific queue
• New zcount -f option to set BPF filters
• New pfcount -F option (do not strip FCS)
• New zcount/zcount_ipc -t option to read the packet payload
• New pcount -e option to set the capture direction
• Add VLAN to the flows dumped by ftflow
• Fix transmission of small packets (less than 60 bytes)
• Fix CPU affinity in ZC sample applications

Misc

• Handle failures in service restart during package updates
• Add linux headers dependency to the pfring-dkms package
• Add actual version/revision to pfring-drivers-zc-dkms packages
• Fix installed .so library and links
• Fix ZC DAQ compilation and API update
• Fix service scripts to avoid command injections

PF_RING 7.6.0 release

PF_RING Library

• New pfring_open flag PF_RING_TX_BPF to evaluate the BPF filter also for TX
• New pfring_open flag PF_RING_FLOW_OFFLOAD_TUNNEL to dissect tunneled traffic in flow-offload mode
• New pfring_open flag PF_RING_DISCARD_INJECTED_PKTS to discard stack-injected packets

ZC Library

• New API call pfring_zc_close_device to close a ZC interface
• New 'flags' parameter to pfring_zc_create_cluster
• Fixed memory allocation in case of more than 4GB of buffer size

FT Library

• New API call pfring_ft_set_filter_all_protocols to reset all filtering rules
• New API call pfring_ft_set_license to set a license at runtime
• New API call pfring_ft_flow_get_ndpi_handle to access the flow nDPI handle
• New pfring_ft_l7_protocol_id, pfring_ft_get_ndpi_handle to access the nDPI handle
• New pfring_ft_flow_value status field to get flow termination reason
• New PFRING_FT_TABLE_FLAGS_DPI_EXTRA flag to enable extra metadata extraction
• New PFRING_FT_DECODE_TUNNELS flag to decode tunnels, new tunnel_type item in the flow value
• New flow slicing support (pfring_ft_flow_set_flow_slicing API)
• Added CAPWAP support
• Added flow metadata for HTTP/DNS/SSL
• Added global 'default' section to the rules configuration file
• Added dpi_min_num_tcp_packets / dpi_min_num_udp_packets to the configuration file
• Added flow_idle_timeout / flow_lifetime_timeout to the configuration file
• Added src/dst mac to the exported flow key
• Added ICMP type/code to flow metadata
• Added flags to flow metadata
• Added custom flow actions to be defined by the user
• Added pfring_ft_load_configuration_ext API
• Improved protocol detection for some protocols like Skype
• Improved metadata extraction for some protocols like Telnet
• Improved pfring_ft_license to return the duration also in demo mode
• Changed l7_detected callback: this is called before the flow_packet callback now
• Changed pfring_ft_create_table and pfring_ft_flow_value to allocate user metadata as part of the flow structure
• Fixed filtering/shunting of custom protocols
• Fixed protocol detection in case of guess
• Fixed pfring_ft_set_l7_detected_callback user parameter handling

PF_RING-aware Libpcap

• Fixed device name check during socket initialization to handle long interface names
• Fixed loop break

PF_RING Kernel Module

• Added new clustering mode cluster_per_flow_ip_with_dup_tuple
• Allow any to capture from any namespace (on the host only)
• Remapping ifindex to an internal device index to handle ifindex growing indefinitely
• Fixed kernel crash parsing malformed packets (12 nested QinQ VLAN headers with GRE)
• Fixed possible race condition
• Fixed QinQ VLAN and VLAN offload support
• Fixed concurrent access to the ring in case of loopback device and bridge
• Compilation fixes for kernel 5.x
• Reworked max ring size check to handle cases like jumbo frames
• Improved promisc management

PF_RING Capture Modules

• New AF_XDP capture module
• Napatech library update, fixed findalldev
• Accolade library update, fixed caplen vs orig len, new env var ACCOLADE_FLOW_IDLE_TIMEOUT
• Myricom library update, license fix with port aggregation
• DAG library update

ZC Drivers

• New ixgbe-zc driver v.5.5.3
• Support for Intel X550
• Compilation fixes for kernel 5.x
• Handling if up/down when the interface is in use by ZC

nBPF

• Added support to match custom fields through a callback (nbpf_set_custom_callback)

Examples

• zcount improvements:
  • Added -T option to capture TX
• zbalance_ipc improvements:
  • Fixed -m 4/5/6 with multiple applications and more than 32 queues
  • New -E option to enable debug mode
  • New -C and -O options
• ftflow_dpdk improvements:
  • More stats: drops, hw stats, per-queue throughput
  • New options to control the link status, flow control, autoneg, port speed, checksum offload
  • New -P option to set the TX rate
  • New TX test mode and -T option to set the packet len
  • New -F option to enable forwarding
  • New -m option to set the mtu
  • Capture-only mode
  • Forward optimizations
• ftflow_pcap improvements:
  • Support for processing a PCAP file
  • New -p <proto.txt> option
  • New -F option to configure filtering/shunting rules
• pfsend improvements:
  • New -8 option to send the same packets times before moving to the next
  • New -B option to set a BPF filter
  • New -t option to forge N different source port
  • New -A option to generate increasing number of flows
• pfcount improvements:
  • New -R option to disable RSS reprogramming
• pfbridge now discards injected packets

Misc

• New pf_ringcfg script to automatically configure pf_ring and drivers
• New pre/post scripts executed by systemd before/after loading pf_ring and drivers
• Improved hugepages configuration with multiple nodes
• npcap lib update, storage utility functions fix for NFS

PF_RING 7.4.0 release

PF_RING Library

• New pfring_open PF_RING_DO_NOT_STRIP_FCS flag to disable FCS/CRC stripping (when supported by the adapter)
• Improved support for cross-compilation
• New PF_RING_FT_CONF environment variable to enable PF_RING FT support and load L7 filtering rules
• New PF_RING_FT_PROTOCOLS environment variable to load L7 protocols when PF_RING FT for L7 filtering is enabled

ZC Library

• New pfring_zc_open_device flag PF_RING_ZC_DO_NOT_STRIP_FCS to disable FCS/CRC stripping (when supported by the adapter)
• New builtin hash function pfring_zc_builtin_5tuple_hash based on 5-tuple
• Fixed SPSC queues BPF support
• Fixed KVM/ivshmem support on Ubuntu 16
• Fixed pfring_zc_recv_pkt_burst with ixgbe-zc drivers

FT Library

• New pfring_ft_set_l7_detected_callback API to set a callback for classified flows/packets (L7 protocol detected)
• New pfring_ft_set_default_action API to set the default action for classified L7 flows
• New pfring_ft_flow_get_action API to get the computed/actual flow action asyncronously
• New pfring_ft_create_table flow_lifetime_timeout parameter to configure the maximum flow duration
• New pfring_ft_load_ndpi_protocols API to load custom nDPI protocols from a configuration file
• New pfring_ft_is_ndpi_available API to check nDPI availability
• Added active_flows to pfring_ft_stats to get the number of currently active flows

PF_RING-aware Libpcap

• New pcap_get_pfring_handle API to get the PF_RING handle used by Libpcap
• New PCAP_PF_RING_ALWAYS_SYNC_FD environment variable for applications not using the fd provided by pcap_get_selectable_fd
• Fix for applications polling from the pcap selectable fd when ZC drivers are used

PF_RING Kernel Module

• Updates to support kernel 4.18 or older
• Fixed 'stack' TX capture in ZC mode
• Fixed ifindex lookup
• Fixed promiscuous mode corner cases
• Fixed arm32 support
• Fixed IPv6 support in software filtering rules
• Fixed software hash rules
• Fixed kernel clustering in case of non-IP packets (sporadically recognized as IP fragments when the fragments cache was enabled)

PF_RING Capture Modules

• Timeline module fixes:
• Fixed extraction of non-IP packets
• Fixed permissions check when running as unprivileges user, when the user has permissions on the filesystem
• Accolade module update to support latest SDK API and features
• Fixed Fiberblaze module bulk mode

ZC Drivers

• New ixgbevf ZC driver
• Drivers updates to support kernel 4.18 or older
• Fixed sporadic crashes during application startup on high traffic rates
• Fixed the DKMS packages
• i40e ZC driver improvements:
  • Forcing symmetric RSS hash on old firmwares
  • Improved interrupts management to fix packets delivered in batches
  • Fixed interrupts management when multiple sockets are active on the same interface (RX+TX or RSS)
• ixgbe ZC driver improvements:
  • Increased max MTU length to 16K
  • Fixed card reset due to kernel-space TX packets pending while the interface is in use by ZC
• Improved hardware timestamp support for igb ZC (i350/82580 adapters)

nBPF 

• Fixed 'portrange' token in BPF-like filters

Examples

• New pftimeline example to extract traffic from a n2disk dump set using the pf_ring API
• New pfsend -M option to forge the source MAC address
• zbalance_ipc improvements:
  • Added -m 6 distribution function (interface X to queue X)
  • Added queues and TX interface stats under /proc (-p)
  • Fixed multiapp (fanout) distribution for more than 32 egress queues
• ftflow improvements:
  • New -F option to load rules from a configuration file
  • New -p option to load custom protocols
  • Improved output (e.g. printing information including the flow action)
• Improved ftflow_dpdk example, added bridging support
• Fixed software filtering in pfcount (enabling full headers when filtering is enabled)

IDS Support (Snort/Bro)

• Fixed Snort DAQ filtering API
• Fixed cluster issues on Bro (due to a libpcap symbols issue)

Misc

• CoreOS support, pf_ring module and drivers installation scripts
• Improved 'zbalance_ipc' clusters management with systemd:
  • Service improvements to set the status after the cluster process is actually up and running
  • Fixed hugepages memory allocation in case of clusters not using ZC drivers
• Improved service dependencies with systemd with respect to other ntop applications
• Added GID to the hugepages configuration file to allow nonprivileged users to use ZC applications

PF_RING 7.2.0 release

• ZC Library

  • New API pfring_zc_pkt_buff_pull / pfring_zc_pkt_buff_push to manage buffer head room
  • New builtin hash pfring_zc_builtin_gre_hash with support for GRE tunneling
    • zbalance_ipc -m 5 option for enabling GRE hashing
  • Support for up to 64 queues in pfring_zc_send_pkt_multi and pfring_zc_distribution_func
  • Fix for attaching to ZC IPC queues from containers

• FT Library (New)

  • L7 flow classification and filtering library
  • Event-driven capture-agnostic API
  • Sample applications
    • ftflow: flow records generation with PF_RING capture
    • ftflow_pcap: flow records generation with PCAP capture
    • ftflow_dpdk: flow records generation with DPDK capture
    • fttest: performance benchmarking tool
    • zbalance_ipc extension to process flows and filter packets

• nBroker (New)

  • Traffic steering and filtering on Intel RRC (FM10K adapters)
  • Daemon to drive the adapter (nbrokerd)
  • API to configure the adapter using a C library (nbrokerlib)
  • Command-line tool with auto-completion to configure the adapter using scripts (nbroker-cli)
  • Low-level library used by nbrokerd to drive the adapter (rrclib)

• PF_RING-aware Libpcap

  • PCAP_PF_RING_USERSPACE_BPF env var to force userspace filtering instead of kernel filtering

• PF_RING Kernel Module

  • Full support for namespaces and containers
  • Fixed skbuff forwarding with fast-tx using reflect_packet
  • Fixed VLAN support in BPF with kernel extensions
  • Fixed support for NetXtreme cards with multiple queues
  • Fixed sw hash filtering for IPv6
  • Fixed intel_82599_perfect_filter_hw_rule VLAN byte order
  • Fixed huge rings (high number of slots or huge slot size)
  • Fixed VLAN offset and packet hash in case of QinQ and VLAN offload
  • Support for Ubuntu 18
  • Support for latest Centos 7 kernel
  • Support for latest Debian 8 kernel

• PF_RING Capture Modules

  • Released source code for FPGA capture modules including Endace, Exablaze, Inveatech, Mellanox, Netcope
  • Accolade lib updates
    • New flag PF_RING_FLOW_OFFLOAD_NOUP to enable flow offload without flow updates (standard raw packets are received, flow id is in the packet hash)
    • Automatically generate the rule ID using rule_id = FILTERING_RULE_AUTO_RULE_ID
    • Support for accolade 200Ku Flex adapters
  • Fiberblaze lib updates
    • Packet recv in chunk mode
  • Fixed extraction from npcap/timeline in case of empty PCAP files in the dump set
  • Endace DAG updates
    • Setting extended_hdr.pkt_hash from ERF FlowID or Packet Signature extension headers if available
    • Support for pfring_set_application_name
    • Support for pfring_dag_findalldevs
  • Napatech lib updates
    • Support for sdk v10

• Drivers

  • e1000e zc driver update v.3.4.0.2
  • i40e zc driver update v.2.4.6
  • ixgbe zc driver update v.5.3.7
  • igb zc driver update v.5.3.5.18
  • Fixed interrupts handling on i40e when in zc mode, this fixes the case where packets are received in batches of 4/8 packets
  • Using nbrokerd for initializing FM10K adapters and configuring the RRC switch

• nBPF

  • Fixed rules constraints

• Misc

  • Reworked init.d systemd support
  • New pf_ringctl script to manage pf_ring and drivers (this is used by init.d/systemd)
  • Documentation improvements, Doxygen integration with "read the docs"