Suricata

pfring.h in SVN (PF_RING 5.3.1) now has:

  /* ********************************* */

  #define PF_RING_REENTRANT        1 << 1
  #define PF_RING_LONG_HEADER     1 << 2
  #define PF_RING_PROMISC          1 << 3

  /* ********************************* */

  pfring* pfring_open(char *device_name, u_int32_t caplen, u_int32_t flags);

whereas in PF_RING 5.3.0:-

  pfring* pfring_open(char *device_name, u_int8_t promisc, 
                      u_int32_t caplen, u_int8_t reentrant);

The change was in r5426:

r5246 | deri | 2012-03-19 22:12:21 +0000 (Mon, 19 Mar 2012) | 2 lines

Updated pfring_open* interface prototypes

Suggested fix:

--- src/source-pfring.c 2012-04-12 14:03:48.000000000 +0100
+++ src/source-pfring.c.hacked 2012-04-23 17:30:13.000000000 +0100
@@ -334,7 +334,8 @@
         SCReturnInt(TM_ECODE_FAILED);
     }

-    ptv->pd = pfring_open(ptv->interface, LIBPFRING_PROMISC, (uint32_t)default_packet_size, LIBPFRING_REENTRANT);
+/*    ptv->pd = pfring_open(ptv->interface, LIBPFRING_PROMISC, (uint32_t)default_packet_size, LIBPFRING_REENTRANT;*/
+    ptv->pd = pfring_open(ptv->interface, (uint32_t)default_packet_size, LIBPFRING_REENTRANT << 1 | LIBPFRING_PROMISC << 3);
     if (ptv->pd == NULL) {
         SCLogError(SC_ERR_PF_RING_OPEN,"opening %s failed: pfring_open error",
                 ptv->interface);

but this will need changes in configure to know when to implement the change.

I'm not sure what version number the PF_RING developers will use for the release (in the next week or so) but currently it's 5.3.1. However it does include quite a few big changes (mostly to DNA and using a new libzero library). There are probably other things we could take advantage of ...