nJcx's Blog

十年生死两茫茫,写程序,到天亮。相顾无言,惟有泪千行

高版本Packetbeat借Pcap兼容PF_RING


安装

 git clone https://github.com/ntop/PF_RING.git 
 cd PF_RING-7.4.0-stable/
 yum install numactl-devel libnuma-dev
 UNAME=$(uname -r)
 yum install gcc kernel-devel-${UNAME%.*}
 make
 make install
 cd /lib/modules/`uname -r`/kernel/net/pf_ring
 insmod pf_ring.ko min_num_slots=8192 quick_mode=1
 cd  /lib/modules/`uname -r`/kernel/drivers/net/ethernet/intel/igb
 xz -d igb.ko.xz 
 rmmod igb ; insmod igb.ko 
 ethtool -i eno5
 dmesg | grep Ethernet
 cat /proc/net/pf_ring/infocat /proc/net/pf_ring/info

到这里PF_RING模块,以及网卡驱动已经安装好了

然后

# yum remove libpcap  libpcap-devel 
# cd PF_RING-7.4.0-stable/userland/libpcap
# make install

安装高版本Packetbeat,

packetbeat.interfaces.type: pcap

即可