Doubtful. I don't see ANY logic in ntop to purge the serial cache. You'll basically have at least one entry for every single IP address and (local) mac address that ntop knows about.
The counter is incremented in the !hostFound leg in getHostInfo - perhaps you have hosts aging out of the structures then re-appearing, so they're treated as new?? No... wait... that code is wrong... Try the attached patch - it should prevent the incorrect duplicate entries. LET ME KNOW, so I can forward it on to Luca... Also, if you get a huge file again, you can use the attached little program to dump stuff from it. With some sort commands you'll then get a feel for what's in the file. Remember, the serialCache.db file is recreated on startup... -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Christian Hammers Sent: Monday, April 29, 2002 3:11 AM To: [EMAIL PROTECTED] Subject: Re: [Ntop-dev] serialCache is growing too fast for my flash card :-( Hello On Thu, Apr 25, 2002 at 11:58:00AM -0500, Burton M. Strauss III wrote: > Each entry is TINY... (an ip address in dotted quad or a mac address) and should >only be created again if you've never seen that > host before... What are you monitoring that you have 700K entries? My current directories are smaller again. Maybe it was related to the fact that earlier versions of ntop didn't purge sessions! thanks, -christian- -- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 [EMAIL PROTECTED] Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Authorized Reseller _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
dumpgdbm.c
Description: Binary data
dumpgdbm.c
Description: Binary data
BMS0063-hashc-hostfound-flag-problem.patch
Description: Binary data
