PF_RING浅析
PF_RING架构
PF_RING的主要框架包括如下几部分：
-
内核数据包加速处理模块负责提供拷贝底层的数据包到PF_RING环中
-
用户空间PF_RINGSDK负责透明的为用户空间应用程序提供PF_RING技术支持
特殊定制的PF_RING相关的网卡驱动网卡驱动不通过linux内核任何的数据结构一大到进一步加强数据包的抓取效率的目的。PF_RING可以与任何NIC驱动程序兼容，但是为了达到最大的性能必须使用经过定制过得驱动程序。驱动程序传递数据包的方式取决于加载PF_RING内核模块时transparent_mode参数。
PF_RINT实现了一种新式soket类型(PF_RING)，通过该套接字用户空间的应用程序可以实现与PF_RING内核模块的通信。应用程序能够得到一个PF_RING句柄，并通过其完成PF_RINGAPI的调用。句柄受以下条件约束：
-
物理网络接
-
接收队列，只在多队列网络适配器上有效
-
Tothe ‘any’ virtual interface that means packets received/sent onall system interfaces are accepted.
依据上面所述，数据包通过读取初始化时预分配好的环形内存区域获取数据包。内核模块拷贝进入的数据包到该环中，同时用户空间通过应用程序读取这些数据包。不会存在针对与每个数据包的内存分配与释放动作。数据包一旦被读取，存储该数据包空间就会被释放，ring会将该环用于后续的数据包。这意味着我们的应用程序需要自己维护一个数据包归档，因为数据包一旦读域PF_RING就不会保存这些数据包。
PF_RING安装
PF_RING源码的目录结构为：
•doc/
•drivers/
•kernel/
•Makefile
•README
•README.DNA
•README.FIRST
•userland/
你可以通过Makefile编译整个源码工程
2.1Linux 内核模块安装
为了编译PF_RING内核模块，你需要安装linux内核源码树。然后执行如下命令：
$cd <PF_RING PATH>/kernel
$make
注意：
-
内核模块的安装需要root权限
-
对于某linux发行版本其会包含PF_RING的安装包
-
从PF_RING4.x开始不再需要给内核打补丁
运行PF_RING
首先需要装载PF_RING内核模块（root身份）
#insmod <PF_RING PATH>/kernel/pf_ring.ko[transparent_mode=0|1|2]
[min_num_slots=x][enable_tx_capture=1|0][enable_ip_defrag=1|0][quick_mode=1|0]
NOTE：
-
默认为transparent=0，数据包通过标准的linux接口接收。任何驱动都可以使用该模式
-
transparent=1（使用于vanila和PF_RING-aware驱动程序），数据包分别拷贝到PF_RING和标准linux网络协议栈各一份
-
transparent=2（PF_RING-aware驱动程序），数据包近拷贝到PF_RING,而不会拷贝到标准的linux网络协议栈（tcpdump不会看到任何数据包）。
-
不要同时使用模式1和模式2到vanila驱动，否则将会抓到任何数据包。
其他参数：
-
min_num_slots：Minnumber of ring slots (default – 4096).
-
enable_tx_capture：Setto 1 to capture outgoing packets, set to 0 to disable captureoutgoing packets (default – RX+TX).
-
enable_ip_defrag：Setto 1 to enable IP defragmentation, only rx traffic is defragmented.
-
quick_mode：Setto 1 to run at full speed but with up to one socket per
interface.
3.1检测PF_RING设备配置
如果PF_RING被激活，/proc/net/pf_ring将被创建
[lhl@localhost/proc/net/pf_ring 17:43 # 124]$cat info
PF_RINGVersion : 6.0.0 ($Revision: 已导出$)
Totalrings : 0
Standard(non DNA) Options
Ringslots : 4096
Slotversion : 15
CaptureTX : Yes [RX+TX]
IPDefragment : No
SocketMode : Standard
Transparentmode : Yes [mode 1]
Totalplugins : 0
ClusterFragment Queue : 0
ClusterFragment Discard : 0
PF_RING允许用户加载处理特殊流量的插件。可以通过查看plugins_info文件
[lhl@localhost/proc/net/pf_ring 17:44 # 129]$cat plugins_info
ID Plugin
1 dummy[This is a dummy plugin]
3.2安装libpfring和libpcap
Libpfring为PF_RING的用户空间API库，下面为libpfring和libpcap的编译方式：
$cd<PF_RING PATH>/userland/lib
$./configure
$make
$sudomake install
$cd../libpcap
$./configure
$make
Notethat the lib is reentrant hence it’s necessary to link yourPF_RING-enabled applications also against the -lpthread library.
为了使用启用了PF_RING功能的libpcap(libpcap为静态库)，我们需要重新编译使用了pcap的应用程序。
3.3应用例子
/userlana/examples下面有丰富的基于PF_RING实现的例子程序，如下：
例如：pfcount能够统计一些数据包的信息
[root@localhostexamples]# ./pfcount -i p4p1
UsingPF_RING v.6.0.0
Capturingfrom p4p1 [A4:1F:72:8F:AC:B1][ifIndex: 2]
#Device RX channels: 1
#Polling threads: 1
Dumpingstatistics on /proc/net/pf_ring/stats/10628-p4p1.9
=========================
AbsoluteStats: [0 pkts rcvd][0 pkts filtered][0 pkts dropped]
TotalPkts=0/Dropped=0.0 %
0pkts - 0 bytes
=========================
3.4PF_RING 其他模块
Asof version 4.7, the PF_RING library has a new modular architecture,making it possible to use
additionalcomponents other than the standard PF_RING kernel module. Thesecomponents are
compiledinside the library according to the supports detected by theconfigure script.
Currently,the set of additional modules includes:
•DAGmodule.
Thismodule adds native support for Endace DAG cards in PF_RING. In orderto use this module it’s
necessaryto have the dag library (4.x or later) installed and to link yourPF_RING-enabled
applicationusing the -ldag flag.
•DNAmodule.
Thismodule can be used to open a device in DNA mode, if you own asupported card and a DNA
driver.Please note that the PF_RING kernel module must be loaded before thethe DNA driver. With
DNAyou can dramatically increase the packet capture and transmissionspeed as the kernel layer
isbypassed and applications can communicate directly with the card.
Currentlythese DNA-aware drivers are available:
‣e1000e
‣igb
‣ixgbe
Thedrivers are part of the PF_RING distribution and can be found indrivers/DNA/.
Withall the drivers you can achieve wire rate at any packet size, bothfor RX and TX. You can test
RXusing the pfcount application, and TX using the pfsend application.
16
PF_RINGUser’s Guide v.6.0.0
Notethat in case of TX, the transmission speed is limited by the RXperformance. This is because
whenthe receiver cannot keep-up with the capture speed, the ethernet NICsends ethernet PAUSE
framesback to the sender to slow it down. If you want to ignore theseframes and thus send at full
speed,you need to disable autonegotiation and ignore them (ethtool -A dnaXautoneg off rx off tx
off).
• ZCmodule.
Thismodule can be used to open a device in ZC mode, if you own asupported card and a
PF_RING-awaredriver with ZC support. As with DNA, ZC dramatically increases thepacket capture
andtransmission speed as the kernel layer is bypassed and applicationscan communicate
directlywith the card.
Currentlythese ZC drivers are available:
‣e1000e
‣igb
‣ixgbe
Thedrivers are part of the PF_RING distribution and can be found indrivers/PF_RING_aware/
identifiedby the suffix ‘-zc’. With all the drivers you can achieve wirerate at any packet size, both
forRX and TX. In order to open a device in ZC mode you should use the“zc:” prefix: “zc:ethX”.
•LinkAggregation (“multi”) module.
Thismodule can be used to aggregate multiple interfaces in order tocapture packets from all of
themopening a single PF_RING socket. For example it is possible to open aring with device name
“multi:ethX;ethY;ethZ”.
•UserspaceRING (“userspace”) module.
Thismodule allows an application to send packets to another processleveraging on the standard
PF_RINGAPI by creating virtual devices (e.g. usrX, where X is a uniqueidentifier for the userspace
ring).In order to do this, the sending application has to open a ring byusing as device name
“userspace:usrX”(where “userspace:” identifies the Userspace RING module), whilethe receiving
applicationhas to open a ring in the standard way by using as device name“usrX”.
•Libzeroconsumer (“dnacluster”) module.
Thismodule can be used to attach to a DNA Cluster allowing theapplication to send and receive
packetsleveraging on the standard PF_RING API. The sending application hasto open a ring by
usingas device name “dnacluster:X@Y” where X is the cluster identifierand Y is the consumer
identifier,or “dnacluster:X” for auto-assigning the consumer identifier.
•LinuxTCP/IP Stack injection (“stack”) module.
Thismodule can be used to inject/capture packets to/from the Linux TCP/IPStack, simulating the
arrival/sendingof those packets on an interface. The application has to open a ringby using as
devicename “stack:dnaX” where dnaX is the interface bound to thepackets injected into the stack.
Inorder to inject a packet to the stack pfring_send() has to be used,in order to capture outgoing
packetspfring_recv() has to be used.
PF_RING-应用程序开发
PF_RING是一款简单但功能强大的技术，其能够以较小的代价为开发者提供高性能的数据包流量监测和处理功能。因为PF_RING能够使开发者从复杂的内核操作中解脱出来，使其不必关于系统底层实现，而集中精力解决用户空间的应用的问题。