[Bro] Module pf_ring not found.

[Ward Sladek]

PF_RING doesn't/didn't support kernel 3.8 and I'm not sure if that is still the case today.  You might try a newer version of PF_RING.

Date: Wed, 30 Apr 2014 11:45:25 -0400
From: john.h.hoyt at gmail.com
To: JAzoff at albany.edu
CC: bro at bro.org
Subject: Re: [Bro] Module pf_ring not found.

I went back and re-ran make install from the kernel directory and got the following output:








mkdir -p /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp *.ko /lib/modules/3.8.0-38-generic/kernel/net/pf_ring

cp linux/pf_ring.h /usr/include/linux

/sbin/depmod 3.8.0-38-generic
Then I re-ran the command:modprobe pf_ring enable_tx_capture=0 min_num_slots=32768And got the error: FATAL: Error inserting pf_ring (/lib/modules/3.8.0-38-generic/kernel/net/pf_ring/pf_ring.ko): Invalid module format



Then, I went back through the steps of re-running make install, beginning with the directoryPF_RING-5.6.1/userland/lib 

Still no luck. 
I checked the make file for each before re-running the install to make sure that the prefix was still set. 
Thanks,John





On Wed, Apr 30, 2014 at 10:32 AM, Justin Azoff <JAzoff at albany.edu> wrote:

On Wed, Apr 30, 2014 at 10:09:17AM -0400, John Hoyt wrote:

> I followed the steps for configuring load balancing here:

>

> http://www.bro.org/documentation/load-balancing.html

>

> Everything worked great, but I had to restart the server and now I can't load

> the PF_RING module.

>

>

> sudo modprobe pf_ring enable_tx_capture=0 min_num_slots=32768

>

> FATAL: Module pf_ring not found.



Did you upgrade your kernel version before the reboot?  You may need to

reinstall the kernel module



Try going back into the PF_RING-5.6.1/kernel directory and running



    make install



upstream pf_ring does not use dkms so if you upgrade the kernel you will

need to reinstall the modules..



--

-- Justin Azoff




_______________________________________________
Bro mailing list
bro at bro-ids.org
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140430/79b99f97/attachment.html