Fallback to libpcap when pf_ring is not available (or add an option)
jpVm5jYYRE1VIKL opened this issue · comments
In n2disk not exist any description about interface names format.
Option :
[--interface|-i] <device> | Ingress packet device.
As i understand it is possible to start n2disk using :
pcap:eth0 , tc:eth0, zc: eth0 . But not exist any place where described all such options.
Also not described how to use it without PF_RING or PF_RING ZC and how to use it with just default libpcap.
As i see docker image try to use PF_RING even with "pcap:eth0"
@jpVm5jYYRE1VIKL please note that since n2disk is using PF_RING as capture component, all the interfaces supported by PF_RING can be used, thus please refer to the PF_RING documentation at https://www.ntop.org/guides/pf_ring/get_started/index.html
n2disk is currently always using PF_RING on Linux, pcap is used on other OSs. This said, it should be possible to enable pcap support also on Linux if required, but this requires some change to the software.
@cardigliano Thanks for your answer i clearly understand now that PF_RING is not what we need because not always possible to load 3rd party kernel modules inside system. Beside this as i understood it support very limited amount of adapters and it will be good to have workaround mode or clear description of data exchange protocol between ntopng and n2disk. So we can implement ourself n2disk replacement and send proper data to ntopng.
Implemented