masscan --pfring: "No pfring adapter available" despite PF_RING kernel module loaded (PF_RING 9.1.0)

[DenTricky73]

Describe the bug
Using masscan with --pfring fails with the message:

No pfring adapter available. Please install pfring or run masscan without the --pfring option.

Even though the PF_RING kernel module is loaded on the system.

Environment

• masscan: Masscan version 1.3.9-integration ( https://github.com/robertdavidgraham/masscan )

• Compiled on: Oct 8 2025 19:09:47

• Compiler: gcc 14.3.0

• OS: Linux

• GIT version: 1.3.2-213-gb99d433

• Distribution(s) tested:

• Ubuntu 24.04.3 LTS

• Kali Linux 8.14.2 Rolling

• Kernel module:

• sudo modinfo pf_ring output:
  filename: /lib/modules/6.16.8+kali-amd64/kernel/net/pf_ring/pf_ring.ko
  alias: net-pf-27
  version: 9.1.0
  description: Packet capture acceleration and analysis
  author: ntop.org
  license: GPL
  srcversion: 5CE538CE1BE9CEECE35DAE8
  depends:
  name: pf_ring
  retpoline: Y
  vermagic: 6.16.8+kali-amd64 SMP preempt mod_unload modversions
  parm: min_num_slots:Min number of ring slots (uint)

• lsmod | grep pf_ring:
  pf_ring 245760 0

Steps to reproduce

1. Install PF_RING kernel module (in my case it shows version: 9.1.0).
2. Install or build masscan (I used the integration build above).
3. Run: sudo masscan 8.8.8.8 -p80 --rate 10 --pfring

Actual behavior
masscan exits with:
No pfring adapter available. Please install pfring or run masscan without the --pfring option.

Expected behavior
masscan should detect the PF_RING adapter(s) and run scanning using PF_RING when --pfring is specified (or provide a clear diagnostic if userspace PF_RING components or adapters are missing).

Notes / Additional info

• The kernel module is present and loaded, but lsmod shows pf_ring with 0 users — this suggests no PF_RING adapters/instances are currently exposed to userspace or masscan cannot find them.
• Possible causes to investigate:
• masscan was not compiled/linked against the appropriate libpfring (or the libpfring version present does not match the kernel module ABI).
• PF_RING userspace components (libpfring, pfringcfg or daemon/tools that expose adapters) are not installed/configured, so no PF_RING adapters are visible to userspace programs.
• PF_RING kernel module version (9.1.0) vs the libpfring userspace version mismatch causing detection failure.
• I do not have further logs from dmesg or pfring utilities in this report; happy to provide if desired.

What I checked / included

• masscan --version output shown above
• modinfo pf_ring showing version: 9.1.0
• lsmod showing pf_ring loaded
• Exact masscan invocation and error message

Suggested next steps for maintainers / for debugging

1. Confirm whether masscan binary was built with PF_RING userspace support enabled and which libpfring version / headers were used at compile time.
2. Check for presence of libpfring in userspace:
   • ldd $(which masscan) or ldconfig -p | grep pfring (to see which libpfring, if any, masscan links to).
3. Check for PF_RING adapters and kernel messages:
   • dmesg | grep -i pf_ring
   • Look for PF_RING adapter listings (depending on PF_RING tools available, e.g. pfringcfg or /proc/net/pf_ring).
4. Report whether masscan needs a specific PF_RING version (9.0.x vs 9.1.x) or ABI compatibility notes.
5. If a simple version mismatch is the cause, consider suggesting a clear diagnostic on startup (e.g., version check between userspace lib and kernel module) or a clearer error message indicating "libpfring not found / no PF_RING adapters exposed".

If you prefer, I can also attach additional debug outputs (dmesg, ldd output, contents of /proc/net if present) to help triage. Thanks!

[mzpqnxow]

A few things:

• Are you running with adequate privileges? Running as root is simplest for testing
• Have you tried specifying the interface explicitly using —adapter ?
• Where/how did you install pfring? The LKM is loaded, yes, but where is the pfring userland shared library? Is it in your LD_LIBRARY_PATH or a directory listed in ld.so.conf? find /usr /lib* -name ‘libpf*.so’ will find the library. If it’s in a directory like /usr/local/lib you may need to export LD_LIBRARY_PATH=/usr/local/lib.
• what does sudo pf_ringcfg --list-interfaces say? (Also, you should glance through this if you haven’t already