PF_RING Documentation

PF_RING is a high speed packet capture library that turns a commodity PC into an efficient and cheap network measurement box suitable for both packet and active traffic analysis and manipulation. Moreover, PF_RING opens totally new markets as it enables the creation of efficient application such as traffic balancers or packet filters in a matter of lines of codes.

User's Guide

• Get Started
  • 1. Installing from packages
  • 2. Installing from GIT
• Vanilla PF_RING
  • Packet Parsing
  • Packet Filtering
  • Packet Clustering
• PF_RING ZC (Zero Copy)
  • PF_RING ZC for Intel
  • Other Drivers
  • ZC Library/API
• PF_RING FT (Flow Table)
  • API Overview
  • nDPI Integration
  • L7 Filtering and Shunting
  • IDS Acceleration
• Sample Applications
  • Compiling the Applications
  • Basic Packet Capture
  • Basic Packet Transmission
  • Basic Packet Forwarding
  • Load Balancing
  • Divide and Conquer
  • L7 Flow Classification
• Drivers and Modules
  • 1. Adapters Comparison Table
  • 2. AF_XDP Support
  • 3. Silicom/Fiberblaze Support
  • 4. Intel Support
  • 5. NVIDIA/Mellanox Support
  • 6. Napatech Support
  • 7. pcap Support
  • 8. Linux TCP/IP Stack Injection Module
  • 9. n2disk Timeline Module
• Load Balancing / RSS
  • RSS (Receive Side Scaling)
  • PF_RING Cluster (Kernel)
  • ZC Cluster (zbalance_ipc)
  • Using ZC Cluster with systemd
• Filtering
  • 1. nBPF
  • 2. Runtime Filtering
• Containers Support
  • 1. Network Namespaces
  • 2. Using PF_RING with Docker
  • 3. Using PF_RING with CoreOS
• VM Support
  • 1. PCI Passthrough with PF_RING ZC
  • 2. SR-IOV with PF_RING ZC
  • 3. QEMU/KVM Support in PF_RING ZC
• IDS/IPSs Integration
  • 1. Using Zeek with PF_RING
  • 2. Using Suricata with PF_RING
  • 3. Using Snort with PF_RING
  • 4. Using Snort with PF_RING ZC
• Hugepages Support
  • For the impatient
  • How to configure Hugepages permanently
  • The whole story
  • Possible errors
• Capabilities
• AMD Processors
  • Common Issues
• Intel Processors
  • Common Issues

Developer's Guide

• API Documentation
  • 1. PF_RING Kernel Internal API
  • 2. PF_RING API
  • 3. PF_RING ZC API
  • 4. PF_RING FT API
  • 5. Libpcap API

Other Products

• ntopng
• nProbe
• nProbe Cento
• n2disk
• nDPI
• nEdge
• nScrub
• nBox
• nTap