PF_Ring 编译安装 for Linux SUSE11 SP1

安装环境：

系统：Linux SUSE 11 SP1
内核：Linux 2.6.32.12-0.7-default

安装步骤

1、下载

地址：http://sourceforge.net/projects/ntop/files/PF_RING/

选择版本：5.6.1

博主使用最新版本6.0.3，安装内核失败，失败原因：

msgplus@linux-10108:[/lib/modules/2.6.32.12-0.7-default/kernel/net/pf_ring]dmesg|tail
[  535.695813] eth0: 0xffffc900110b0000, 6c:62:6d:a8:07:dd, IRQ 26
[  539.768002] r8168: eth0: link up
[  670.341850] pf_ring: Unknown symbol sk_attach_filter
[  670.342742] pf_ring: Unknown symbol sk_detach_filter
[  834.951015] pf_ring: Unknown symbol sk_attach_filter
[  834.951909] pf_ring: Unknown symbol sk_detach_filter
[  849.314716] usb 2-1: USB disconnect, address 2
[  850.306723] usb 2-2: USB disconnect, address 3
[ 1323.545911] pf_ring: Unknown symbol sk_attach_filter
[ 1323.546832] pf_ring: Unknown symbol sk_detach_filter

不知道什么原因。

2、解压

tar -xvf PF_RING-5.6.1.tar.gz

3、编译安装内核

cd PF_RING-5.6.1/kernel/
make
sudo make install
sudo insmod pf_ring.ko

在这里编译内核是遇到了问题，类似这样的问题，原因是没有安装：kernel-devel

把SUSE 11 SP1 的系统盘放入光驱，进入控制面板，软件管理界面，把kernel-devel勾选安装上就可以了。

---------------------------------------------------------------------------------------------------------------
make -C /lib/modules/2.6.32-131.21.1.tb514.el5.x86_64/build SUBDIRS=/home/detai/pf_ring/kernel EXTRA_CFLAGS='-

I/home/detai/pf_ring/kernel -DSVN_REV="\"8798\""' modules
make: Entering an unknown directory
make: *** /lib/modules/2.6.32-131.21.1.tb514.el5.x86_64/build: No such file or directory.  Stop.
make: Leaving an unknown directory
make[1]: *** [all] Error 2
make[1]: Leaving directory `/home/detai/pf_ring/kernel'
make: *** [all] Error 2
-----------------------------------------------------------------------------------------------------------------

4、编译PF_Ring库 （没什么好讲的）

cd PF_RING-5.6.1/userland/lib
./configure
make
sudo make install

查看是否安装成功

cat /proc/net/pf_ring/info

PF_RING Version          : 5.6.1 ($Revision: Unversioned directory$)
Total rings              : 0

Standard (non DNA) Options
Ring slots               : 4096
Slot version             : 15
Capture TX               : Yes [RX+TX]
IP Defragment            : No
Socket Mode              : Standard
Transparent mode         : Yes [mode 0]
Total plugins            : 0
Cluster Fragment Queue   : 0
Cluster Fragment Discard : 0

ls /proc/net/pf_ring/

dev  info  plugins_info  stats

5、编译libpcap库（没什么好讲的）

cd PF_RING-5.6.1/userland/libpcap
./configure
make
sudo make install

6、运行实例程序

cd PF_RING-5.6.1/userland/examples
make
sudo pfcount -i eth0

-----------------------------------

遇到的问题

1、版本高
2、insmod 失败，原因