search

robertdavidgraham / masscan

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
GNU Affero General Public License v3.0
23k stars 3.02k forks source link

pf_ring zc not getting any packets back #729

Closed jmac125 closed 10 months ago

jmac125 commented 10 months ago 
masscan -p80 --rate 100000000000 0.0.0.0/0 --exclude 192.168.0.1/24 -oX scan.xml -i zc:eno1 --source-mac B4:96:91:84:3C:30 --source-ip 147.75.47.185 --router-mac 06:00:de:ad:be:ef
#########################################################################
# ERROR: You do not seem to have a valid PF_RING ZC 8.4.0.230202
# license for eno1 (MAC B4:96:91:84:3C:30) [Intel 10/40 Gbit i40e family]
# ERROR: Missing license file
# ERROR: Please get one at http://shop.ntop.org/
#########################################################################
# PF_RING ZC running in demo mode (packet capture and transmission
# limited to 5 minutes)
#########################################################################
rx ring disable timeout
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2023-08-21 21:21:38 GMT
Initiating SYN Stealth Scan
Scanning 4294967040 hosts [1 port/host]
rate:4102.82-kpps, 10.27% done,   0:15:38 remaining, found=0
pf_ringcfg --list-interfaces
Name: enx72ad6a0d0e60      Driver: cdc_ether  RSS:     1    [Linux Driver] 
Name: eno1                 Driver: i40e       RSS:     8    [Running ZC]   
Name: eno2                 Driver: i40e       RSS:     8    [Running ZC]

I have pf_ring installed and running with an intel NIC. It's sending about 4x the rate it was without zc, but i'm not getting any responses. I thought it was strange that i had to specify source-mac,ip and router mac, so it may be related to those if i try the --pfring option without zc in the name, i get 

masscan -p80 --rate 100000000000 0.0.0.0/0 --exclude 192.168.0.1/24 -oX scan.xml -i eno1 --pfring
No pfring adapter available. Please install pfring or run masscan without the --pfring option.
pf_ringcfg --list-interfaces                            
Name: enx72ad6a0d0e60      Driver: cdc_ether  RSS:     1    [Linux Driver] 
Name: eno1                 Driver: i40e       RSS:     8    [Running ZC]   
Name: eno2                 Driver: i40e       RSS:     8    [Running ZC]
jmac125 commented 10 months ago 
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
4: enx72ad6a0d0e60: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
    link/ether 72:ad:6a:0d:0e:60 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::70ad:6aff:fe0d:e60/64 scope link 
       valid_lft forever preferred_lft forever
5: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether b4:96:91:84:3c:30 brd ff:ff:ff:ff:ff:ff
    altname enp1s0f0
    inet 147.75.47.185/31 brd 255.255.255.255 scope global eno1
       valid_lft forever preferred_lft forever
    inet6 2604:1380:4111:ed00::1/127 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::b696:91ff:fe84:3c30/64 scope link 
       valid_lft forever preferred_lft forever
6: eno2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether b4:96:91:84:3c:31 brd ff:ff:ff:ff:ff:ff
    altname enp1s0f1
    inet6 fe80::b696:91ff:fe84:3c31/64 scope link 
       valid_lft forever preferred_lft forever
jmac125 commented 10 months ago

nvm, i screwed up the interfaces file. the interface should not have a /31 addr