Many PF_RING users know that for avoid patching the Linux kernel, as of PF_RING 4.x packets are received though NAPI. This means that the packet journey is the same used in standard Linux, thus the performance improvement with respect to vanilla Linux is minimal (< 5%) although PF_RING allows to do many more things than the standard AF_PACKET.
In order to boost performance PF_RING supports a parameter named transparent_mode that can be used when the module is loaded into the kernel as follows insmod pf_ring.ko transparent_mode=X where X can either be set to 0, 1 or 2. Its meaning changes depending on the NIC driver used for the interface on which you hook your PF_RING-based application (e.g. pfcount); so it might be that on one interface you have a standard driver, and on another interface you have a PF_RING-aware driver. Currently all supported PF_RING-aware drivers reside in PF_RING/drivers in addition to TNAPI. Note that in the case of DNA drivers, as the kernel is totally bypassed, the transparent_mode parameter has no effect.
The following table explains the meaning of this parameter.
| Mode | Standard driver | PF_RING-aware driver | Packet Capture Acceleration |
|---|---|---|---|
| 0 | Packets are received through Linux NAPI | Same as Vanilla Linux | |
| 1 | Packets are received through Linux NAPI | Packets are passed to NAPI (for sending them to PF_RING-unaware applications) and copied directly to PF_RING for PF_RING-aware applications (i.e. PF_RING does not need NAPI for receiving packets) | Limited |
| 2 | The driver sends packets only to PF_RING so PF_RING-unaware applications do not see any packet | The driver copies packets directly to PF_RING only (i.e. NAPI does not receive any packet) | Extreme |