Others probably already mentioned PFRing. Might also want to ensure you're only processing data you NEED to. Maybe you can filter some out until the rate is something tolerable and still accomplish your goals?
G -----Original Message----- From: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] On Behalf Of Mike Marseglia Sent: Tuesday, January 06, 2009 10:22 AM To: ntop@unipi.it Subject: [Ntop] ntop traffic limit? Hi, I have a question on the amount of traffic ntop and libpcap can handle, considering hardware specifications. I have spanned 1Gb of traffic the following linux system and ntop is reporting a large amount of dropped traffic. ntop eventually quits because it runs out of hash table memory. I suspect libpcap is dropping FIN packets and as a result ntop keeps the conversation in memory. Given the hardware specifications below, how much traffic can I expect ntop and libpcap handle? When I look at the physical interface I only see 100 drops. ntop reports no drops. The majority of dropped traffic appears to be with libpcap. CPU Dual core Intel(R) Xeon(R) CPU 5140 @ 2.33GHz Memory :~# free total used free shared buffers cached Mem: 2075348 1873576 201772 0 7792 1417668 -/+ buffers/cache: 448116 1627232 Swap: 4000176 48 4000128 listening interface eth1 Link encap:Ethernet HWaddr inet6 addr: Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:3678032734 errors:0 dropped:100 overruns:0 frame:0 TX packets:6 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:618105664 (589.4 MiB) TX bytes:492 (492.0 b) Interrupt:114 Memory:fa000000-fa011100 Kernel 2.6.18-6-686 #1 SMP Fri Jun 6 22:22:11 UTC 2008 i686 GNU/Linux libpcap version libpcap0.8-dev 0.9.5-1 ntop version ntop v.3.3.8 >From the ntop Global Traffic page Packets Dropped (libpcap) 115.8% 30,053,796 Dropped (ntop) 0.0% 0 Total Received (ntop) 25,955,606 Total Packets Processed 25,955,609 Unicast 100.0% 25,955,235 Broadcast 0.0% 7 Multicast 0.0% 355 -- Mike Marseglia Systems Administrator, OSHEAN 401-886-0887 x208 401-248-4867 m...@oshean.org _______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
