@cardigliano cardigliano released this Jun 13, 2018 · 30 commits to 7.2.0-stable since this release

Assets 2
  • ZC Library

    • New API pfring_zc_pkt_buff_pull / pfring_zc_pkt_buff_push to manage buffer head room
    • New builtin hash pfring_zc_builtin_gre_hash with support for GRE tunneling
      • zbalance_ipc -m 5 option for enabling GRE hashing
    • Support for up to 64 queues in pfring_zc_send_pkt_multi and pfring_zc_distribution_func
    • Fix for attaching to ZC IPC queues from containers
  • FT Library (New)

    • L7 flow classification and filtering library
    • Event-driven capture-agnostic API
    • Sample applications
      • ftflow: flow records generation with PF_RING capture
      • ftflow_pcap: flow records generation with PCAP capture
      • ftflow_dpdk: flow records generation with DPDK capture
      • fttest: performance benchmarking tool
      • zbalance_ipc extension to process flows and filter packets
  • nBroker (New)

    • Traffic steering and filtering on Intel RRC (FM10K adapters)
    • Daemon to drive the adapter (nbrokerd)
    • API to configure the adapter using a C library (nbrokerlib)
    • Command-line tool with auto-completion to configure the adapter using scripts (nbroker-cli)
    • Low-level library used by nbrokerd to drive the adapter (rrclib)
  • PF_RING-aware Libpcap

    • PCAP_PF_RING_USERSPACE_BPF env var to force userspace filtering instead of kernel filtering
  • PF_RING Kernel Module

    • Full support for namespaces and containers
    • Fixed skbuff forwarding with fast-tx using reflect_packet
    • Fixed VLAN support in BPF with kernel extensions
    • Fixed support for NetXtreme cards with multiple queues
    • Fixed sw hash filtering for IPv6
    • Fixed intel_82599_perfect_filter_hw_rule VLAN byte order
    • Fixed huge rings (high number of slots or huge slot size)
    • Fixed VLAN offset and packet hash in case of QinQ and VLAN offload
    • Support for Ubuntu 18
    • Support for latest Centos 7 kernel
    • Support for latest Debian 8 kernel
  • PF_RING Capture Modules

    • Released source code for FPGA capture modules including Endace, Exablaze, Inveatech, Mellanox, Netcope
    • Accolade lib updates
      • New flag PF_RING_FLOW_OFFLOAD_NOUP to enable flow offload without flow updates (standard raw packets are received, flow id is in the packet hash)
      • Automatically generate the rule ID using rule_id = FILTERING_RULE_AUTO_RULE_ID
      • Support for accolade 200Ku Flex adapters
    • Fiberblaze lib updates
      • Packet recv in chunk mode
    • Fixed extraction from npcap/timeline in case of empty PCAP files in the dump set
    • Endace DAG updates
      • Setting extended_hdr.pkt_hash from ERF FlowID or Packet Signature extension headers if available
      • Support for pfring_set_application_name
      • Support for pfring_dag_findalldevs
    • Napatech lib updates
      • Support for sdk v10
  • Drivers

    • e1000e zc driver update v.
    • i40e zc driver update v.2.4.6
    • ixgbe zc driver update v.5.3.7
    • igb zc driver update v.
    • Fixed interrupts handling on i40e when in zc mode, this fixes the case where packets are received in batches of 4/8 packets
    • Using nbrokerd for initializing FM10K adapters and configuring the RRC switch
  • nBPF

    • Fixed rules constraints
  • Misc

    • Reworked init.d systemd support
    • New pf_ringctl script to manage pf_ring and drivers (this is used by init.d/systemd)
    • Documentation improvements, Doxygen integration with "read the docs"

@cardigliano cardigliano released this Nov 21, 2017 · 35 commits to 7.0.0-stable since this release

Assets 2

PF_RING Library

  • Flow offload support
    • New PF_RING_FLOW_OFFLOAD pfring_open() flag to enable hw flow offload on supported cards (received buffers are native metadata)
    • New PF_RING_FLOW_OFFLOAD_NOUPDATES pfring_open() flag to disable flow updates with hw flow offload enabled: only standard raw packets with a flow id are received
    • New PKT_FLAGS_FLOW_OFFLOAD_UPDATE packet flag to indicate flow metadata in the received buffer (generic_flow_update struct)
    • New PKT_FLAGS_FLOW_OFFLOAD_PACKET packet flag to indicate raw packet with flow_id in pkt_hash
    • New PKT_FLAGS_FLOW_OFFLOAD_MARKER packet flag to indicate marked raw packet
  • Fixes for ARM systems

ZC Library

  • New pfring_zc_set_app_name API
  • PF_RING_ZC_PKT_FLAGS_FLOW_OFFLOAD flag to enable hw flow offload
  • Fixed BPF filters in SPSC queues
  • Fixed hugepages cleanup in case of application dropping privileges
  • Fixed sigbus error on hugepages allocation failure on numa systems
  • Fixed multiple clusters allocation in a single process

PF_RING-aware Libpcap/Tcpdump

  • Libpcap update v.1.8.1
  • Tcpdump update v.4.9.2

PF_RING Kernel Module

  • Docker/containers namespaces isolation support
  • Fixed capture on Raspberry Pi
  • Implemented support for VLAN filtering based on interface name (., where ID = 0 accepts only untagged packets)
  • New cluster types cluster_per_flow_ip_5_tuple/cluster_per_inner_flow_ip_5_tuple to balance 5 tuple with IP traffic, src/dst mac otherwise
  • Fixed hash rule last match, new hash_filtering_rule_stats.inactivity stats

PF_RING Capture Modules

  • Accolade flow offload support
    • New hw_filtering_rule type accolade_flow_filter_rule to discard or mark a flow
  • Netcope support
    • New hw_filtering_rule type netcope_flow_filter_rule to discard a flow
  • Improved Fiberblaze support
    • pfring_get_device_clock support
    • Ability to set native filters by setting as BPF string 'fbcard:'
    • Fixed TX memory management
    • Fixed subnet BPF filters
    • Fixed drop counter
    • Fixed capture mode
    • Fixed sockets not enabled
    • FPGA error detection
  • Endace DAG update
  • npcap/timeline module compressed pcap extraction fix


  • ixgbe-zc driver update v.5.0.4
  • i40e-zc driver update v.2.2.4


  • Fixed nBPF parser memory leak


  • New pfsend option -L to forge VLAN IDs
  • zbalance_ipc improvements
    • Ability to dump output to log file (-l)
    • Fixed privileges drop (-D)


  • Fixed systemd dependencies, renamed pfring.service to pf_ring.service
  • New /etc/pf_ring/interfaces.conf configuration file for configuring management and capture interfaces

@lucaderi lucaderi released this Apr 25, 2017 · 49 commits to 6.6.0-stable since this release

Assets 2

PF_RING Library

  • New pfring_findalldevs/pfring_freealldevs API for listing all interfaces supported by pf_ring
  • New timeline module based on libnpcap for seamlessly extracting traffic from a n2disk dumpset using the pf_ring API
  • Dynamic capture modules loading with dlopen support
  • Improved pfring_set_bpf_filter to set hw rules when supported by the network card thanks to the nBPF engine

ZC Library

  • New pfring_zc_set_bpf_filter/pfring_zc_remove_bpf_filter API for setting BPF filters to device queues
  • Fixed pfring_zc_queue_is_full for device queues
  • Flushing SPSC queues when a consumer attaches (RX only)

PF_RING-aware Libpcap/Tcpdump

  • Support for extracting traffix from a n2disk dumpset using libpcap
  • tcpdump upgrade to v.4.9.0

PF_RING kernel module

  • Support for latest ubuntu and centos stable kernels
  • Support for SCTP and ICMP packet parsing
  • Packet hash improvements
  • Added tunneled IP version to packet metadata
  • Added IP version to sw filters
  • New kernel cluster hash types for tunneled traffic
  • QinQ VLAN parsing
  • Removed deprecated kernel plugins support
  • Promisc fix in case of multiple devices in a single socket


  • Support for latest ubuntu and centos stable kernels
  • FPGA modules/libraries are now loaded at runtime using dlopen
  • RSS support on Intel i211
  • Jumbo frames support on i40e
  • i40e tx optimisations
  • i40e interrupts fixes in case of RSS
  • Fiberblaze capture module with chunk mode support
  • Exablaze capture module
  • Accolade improvements
  • Endace DAG update and support for streams
  • Myricom ports aggregation fixes, new syntax myri:,


  • New nBPF filtering engine supporting an extended subset of the BPF syntax (tunneled traffic and l7 protocols are supported)
  • nBPF support for hw filtering on Fiberblaze cards
  • nBPF support for hw filtering on Intel FM10K cards (Silicom PE3100G2DQIR)
  • nBPF support for hw filtering on Exablaze cards
  • nBPF support for hw filtering on Napatech cards and NTPL generation
  • Support for "start and end and " when extracting from a n2disk timeline
  • Support for vlan [id], mpls [label], gtp


  • pfcount:
    • ability to list interfaces with -L (-v 1 for more info)
    • ability to dump traffic on PCAP file with -o
  • psend:
    • option to force flush per packet (-F)
    • options to specify src/dst IP for packet forging (-S/-D)
    • option to forge packets on the fly instead of at preprocessing time (-O)
    • option to randomize generated ips sequence (-z)
    • ability to generate IPv6 traffic (-V 6)
    • ability to generate mixed v4 and v6 traffic (-V 0)
    • TCP/UDP checksum when reforging
  • zbalance_ipc
    • option to use hw aggregation when supported by the card (-w)
    • IP-based filtering with ZMQ support for rules injection


  • New extcap module 'ntopdump' for Wireshark 2.x


  • Improved systemd support (Ubuntu 16)

@cardigliano cardigliano released this Jun 22, 2016 · 29 commits to 6.4.1-stable since this release

Assets 2

2016-06-16 PF_RING 6.4.1

  • PF_RING Library
    • Fixed pfring_get_interface_speed on several capture modules
  • PF_RING kernel module
    • Fixed packet corruption with standard pf_ring sockets in case of slow consumer
  • Drivers
    • Fixed 'tx hang' on all drivers

2016-06-07 PF_RING 6.4

  • PF_RING Library
    • Improved Myricom support, new naming scheme to improve usability
    • Improved Napatech support, 100G support
    • Improved Accolade support
    • New Invea-Tech support
    • New API pfring_get_metadata to read ZC metadata
    • New pfring_get_interface_speed API
    • New API pfring_version_noring()
    • C++ wrapper improvements
    • Removed DNA legacy
  • ZC Library
    • New API pfring_zc_set_device_proc_stats to write /proc stats per device
    • New API pfring_zc_set_device_app_name to write the application name under /proc
    • New API pfring_zc_get_cluster_id to get the cluster ID from a queue
    • New API pfring_zc_check_device_license for reading interface license status
    • New API pfring_zc_get_queue_settings to read buffer len and metadata len from queue
    • New API pfring_zc_get_queue_speed to read the link speed
    • New pfring_zc_open_device flag PF_RING_ZC_DEVICE_NOT_PROMISC to open the device without setting promisc mode
    • New packet metadata flags, including IP/L4 checksum (when available from card offloads)
    • Improved pfring_zc_builtin_gtp_hash
  • PF_RING-aware Libpcap/Tcpdump
    • New libpcap v.1.7.4
    • New tcpdump v.4.7.4
    • Libnpcap support to let libpcap-based applications (i.e. tcpdump) read compressed .npcap files produced by n2disk
    • Native nanosecond timestamps support
    • Tcpdump patch to close the pcap handle in case of errors (this avoids breaking ZC queues)
  • PF_RING kernel module
    • Fixed BPF support on kernel 4.4.x
    • Fixed RSS support on Centos 6 (it was reporting the wrong number of queues, affecting RSS rehash)
    • Reworked promisc support: handling promisc through the pf_ring kernel module in order to automatically remove it even when applications drop privileges
    • VLAN ID fix in case of vlan stripping offload enabled (it was including priority bits)
  • Drivers
    • New i40e-zc v.1.5.18
    • New fm10k-zc v.0.20.1
    • Support for latest Ubuntu 16, RHEL 6.8, Centos 7
    • Fixed i40e-zc initialisation failures due to promisc reset
    • Fixed i40e-zc 'transmit queue 0 timed out'
    • Fixed e1000e-zc memory leak
  • Examples
    • Added ability to reforge MAC/IP also when reading packets from pcap file/stdin in pfsend
    • Added -f option for replaying packets from pcap file in zsend
    • Added -o option to pfsend to specify an offset to be used with -b
    • Added -r option to use egress interfaces instead of queues in zbalance_ipc
  • Snort DAQ
    • Fixed DAQ-ZC buffer leak in IPC mode
    • Fixed DAQ_DP_ADD_DC support
    • Fixed support for DAQ < 2.0.6

@lucaderi lucaderi released this Jun 8, 2016 · 1369 commits to dev since this release

Assets 2

Merge branch 'dev' of https://github.com/ntop/PF_RING into dev
May 4, 2015
6.0.3 release dated April 10th, 2015