Hi On Tue, 2009-01-06 at 11:21 -0500, Mike Marseglia wrote: > I have a question on the amount of traffic ntop and libpcap can > handle, considering hardware specifications. I have spanned 1Gb of > traffic the following linux system and ntop is reporting a large > amount of dropped traffic. ntop eventually quits because it runs out > of hash table memory. I suspect libpcap is dropping FIN packets and > as a result ntop keeps the conversation in memory.
Your probably want to consider using PF_RING over libpcap for this capture rate: http://www.ntop.org/PF_RING.html You'll need to recompile ntop to do so. Graeme _______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
