# PF_RING (I have used Option 1)
###### tags: `ntop` `pf_ring` `OS` `Linux`

## System
Updated by Sohail: 12/10/2021
Model: SCB-1921B-AA1
OS: Ubuntu 20.04 LTS (Kernel 5.8.0-48-generic)

## Download PF-Ring from GIT

# git clone https://github.com/ntop/PF_RING.git

**Note: Read the README.FIRST and OTHER README Files in the PF_RING folder for more understanding.**

## Install Libraries and Dependencies

# apt-get install build-essential bison flex linux-headers-$(uname -r) libnuma-dev libnl-genl-3-dev
# apt-get install net-tools ethtool

## Compile the pf_ring Option 1:

# cd PF_RING
# make
# cd kernel
# make install 
# cd ../userland/lib
# make install
# cd
# cd PF_RING/drivers/intel
# make
# cd ice/ice-*-zc/src
# sudo ./load_driver.sh

### Compile the pf-ring Option 2: Alternative way

# apt-get install pfring
# pf_ringcfg –configure-driver ice –rss-queues 4
# apt-get install pfring-dkms
# mkdir -p /etc/pf_ring
# echo “min_num_slots=65536” > /etc/pf_ring/pf_ring.conf
# sudo systemctl restart pf_ring

### Check the PF_RING Version

# cat /proc/net/pf_ring/info

**If get any error regarding ice-zc drivers, check kernel version, PF-Ring version are as per mentioned above.**

### Install ice-zc drivers using following steps:
Go on http://packages.ntop.org
Select Ubuntu and then follow the steps for Ubuntu 20.04 LTS
Then re-install ntop packages:

# apt-get clean all
# apt-get update
# apt-get install pfring-dkms nprobe ntopng cento
# apt-get install pfring-drivers-zc-dkms

### Run “systemctl status pf_ring” and if it shows no error, that means PF-Ring is ready to use.

# systemctl status pf_ring


### Run PF_RING

# cd PF_RING/userland/examples/
# pf_ringcfg –configure-driver ice –rss-queues 4

Copy the PCAP file PF_RING/userland/examples/ if you want to test your own, otherwise use existing example files there.
2. Now open 4 terminals and run the following 4 commands simultaneously
3. Run ./pfsend -f [pcap_file_name.pcap] -n 0 -i zc:[port_name]@0
4. Run ./pfsend -f [pcap_file_name.pcap] -n 0 -i zc:[port_name]@1
5. Run ./pfsend -f [pcap_file_name.pcap] -n 0 -i zc:[port_name]@2
6. Run ./pfsend -f [pcap_file_name.pcap] -n 0 -i zc:[port_name]@3