> On Fri, Jun 30, 2017 at 12:06 AM, Kevin Wilson <wkevils@gmail.com> wrote:
> Hello,
> I have tried to set CONFIG_PACKET=m in kernel 4.11 and rebuilt the
> kernel and rebooted.
> I am using Ubuntu 16.04.

> After reboot, the af_packet.ko kernel module is loaded:
> lsmod
> shows:
> af_packet              45056  2

> But I cannot remove it:
> rmmod af_packet
> rmmod: ERROR: Module af_packet is in use

> I want to be able to rmmod it, for adding debug printing, etc. 

> How can I find which applications uses it ? (So I will be able to stop
> them, rmmod af_packet, and then insmod it again)?

> Regards,
> Kevin

Hello Kevin,

Quick fix and short answer to your problem is to disable internet.

run this in a shell/terminal: /sbin/ifconfig etho0 down 

Now check lsmod again, once internet is disabled the used by column which lsmod reports as af_packet being used by 2 devices/processes/whatever... will show 0.

Now when you sbin/rmmod af-packet it will work and unload af_packet.

Do whatever debug printing you have to.... 

sbin/insmod af_packet 

enable internet by running : /sbin/ifconfig etho0 down 

now check dmesg or what ever you use. Wash, rinse then repeat as needed.

The answer to your question "How can I find which applications uses it ?"  is something "I" have been trying to figure out for the last 9 odd years. Maybe folks with more experience can shed some light on how to go about doing this ?

More experienced equates to = Valdis / Gregkh / DerRichard / Realtime localmodconfig Steve Rostedt  and too many others to name.... :)

Hope this helps - Aruna