# CHANGELOG --------------------------------------- 2026-08-26 PF_RING 9.4 * PF_RING Library - Add support for Linux alias interfaces - Add PF_RING_IP_ONLY_RSS flag to pfring_open() to enable IP-based RSS (when supported by the adapter) - Add support for multi-timeline extraction (n2disk dump sets) with timestamp-based data aggregation via nPCAP * PF_RING Kernel Module - Fix packet_rcv being called multiple times with multiple namespaces - Fix bond capture race condition - Add per-interface packet counters printed under /proc - Fix compilation on kernel >= 6.17 - Deprecate quick_mode * FT Library - Add support for nDPI category filters - Add PF_RING_ZC_IPONLY_RSS flag to enable IP-based RSS (when supported by the adapter) - Add PFRING_FT_KEY_EXT_MAC flag to use the MAC address as part of the flow key - Export unique_source_id in flow stats - Fix IP-based protocol guess - Fix flow stats metadata export * PF_RING Capture Modules and ZC Drivers - NVIDIA (Mellanox) improvements - Print Mellanox interface name when listing interfaces - Fix segfault opening a non-existing interface - Napatech improvements - Fix serial number reporting on F3076x and F2070x - Intel improvements - New ice-zc driver v.2.5.4 (adds support for E835) - Fix symmetric RSS configuration being reset on ice reload - Change RSS hash function selection on ice according to rss_scheme, enable src MAC in L2 hash - Unload intel_auxiliary before reloading the ice driver - Fix i40e/ixgbe/igb compilation on RHEL 9.7 - Fix compilation on kernel 7.x (Ubuntu 26) and kernel < 7.x - Remove e1000e from drivers bundle package (EOL) * Examples - pfcount - Print link state, improve output formatting - pfcount_multichannel - Add -x option to enable IP-only RSS hashing - Fix preflect - Fix ntopdump wireshark extcap - Remove obsolete pfcount_82599 example * Misc - Support for Ubuntu 26 - Add pfring_is_module_prefix() API - Rework service start/stop sequencing in pfring/pfring-dkms postinst/prerm scripts - Improve cluster service reliability (fix hanging service, avoid circular restart dependencies) --------------------------------------- 2025-11-17 PF_RING 9.2 * PF_RING Library - Fix fd leak in pfring_findalldevs - Fix IPv6 decoding - Define endianess macros compatible with kernel in userspace * PF_RING Kernel Module - Enhanced namespace and container support - Implement cluster type cluster_per_flow_ip_with_dup_tuple_ext - Fix GRE parsing: do not modify packet content - Reset packet_type struct - Fix compilation on old kernels * ZC Library - Add GTP-over-GRE support for zbalance GTP hash * FT Library - nDPI API updates - Fix CAPWAB decoding * PF_RING Capture Modules and ZC Drivers - NVIDIA (Mellanox) ConnectX improvements - Add support for non-promisc mode, both with single queue and RSS - Napatech improvements - Add PF_RING_FLOW_OFFLOAD_RESET flag to reset hardware flow table when using PF_RING_FLOW_OFFLOAD - Intel improvements - New ice-zc driver v.2.3.10 - Rework shutdown procedure to avoid crash on shutdown - New igb-zc driver v.5.16.11 - Disable e1000e compilation on kernel 6.12 or later (EOL) - Rename intel_igb_82580 to intel_igb_ts (includes i350/82580) - Load ice before iavf to prevent initialization issues - Fix VF configuration and driver auto-loading * Examples - pfcount_multichannel - Add -J option to disable promisc mode - ftflow - Update access to ndpi metadata - New psend example * Misc - Support for Debian 13 - Support for Linux kernel 6.12 and newer --------------------------------------- 2025-04-24 PF_RING 9.0 * Key Features - Consolidated Napatech Flow Manager support (now with periodic flow updates) - Flow tracking on NVIDIA DOCA Flow CT (BlueField 3 and ConnectX 6/7) * PF_RING Library - Add PF_RING_FLOW_UPDATE_CAUSE_PERIODIC to generic flow offload messages - Add support for Arista 7280 timestamps - Add ifindex to interface list returned by pfring_findalldevs() - Add PF_RING_HW_TIMESTAMP_UNSYNC flag to avoid setting the hw clock using system time (e.g. when using PTP) * PF_RING Kernel Module - Set interface name under /proc for non-kernel devices - Add SO_GET_CLUSTER_OBJECT_INFO to read ZC queue status * ZC Library - New API calls to check if a queue is locked and in use (pfring_zc_ipc_queue_in_use, pfring_zc_ipc_queue_in_use_from_cluster, pfring_zc_ipc_queue_in_use_from_queue) - Add pfring_zc_get_num_rx_channels API (print number of device queue in zcount and zbalance_ipc) - Implemented GTPv0 balancing in built-in hash - Add PF_RING_ZC_DEVICE_HW_TIMESTAMP_UNSYNC flag to avoid setting the hw clock using system time (e.g. when using PTP) * FT Library - Add PFRING_FT_TABLE_FLAGS_NO_GUESS flag to disable protocol guess - Add PFRING_FT_IGNORE_VLAN to ignore VLAN in flow key - Add action to pfring_ft_packet_metadata to be used in packet callbacks - Fix flow slices export (duration) - Fix shunting * PF_RING Capture Modules and ZC Drivers - Napatech improvements - Add support for periodic flow updates with the latest Flow Manager API - Add support for NT_TIMESTAMP_TYPE_UNIX_NANOTIME - Handle PF_RING_FLOW_OFFLOAD_NOUPDATES to disable periodic updates - Fix flow ID (32-bit on API v2) on new Flow Manager API - NVIDIA (Mellanox) ConnectX improvements - RSS limit set to 64 queues - Add PF_RING_RSS env var to set number of rss queues (rather then reading system conf) - Fix BPF rules - Intel improvements - Add MAC/VLAN support in RSS - Add rss_scheme parameter to select rss hash at driver load - Add irdma kernel module - required by ice on some kernel version - Update support for Silicom FPGA (Fiberblaze) adapters * Examples - zbalance_ipc - Fail on bad or unsupported BPF - Add -0 option to disable RSS (all traffic to queue 0) - pfcount - Add ifindex to interface list (printed with -L -v 1) - Fix -L header - zcount - Add -U option to set PF_RING_ZC_DEVICE_HW_TIMESTAMP_UNSYNC - ftflow - Add -f to ftflow. Update FT libs. - Fix uninitialized memory and minor leaks - ftflow_pcap - Add -N option to disable L7 protocol guess - pfflow_offload improvements for Napatech Flow Manager - Add -u to enable periodic updates - Print flow updates * Misc - Add ARM support for PF_RING FT - Add support for /etc/pf_ring/keepoffload (keep interfaces offloads enabled) - Fix pf_ringctl script execution on Rocky9 and new RH systems based on systemd - Fix compilation on RH9 - Deprecate apcon/vss timestamps --------------------------------------- 2024-08-05 PF_RING 8.8 * Key Features - Support for Napatech Flow Manager - Support for NVIDIA BlueField 2/3 * PF_RING Library - Add pfring_flow_update struct and pfring_recv_flow - Add PF_RING_FLOW_OFFLOAD flag to enable Flow Table offload on supported adapters - Add PF_RING_FLOW_OFFLOAD_AUTO_UNLEARN to control tcp auto unlearn - Add PF_RING_KEEP_CRC flag (required by Napatech) - Fix pfring_zc_send_pkt_multi return code * PF_RING Kernel Module - Add flow_id to generic_flow_tuple_hw_rule - Fix crash with more than 64 rss queues - Various minor fixes * FT Library - Add pfring_ft_zmq_get_stats API - Add slice action * PF_RING Capture Modules and ZC Drivers - Add support for Napatech Flow Manager (Flow Table offload) - Add support for NVIDIA BlueField (ARM64) - Add jumbo support for ice-zc - Add support for Napatech zero-copy forwarding (pfring_send_last_rx_packet) - Fix all Intel drivers compilation on latest kernels (including Ubuntu 24) - ixgbevf-zc driver update v.4.18.9 - i40e-zc driver update v.2.24.6 - iavf-zc driver update v.4.9.5 - Extend Napatech interface name to support adapter ID - Fix drop counter on NVIDIA/Mellanox Connect-X (read phy discards in addition to buffer discards) - Fix crash with more than 64 rss queues - Fix iavf (i40e VF) ring initialization - Fix driver dependency intel_auxiliary * PF_RING-aware Libpcap/Tcpdump - New pfring-aware tcpdump 4.99.4 * Examples - New pfflow_offload sample app with support for Napatech Flow Manager - pfsend - Fix ipv6 packet forging - Add eth header when replaying RAW capture files - Add -U / -K options to control flow distribution - Fix on the fly packets generation - Fix -A when -O is used - pfsend_multichannel - Add -C to support multiple TX channels with Napatech - pfbridge - Add support for Napatech zero-copy forwarding * Misc - Improve pf_ringctl to auto generate hugepages.conf based on numa nodes - Change MAX_CAPLEN to 65600 to correctly handle max jumbo packet size - Remove deprecated code for Accolade and fm10k --------------------------------------- 2023-10-23 PF_RING 8.6.1 * PF_RING Library - New pfring_set_cluster_consumer API to set a kernel cluster with (optional) consumer queue id and support for options (pfring_set_cluster() is set as deprecated) * PF_RING Kernel Module - Implement 'relaxed' distribution mode in the kernel cluster to deliver packets to the first available queue if a consumer is down (CLUSTER_OPTION_RELAXED_DISTRIBUTION) - Support for kernel 6.4+ * PF_RING Capture Modules and ZC Drivers - New ice zc driver v.1.12.7 - New ixgbe zc driver v.5.19.6 - New igb zc driver v.5.14.16 - Add auto DDP install in ice dkms packages * Examples - pfsend: - Add -G for seding traffic on two interfaces (one per direcion) - Improve TX rate precision adjust the transmission rate to compensate cpu freq fluctuations - pfcount: print both lib and kernel module versions * Misc - Fix hugepages file parsing (/etc/hugepages.conf) --------------------------------------- 2023-09-01 PF_RING 8.6 * PF_RING Library - New Runtime Manager for injecting and removing filtering rules to the socket via Redis - Fix memory leaks in PCAP module - Fix caplen/MTU on loopback capture * PF_RING Kernel Module - Add support for probabilistic sampling with kernel capture * FT Library - Improve application protocol guess with nDPI * PF_RING Capture Modules and ZC Drivers - Add initial support for NVIDIA/Mellanox BlueField - Add Napatech ns timestamp in PCAP mode - Add support for probabilistic sampling with userspace capture - Optimize hw timestamping on ice adapters (Intel E810) - Fix timestamp support when using the ZC burst API with ice adapters - Fix drivers compilation on Kernel 6.x - Fix drivers compilation on RH 8.8 * nPCAP - Fix memory corruption with big index files * PF_RING-aware Libpcap/Tcpdump - Add PF_RING support to pcap_inject - Fix pcap_read_pf_ring return code (number of packets) * Examples - zbalance_ipc: add support for multiple balancer threads when using NVIDIA/Mellanox adapters - pfsend: add -c option to balance on dest ip rather than src up - pfcount: compute drop rate in packet mode only - pfcount: report expired licenses - Fix ftflow_dpdk compilation on DPDK 22 or later - Fix memory leaks in pcount, alldevs, preflect, ftflow_pcap, * Misc - Add support for Debian 12 - Add libelf and libbpf dependencies to packages - Add sbsigntool dependency which includes kmodsign required by dkms - Add revision to pfring-dkms dependency in packages - Fix check for init/systemd presence - Cleanup support for legacy adapters --------------------------------------- 2023-01-30 PF_RING 8.4 * PF_RING Library - New API pfring_get_ethtool_link_speed - Add vlan_id to flow rule struct - Add optimization flags to BPF filters compiled with pcap_compile - Fix pfring_open_multichannel * PF_RING Kernel Module - Add keep_vlan_offload option to avoid reinserting VLAN header on VLAN interfaces when used inline * ZC Library - New ZC APIs (available on supported adapters) - pfring_zc_get_device_clock - pfring_zc_set_device_clock - pfring_zc_adjust_device_clock - pfring_zc_send_pkt_get_time - Add new pfring_zc_run_fanout_v3 API to support more than 64 fan-out queues - Add support for capturing stack packets, used by zcount and zbalance_ipc * PF_RING Capture Modules and ZC Drivers - New iavf-zc driver to support i40e and ice Virtual Functions - Support for VF trust mode on ice adapters (promisc with SR-IOV) - Improve ice driver (E810 adapters) - Update ice driver to v.1.9.11 - Add support to get time, set time, adjust time, send get time - Improvei the NVIDIA/Mellanox (mlx) driver - Extend hardware rules - Add support for VLAN filtering - Add set_default_hw_action API - Fix reported link speed - Fix bidirectional rules - Fix pfring_poll support - Improve the Napatech driver - Add nanosecond timestamp capture when using the packet API in PCAP chunk mode - Improve the ZC drivers API to support more callbacks - Add socket extensions (getsockopt/setsockopt): - SO_GET_DEV_STATS (get_stats ZC drivers callback) - SO_GET_DEV_TX_TIME (get_tx_time ZC drivers callback) - SO_SET_DEV_TIME (set_time ZC drivers callback) - SO_SET_ADJ_TIME (adjust_time ZC drivers callback) - Add management_only_mode to allow opening multiple sockets on the same ZC interface - Update drivers to support latest RH 9.1, Ubuntu 22, Debian kernels * FT Library - Fix double free * nBPF - Add icmp protocol primitive support * nPCAP - Update npcap lib to support for nanosecond time in packet extraction * PF_RING-aware Libpcap/Tcpdump - Update tcpdump to v.4.99.1 - Update libpcap to v.1.10.1 * Examples - Add ztime example - Ability to set/adjust the card clock without capturing/transmitting traffic (external process) - Test for the send-get-time feature - pfsend - Flush queued packets when waiting at real pcap rate and on shutdown - Fix headers ranzomization - Fix crash with -z - pfsend_multichannel - Add support for controlling IPs generated - pfcount - Add -I option to print interface info in JSON format - pfcount_multichannel - Print full packet metadata with -v - zbalance_ipc - Add support for up to 128 queues with -m 1 and -m 2 (new v3 api) - Add -X option to capture TX traffic (standard driver only) - Fix check for queues limit - zdelay - Fix queue size (power of 2) * Misc - Add pfcount_multichannel and pfsend_multichannel to packages - Service script (pf_ringctl) - Add support for configuring RSS via ethtool - Add pre/post scripts for ZC drivers - Handle multi-line driver conf file - Removed obsolete fm10k driver --------------------------------------- 2022-06-30 PF_RING 8.2 * PF_RING Library - New new pfring_get_caplen API - New pfring_get_link_type API - Add src_ip_mask and dst_ip_mask to generic_flow_rule - Add priority to hw_filtering_rule - Add module version to device info returned by pfring_findalldevs - Refactor device name parsing - Use sockaddr_ll in bind (to supports interface names longer than 14 chars) * ZC Library - New Mellanox support for ConnectX 4/5/6 adapters, including hardware offloads for timestamp, filtering, RSS - Fix pfring_zc_numa_get_cpu_node * FT Library - Add native support for flow export over ZMQ * PF_RING Kernel Module - Add support for VXLAN - Add support for both sockaddr and sockaddr_ll in bind - Refactor kernel locking - Discard VLAN in hash cluster_per_flow_ip_with_dup_tuple calculation - Detect when a process owning a PF_RING socket changes the PID (e.g. fork) - Export process PID to userspace - Fix compilation on latest kernels for Rocky Linux and RH 8.5, Debian 9, 10, 11, Ubuntu 18, 20, 22 - Fix net namespace handling - Fix crash when renaming /proc entries * PF_RING Capture Modules - Fix drop statistics on Napatech with HBA set * ZC Drivers - New igb-zc driver v.5.10.2 - New i40e-zc driver v.2.17.4 - New ice-zc driver v.1.8.8 * nBPF - Fix double free * Examples - New sample application pfsend_multichannel to send traffic using RSS - New zdelay application to forward traffic between interfaces, adding a configurable delay - pfcount_multichannel: remove limit on number of threads - zbalance_ipc: improve hashing modes (e.g. add -Y to control eth type) - pfcount: - Add -0 to steer all traffic to RSS queueu 0 - Add -P to set rule priority - ftflow_dpdk: - Set RSS mode/hf (required on some adapters e.g. Mellanox) - Use time from hardware timestamp when available * Misc - Add support for Ubuntu 22 - Remove nBroker support (fm10k adapters are EOL) --------------------------------------- 2021-08-11 PF_RING 8.0 * PF_RING Library - Add pfring_recv_burst API allowing batch receive (when supported by the capture module/adapter) - New zero-copy AF_XDP support (reworked), including pfring_recv_burst support - Fix breakloop when using pfring_loop * ZC Library - New pfring_zc_pkt_buff_data_from_cluster API to get the packet buffer providing packet handle and cluster - New pfring_zc_pkt_data_buff API to get the packet handle providing packet buffer and cluster - New pfring_zc_pkt_buff_pull_only API to remove data from the head room of a packet - Add PF_RING_ZC_BUFFER_HEAD_ROOM define (buffer head room size) - Add PF_RING_ZC_SEND_PKT_MULTI_MAX_QUEUES define (max number of queues in queues_mask) * FT Library - New pfring_ft_api_version API to get the API version - New pfring_zc_precompute_cluster_settings API to get memory information before allocating resources - Add VXLAN encapsulation support - Add tunnel_id to flow metadata - Add support for compiling examples with DPDK >=20 - Fix L7 metadata with short flows * PF_RING-aware Libpcap/Tcpdump - Set 5-tuple clustering as default when using clustering with libpcap * PF_RING Kernel Module - Support for kernel >=5.9 - Add more info to /proc, including promisc mode and ZC slots info - Handle long interface name (error on interface length bigger than 14-char as supported by bind) - Fix channel selection when channel is unknown (e.g. VM) - Fix triple VLAN tags with hw offload/acceleration - Fix check on mapped memory size - Fix potential data race in SO_SET_APPL_NAME - Fix OOB access * PF_RING Capture Modules - Accolade library update (SDK 1_2_20210714) - Napatech library update (SDK 12.7.2.1) - Silicom/Fiberblaze library update (SDK 3_5_9_1) - Add steer_to_ring and ring_id fields to Accolade rules (accolade_hw_rule) - Add support for recv burst on Napatech adapters in chunk mode - Add PF_RING_PACKET_CAPTURE_PRIO env var to set hostBufferAllowance on Napatech adapters - Rename ACCOLADE_RING_BLOCKS env var to ANIC_RING_BLOCKS on Accolade adapters (default is now 16) - Fix Accolade drop counter when capturing from rings - Fix extraction of packets with nsec timestamps on Timeline module (n2disk dump) * ZC Drivers - New ice ZC driver v.1.3.2 (Intel Columbiaville / E810 adapters) with symmetric RSS support - Support latest kernels, including RH/CentOS 8.4 and Ubuntu 20, for all ZC drivers - i40e ZC driver update (v.2.13.10) - e1000e ZC driver update (v.3.8.7) * nBPF - New nBPF primitives 'device ' and 'interface ' to match metadata from Arista MetaWatch devices * Examples - pfcount - Add -B option (burst mode) - pfsend - Add -n support with -f - Add support to reforge src/dst IP from pcap with -S and -D - ftflow - Add -E option to run extra DPI dissection (e.g. to print JA3 info) - zbalance_ipc - Add runtime reload of nDPI protocol configuration file - Add -m 7 option (sample distribution based on eth type) - Add default configuration file /etc/cluster/cluster.conf (when no option is specified) * Misc - Move libraries and utility scripts from /usr/local to /usr - Install pfring-aware tcpdump with packages - Add revision to pfring-dkms version --------------------------------------- 2020-10-19 PF_RING 7.8 * PF_RING Library - Add support for Device ID and Port ID to the extended packet header - Add Arista 7150 Series hw timestamps support (keyframes and packet trailer parsing and stripping) - Add Metawatch Metamako hw timestamps support (packet trailer parsing and stripping) - errno EINTR is now returned on breakloop - Improve XDP support - Replace configure --enable-xdp with --disable-xdp (XDP enabled by default when supported) * ZC Library - New PF_RING_ZC_DEVICE_METAWATCH_TIMESTAMP flag to enable Metawatch hw timestamps - New pfring_zc_get_pool_id API to get the Pool ID - New pfring_zc_run_balancer_v2 pfring_zc_run_fanout_v2 APIs to support filtering functions - BPF support in ZC interfaces, standard interfaces and SPSC queues - Add support for BPF in TX queues - Builtin GTP hash now expose GTP info (flags) - Fix CRC strip on ixgbevf * FT Library - New pfring_ft_flow_get_id API to get the flow ID - New PFRING_FT_IGNORE_HW_HASH flag to ignore hw packet hash - New PKT_FLAGS_FLOW_OFFLOAD_1ST packet flag (first packet of a flow) - Add support for flow slicing - New API pfring_ft_flow_get_users to get flow users (in case of slicing) - Improve application protocol detection - Fix bogus-IP headers parsing * PF_RING-aware Libpcap/Tcpdump - New libpcap v.191 - New tcpdump v.4.9.3 - stats.ps_recv now includes packets dropped due to out of buffer space * PF_RING Kernel Module - Fix channels with standard drivers - Fix 64-bit channel mask - Fix defragmentation of packets with ethernet padding - Fix unnecessary device mapping causing ifindex exhaustion * PF_RING Capture Modules - Update support for Fiberblaze adapters - Fix filtering with Accolade adapters * ZC Drivers - New ice ZC driver supporting E800 Series Intel adapters - Support for Ubuntu 20 LTS - Support for CentOS/RedHat 8.2 - Fix queue attach/detach in ixgbe-zc - Support for kernel 5.4 * nBPF - Add support for matching Local/Remote IP (new extended-BPF primitives) - Support uppercase AND/OR in extended-BPF filters - Fix extended-BPF grammar * Examples - New zfilter_mq_ipc sample app (packet filtering with multiple threads and fanout to multiple consumer processes) - ftflow: - New -H option to ignore hw hash setting PFRING_FT_IGNORE_HW_HASH - New -t option to print stats only - ftflow_dpdk - New -l option to run loopback tests - Add RX/TX ring size configuration - pfsend: - New -z option to precompute randomized sequence - New -W ID[,ID] option to forge VLAN and QinQ VLAN - zbalance_ipc: - New -x option to filter by VLAN ID - Add ability to set BPF to egress queues - Add ability to refresh BPF filters at runtime - New -G : option to forward GTP-C traffic to a specific queue - New zcount -f option to set BPF filters - New pfcount -F option (do not strip FCS) - New zcount/zcount_ipc -t option to read the packet payload - New pcount -e option to set the capture direction - Add VLAN to the flows dumped by ftflow - Fix transmission of small packets (less than 60 bytes) - Fix CPU affinity in ZC sample applications * Misc - Handle failures in service restart during package updates - Add linux headers dependency to the pfring-dkms package - Add actual version/revision to pfring-drivers-zc-dkms packages - Fix installed .so library and links - Fix ZC DAQ compilation and API update - Fix service scripts to avoid command injections --------------------------------------- 2020-02-18 PF_RING 7.6 * PF_RING Library - New pfring_open flag PF_RING_TX_BPF to evaluate the BPF filter also for TX - New pfring_open flag PF_RING_FLOW_OFFLOAD_TUNNEL to dissect tunneled traffic in flow-offload mode - New pfring_open flag PF_RING_DISCARD_INJECTED_PKTS to discard stack-injected packets * ZC Library - New API call pfring_zc_close_device to close a ZC interface - New 'flags' parameter to pfring_zc_create_cluster - Fixed memory allocation in case of more than 4GB of buffer size * FT Library - New API call pfring_ft_set_filter_all_protocols to reset all filtering rules - New API call pfring_ft_set_license to set a license at runtime - New API call pfring_ft_flow_get_ndpi_handle to access the flow nDPI handle - New pfring_ft_l7_protocol_id, pfring_ft_get_ndpi_handle to access the nDPI handle - New pfring_ft_flow_value status field to get flow termination reason - New PFRING_FT_TABLE_FLAGS_DPI_EXTRA flag to enable extra metadata extraction - New PFRING_FT_DECODE_TUNNELS flag to decode tunnels, new tunnel_type item in the flow value - New flow slicing support (pfring_ft_flow_set_flow_slicing API) - Added CAPWAP support - Added flow metadata for HTTP/DNS/SSL - Added global 'default' section to the rules configuration file - Added dpi_min_num_tcp_packets / dpi_min_num_udp_packets to the configuration file - Added flow_idle_timeout / flow_lifetime_timeout to the configuration file - Added src/dst mac to the exported flow key - Added ICMP type/code to flow metadata - Added flags to flow metadata - Added custom flow actions to be defined by the user - Added pfring_ft_load_configuration_ext API - Improved protocol detection for some protocols like Skype - Improved metadata extraction for some protocols like Telnet - Improved pfring_ft_license to return the duration also in demo mode - Changed l7_detected callback: this is called before the flow_packet callback now - Changed pfring_ft_create_table and pfring_ft_flow_value to allocate user metadata as part of the flow structure - Fixed filtering/shunting of custom protocols - Fixed protocol detection in case of guess - Fixed pfring_ft_set_l7_detected_callback user parameter handling * PF_RING-aware Libpcap - Fixed device name check during socket initialization to handle long interface names - Fixed loop break * PF_RING Kernel Module - Added new clustering mode cluster_per_flow_ip_with_dup_tuple - Allow any to capture from any namespace (on the host only) - Remapping ifindex to an internal device index to handle ifindex growing indefinitely - Fixed kernel crash parsing malformed packets (12 nested QinQ VLAN headers with GRE) - Fixed possible race condition - Fixed QinQ VLAN and VLAN offload support - Fixed concurrent access to the ring in case of loopback device and bridge - Compilation fixes for kernel 5.x - Reworked max ring size check to handle cases like jumbo frames - Improved promisc management * PF_RING Capture Modules - New AF_XDP capture module - Napatech library update, fixed findalldev - Accolade library update, fixed caplen vs orig len, new env var ACCOLADE_FLOW_IDLE_TIMEOUT - Myricom library update, license fix with port aggregation - DAG library update * ZC Drivers - New ixgbe-zc driver v.5.5.3 - Support for Intel X550 - Compilation fixes for kernel 5.x - Handling if up/down when the interface is in use by ZC * nBPF - Added support to match custom fields through a callback (nbpf_set_custom_callback) * Examples - zcount improvements: - Added -T option to capture TX - zbalance_ipc improvements: - Fixed -m 4/5/6 with multiple applications and more than 32 queues - New -E option to enable debug mode - New -C and -O options - ftflow_dpdk improvements: - More stats: drops, hw stats, per-queue throughput - New options to control the link status, flow control, autoneg, port speed, checksum offload - New -P option to set the TX rate - New TX test mode and -T option to set the packet len - New -F option to enable forwarding - New -m option to set the mtu - Capture-only mode - Forward optimizations - ftflow_pcap improvements: - Support for processing a PCAP file - New -p option - New -F option to configure filtering/shunting rules - pfsend improvements: - New -8 option to send the same packets times before moving to the next - New -B option to set a BPF filter - New -t option to forge N different source port - New -A option to generate increasing number of flows - pfcount improvements: - New -R option to disable RSS reprogramming - pfbridge now discards injected packets * Misc - New pf_ringcfg script to automatically configure pf_ring and drivers - New pre/post scripts executed by systemd before/after loading pf_ring and drivers - Improved hugepages configuration with multiple nodes - npcap lib update, storage utility functions fix for NFS --------------------------------------- 2018-12-19 PF_RING 7.4 * PF_RING Library - New pfring_open PF_RING_DO_NOT_STRIP_FCS flag to disable FCS/CRC stripping (when supported by the adapter) - Improved support for cross-compilation - New PF_RING_FT_CONF environment variable to enable PF_RING FT support and load L7 filtering rules - New PF_RING_FT_PROTOCOLS environment variable to load L7 protocols when PF_RING FT for L7 filtering is enabled * ZC Library - New pfring_zc_open_device flag PF_RING_ZC_DO_NOT_STRIP_FCS to disable FCS/CRC stripping (when supported by the adapter) - New builtin hash function pfring_zc_builtin_5tuple_hash based on 5-tuple - Fixed SPSC queues BPF support - Fixed KVM/ivshmem support on Ubuntu 16 - Fixed pfring_zc_recv_pkt_burst with ixgbe-zc drivers * FT Library - New pfring_ft_set_l7_detected_callback API to set a callback for classified flows/packets (L7 protocol detected) - New pfring_ft_set_default_action API to set the default action for classified L7 flows - New pfring_ft_flow_get_action API to get the computed/actual flow action asyncronously - New pfring_ft_create_table flow_lifetime_timeout parameter to configure the maximum flow duration - New pfring_ft_load_ndpi_protocols API to load custom nDPI protocols from a configuration file (example: https://github.com/ntop/nDPI/blob/dev/example/protos.txt) - New pfring_ft_is_ndpi_available API to check nDPI availability - Added active_flows to pfring_ft_stats to get the number of currently active flows * PF_RING-aware Libpcap - New pcap_get_pfring_handle API to get the PF_RING handle used by Libpcap - New PCAP_PF_RING_ALWAYS_SYNC_FD environment variable for applications not using the fd provided by pcap_get_selectable_fd - Fix for applications polling from the pcap selectable fd when ZC drivers are used * PF_RING Kernel Module - Updates to support kernel 4.18 or older - Fixed 'stack' TX capture in ZC mode - Fixed ifindex lookup - Fixed promiscuous mode corner cases - Fixed arm32 support - Fixed IPv6 support in software filtering rules - Fixed software hash rules - Fixed kernel clustering in case of non-IP packets (sporadically recognized as IP fragments when the fragments cache was enabled) * PF_RING Capture Modules - Timeline module fixes: - Fixed extraction of non-IP packets - Fixed permissions check when running as unprivileges user, when the user has permissions on the filesystem - Accolade module update to support latest SDK API and features - Fixed Fiberblaze module bulk mode * ZC Drivers - New ixgbevf ZC driver - Drivers updates to support kernel 4.18 or older - Fixed sporadic crashes during application startup on high traffic rates - Fixed the DKMS packages - i40e ZC driver improvements: - Forcing symmetric RSS hash on old firmwares - Improved interrupts management to fix packets delivered in batches - Fixed interrupts management when multiple sockets are active on the same interface (RX+TX or RSS) - ixgbe ZC driver improvements: - Increased max MTU length to 16K - Fixed card reset due to kernel-space TX packets pending while the interface is in use by ZC - Improved hardware timestamp support for igb ZC (i350/82580 adapters) * nBPF - Fixed 'portrange' token in BPF-like filters * Examples - New pftimeline example to extract traffic from a n2disk dump set using the pf_ring API - New pfsend -M option to forge the source MAC address - zbalance_ipc improvements: - Added -m 6 distribution function (interface X to queue X) - Added queues and TX interface stats under /proc (-p) - Fixed multiapp (fanout) distribution for more than 32 egress queues - ftflow improvements: - New -F option to load rules from a configuration file - New -p option to load custom protocols - Improved output (e.g. printing the flow action) - Improved ftflow_dpdk example, added bridging support - Fixed software filtering in pfcount (enabling full headers when filtering is enabled) * IDS Support (Snort/Bro) - Fixed Snort DAQ filtering API - Fixed cluster issues on Bro (due to a libpcap symbols issue) * Misc - Improved 'zbalance_ipc' clusters management with systemd: - Service improvements to set the status after the cluster process is actually up and running - Fixed hugepages memory allocation in case of clusters not using ZC drivers - CoreOS support, pf_ring module and drivers installation scripts - Improved service dependencies with systemd with respect to other ntop applications - Added GID to the hugepages configuration file to allow nonprivileged users to use ZC applications --------------------------------------- 2018-06-12 PF_RING 7.2 * ZC Library - New API pfring_zc_pkt_buff_pull / pfring_zc_pkt_buff_push to manage buffer head room - New builtin hash pfring_zc_builtin_gre_hash with support for GRE tunneling - zbalance_ipc -m 5 option for enabling GRE hashing - Support for up to 64 queues in pfring_zc_send_pkt_multi and pfring_zc_distribution_func - Fix for attaching to ZC IPC queues from containers * FT Library (New) - L7 flow classification and filtering library - Event-driven capture-agnostic API - Sample applications - ftflow: flow records generation with PF_RING capture - ftflow_pcap: flow records generation with PCAP capture - ftflow_dpdk: flow records generation with DPDK capture - fttest: performance benchmarking tool - zbalance_ipc extension to process flows and filter packets * nBroker (New) - Traffic steering and filtering on Intel RRC (FM10K adapters) - Daemon to drive the adapter (nbrokerd) - API to configure the adapter using a C library (nbrokerlib) - Command-line tool with auto-completion to configure the adapter using scripts (nbroker-cli) - Low-level library used by nbrokerd to drive the adapter (rrclib) * PF_RING-aware Libpcap - PCAP_PF_RING_USERSPACE_BPF env var to force userspace filtering instead of kernel filtering * PF_RING Kernel Module - Full support for namespaces and containers - Fixed skbuff forwarding with fast-tx using reflect_packet - Fixed VLAN support in BPF with kernel extensions - Fixed support for NetXtreme cards with multiple queues - Fixed sw hash filtering for IPv6 - Fixed intel_82599_perfect_filter_hw_rule VLAN byte order - Fixed huge rings (high number of slots or huge slot size) - Fixed VLAN offset and packet hash in case of QinQ and VLAN offload - Support for Ubuntu 18 - Support for latest Centos 7 kernel - Support for latest Debian 8 kernel * PF_RING Capture Modules - Released source code for FPGA capture modules including Endace, Exablaze, Inveatech, Mellanox, Netcope - Accolade lib updates - New flag PF_RING_FLOW_OFFLOAD_NOUP to enable flow offload without flow updates (standard raw packets are received, flow id is in the packet hash) - Automatically generate the rule ID using rule_id = FILTERING_RULE_AUTO_RULE_ID - Support for accolade 200Ku Flex adapters - Fiberblaze lib updates - Packet recv in chunk mode - Fixed extraction from npcap/timeline in case of empty PCAP files in the dump set - Endace DAG updates - Setting extended_hdr.pkt_hash from ERF FlowID or Packet Signature extension headers if available - Support for pfring_set_application_name - Support for pfring_dag_findalldevs - Napatech lib updates - Support for sdk v10 * Drivers - e1000e zc driver update v.3.4.0.2 - i40e zc driver update v.2.4.6 - ixgbe zc driver update v.5.3.7 - igb zc driver update v.5.3.5.18 - Fixed interrupts handling on i40e when in zc mode, this fixes the case where packets are received in batches of 4/8 packets - Using nbrokerd for initializing FM10K adapters and configuring the RRC switch * nBPF - Fixed rules constraints * Misc - Reworked init.d systemd support - New pf_ringctl script to manage pf_ring and drivers (this is used by init.d/systemd) - Documentation improvements, Doxygen integration with "read the docs" --------------------------------------- 2017-10-20 PF_RING 7.0 * PF_RING Library - Flow offload support - New PF_RING_FLOW_OFFLOAD pfring_open() flag to enable hw flow offload on supported cards (received buffers are native metadata) - New PF_RING_FLOW_OFFLOAD_NOUPDATES pfring_open() flag to disable flow updates with hw flow offload enabled: only standard raw packets with a flow id are received - New PKT_FLAGS_FLOW_OFFLOAD_UPDATE packet flag to indicate flow metadata in the received buffer (generic_flow_update struct) - New PKT_FLAGS_FLOW_OFFLOAD_PACKET packet flag to indicate raw packet with flow_id in pkt_hash - New PKT_FLAGS_FLOW_OFFLOAD_MARKER packet flag to indicate marked raw packet - Fixes for ARM systems * ZC Library - New pfring_zc_set_app_name API - PF_RING_ZC_PKT_FLAGS_FLOW_OFFLOAD flag to enable hw flow offload - Fixed BPF filters in SPSC queues - Fixed hugepages cleanup in case of application dropping privileges - Fixed sigbus error on hugepages allocation failure on numa systems - Fixed multiple clusters allocation in a single process * PF_RING-aware Libpcap/Tcpdump - Libpcap update v.1.8.1 - Tcpdump update v.4.9.2 * PF_RING Kernel Module - Docker/containers namespaces isolation support - Fixed capture on Raspberry Pi - Implemented support for VLAN filtering based on interface name (., where ID = 0 accepts only untagged packets) - New cluster types cluster_per_flow_ip_5_tuple/cluster_per_inner_flow_ip_5_tuple to balance 5 tuple with IP traffic, src/dst mac otherwise - Fixed hash rule last match, new hash_filtering_rule_stats.inactivity stats * PF_RING Capture Modules - Accolade flow offload support - New hw_filtering_rule type accolade_flow_filter_rule to discard or mark a flow - Netcope support - New hw_filtering_rule type netcope_flow_filter_rule to discard a flow - Improved Fiberblaze support - pfring_get_device_clock support - Ability to set native filters by setting as BPF string 'fbcard:' - Fixed TX memory management - Fixed subnet BPF filters - Fixed drop counter - Fixed capture mode - Fixed sockets not enabled - FPGA error detection - Endace DAG update - npcap/timeline module compressed pcap extraction fix * Drivers - ixgbe-zc driver update v.5.0.4 - i40e-zc driver update v.2.2.4 * nBPF - Fixed nBPF parser memory leak * Examples - New pfsend option -L to forge VLAN IDs - zbalance_ipc improvements - Ability to dump output to log file (-l) - Fixed privileges drop (-D) * Misc - Fixed systemd dependencies, renamed pfring.service to pf_ring.service - New /etc/pf_ring/interfaces.conf configuration file for configuring management and capture interfaces --------------------------------------- 2017-04-24 PF_RING 6.6 * PF_RING Library - New pfring_findalldevs/pfring_freealldevs API for listing all interfaces supported by pf_ring - New timeline module based on libnpcap for seamlessly extracting traffic from a n2disk dumpset using the pf_ring API - Dynamic capture modules loading with dlopen support - Improved pfring_set_bpf_filter to set hw rules when supported by the network card thanks to the nBPF engine * ZC Library - New pfring_zc_set_bpf_filter/pfring_zc_remove_bpf_filter API for setting BPF filters to device queues - Fixed pfring_zc_queue_is_full for device queues - Flushing SPSC queues when a consumer attaches (RX only) * PF_RING-aware Libpcap/Tcpdump - Support for extracting traffix from a n2disk dumpset using libpcap - tcpdump upgrade to v.4.9.0 * PF_RING kernel module - Support for latest ubuntu and centos stable kernels - Support for SCTP and ICMP packet parsing - Packet hash improvements - Added tunneled IP version to packet metadata - Added IP version to sw filters - New kernel cluster hash types for tunneled traffic - QinQ VLAN parsing - Removed deprecated kernel plugins support - Promisc fix in case of multiple devices in a single socket * Drivers - Support for latest ubuntu and centos stable kernels - FPGA modules/libraries are now loaded at runtime using dlopen - RSS support on Intel i211 - Jumbo frames support on i40e - i40e tx optimisations - i40e interrupts fixes in case of RSS - Fiberblaze capture module with chunk mode support - Exablaze capture module - Accolade improvements - Endace DAG update and support for streams - Myricom ports aggregation fixes, new syntax myri:, * nBPF - New nBPF filtering engine supporting an extended subset of the BPF syntax (tunneled traffic and l7 protocols are supproted) - nBPF support for hw filtering on Fiberblaze cards - nBPF support for hw filtering on Intel FM10K cards (Silicom PE3100G2DQIR) - nBPF support for hw filtering on Exablaze cards - nBPF support for hw filtering on Napatech cards and NTPL generation - Support for "start