We are pleased to announce the release of PF_RING 9.4, bringing new capabilities for packet capture and flow processing, along with important improvements across the PF_RING kernel module, capture drivers, flow tracking, and system integration.
Multi-Timeline Extraction with nPCAP
PF_RING 9.4 adds support for multi-timeline extraction from n2disk dump sets, with timestamp-based data aggregation through nPCAP. This makes it possible to work more efficiently with traffic distributed across multiple timelines (e.g. load-balanced to multiple streams or interfaces), allowing traffic to be correlated and reconstructed based on timestamps, even when dumped to different volumes. The new capability is particularly useful for investigations and analysis workflows involving large packet repositories and distributed capture data.
IP-Based RSS for More Flexible Packet Distribution
PF_RING 9.4 introduces support for IP-based RSS (Receive Side Scaling) on adapters that support this capability (NVIDIA and Intel). The PF_RING_IP_ONLY_RSS (legacy API) and PF_RING_ZC_IPONLY_RSS (ZC API) flags can be used to request IP-only RSS hashing. This allows you to ignore ports on UDP/TCP traffic, as well as other fields, when load-balancing traffic flows that would be steered to different cores otherwise. The pfcount_multichannel example has been updated with a new -x option to enable IP-only RSS hashing, to quickly check that traffic is actually getting load-balanced as expected.
Kernel Module Fixes and Improvements
Several changes improve the robustness of the PF_RING kernel module:
- Fixed
packet_rcvbeing called multiple times on new kernels when multiple network namespaces are in use. - Fixed a race condition affecting packet capture on bond interfaces.
- Added per-interface packet counters exposed through
/proc. - Fixed compilation with Linux kernel 6.17 and newer kernel environments.
The release also improves PF_RING service management. The pfring and pfring-dkms package scripts have been reworked to provide more reliable service start/stop sequencing. The ZC-based cluster service reliability has been improved as well, addressing hanging services and eliminating circular restart dependencies.
Enhanced Flow Tracking
The FT library receives several important additions in PF_RING 9.4. It now supports nDPI category filters, allowing flow processing and filtering to make use of nDPI’s traffic classification categories.
A new PFRING_FT_KEY_EXT_MAC flag can be used to include the MAC address in the flow key, providing additional granularity when identifying flows.
Flow statistics now export the unique_source_id, and several fixes improve the reliability of flow statistics metadata and IP-based protocol guessing.
Capture Driver and ZC Improvements
PF_RING 9.4 includes updates and fixes across several major capture driver families, including NVIDIA/Mellanox, Napatech and Intel.
The Intel driver stack receives a substantial set of updates:
- New ice-zc driver v2.5.4, adding support for the Intel E835.
- Fixed symmetric RSS configuration being reset when the
icedriver is reloaded. - RSS hash function selection on
iceis now adjusted according torss_scheme, with source MAC enabled in the L2 hash. - Improved handling of
intel_auxiliarywhen reloading theicedriver. - Fixed
i40e,ixgbe, andigbcompilation on RHEL 9.7. - Improved compilation compatibility across newer kernel versions, including Ubuntu 26, RHEL 9.7+.
PF_RING 9.4 combines new functionality with a broad set of compatibility and reliability improvements. From IP-based RSS and multi-timeline packet extraction to Ubuntu 26 support, enhanced flow metadata, and updated Intel, NVIDIA/Mellanox, and Napatech drivers, this release continues to strengthen PF_RING as a foundation for high-performance network monitoring and packet processing.
PF_RING 9.4 is available now.
As always, we recommend upgrading to the latest release to benefit from the new features, driver improvements, compatibility updates, and bug fixes. The full Changelog is available on GitHub.
Enjoy!