Hi, I have a question on the amount of traffic ntop and libpcap can handle, considering hardware specifications. I have spanned 1Gb of traffic the following linux system and ntop is reporting a large amount of dropped traffic. ntop eventually quits because it runs out of hash table memory. I suspect libpcap is dropping FIN packets and as a result ntop keeps the conversation in memory.
Given the hardware specifications below, how much traffic can I expect ntop and libpcap handle? When I look at the physical interface I only see 100 drops. ntop reports no drops. The majority of dropped traffic appears to be with libpcap. CPU Dual core Intel(R) Xeon(R) CPU 5140 @ 2.33GHz Memory :~# free total used free shared buffers cached Mem: 2075348 1873576 201772 0 7792 1417668 -/+ buffers/cache: 448116 1627232 Swap: 4000176 48 4000128 listening interface eth1 Link encap:Ethernet HWaddr inet6 addr: Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:3678032734 errors:0 dropped:100 overruns:0 frame:0 TX packets:6 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:618105664 (589.4 MiB) TX bytes:492 (492.0 b) Interrupt:114 Memory:fa000000-fa011100 Kernel 2.6.18-6-686 #1 SMP Fri Jun 6 22:22:11 UTC 2008 i686 GNU/Linux libpcap version libpcap0.8-dev 0.9.5-1 ntop version ntop v.3.3.8 >From the ntop Global Traffic page Packets Dropped (libpcap) 115.8% 30,053,796 Dropped (ntop) 0.0% 0 Total Received (ntop) 25,955,606 Total Packets Processed 25,955,609 Unicast 100.0% 25,955,235 Broadcast 0.0% 7 Multicast 0.0% 355 -- Mike Marseglia Systems Administrator, OSHEAN 401-886-0887 x208 401-248-4867 m...@oshean.org _______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop