Hi, I hope nprobe is also discussed here because I have a problem with it.
I'm testing nprobe for complete traffic statistics for a cable provider. Currently we have about 1Gbit/s of traffic to scan but will be divided over 4 nprobe servers in it's final implementation. Anyway, with initial iperf tests and nprobe everything seemed okay but with the first tests on live traffic the nprobe process was allocating memory like a madman. About 1MB per second. After there wasn't any memory left, the server crashed. (The server had 2500MB of memory) Initially I blamed weird dual Xeon Compaq setup and/or/even RedHat but back in our Office I set up a new nprobe server (dual Pentium Pro-200 with 64MB of memory) based on Slackware 9.1 and captured on the live nprobe server a pcap stream of 91MB (1.000.000 packets) and copied it to the new machine. Replaying the captured stream with tcpreplay I saw the nprobe memory footprint rise to 21MB. This means the memory increase was cause by the amount of different flows. (I'm talking here about 1500 exported flows per second) Playing the stream again DIDN'T increase the allocated nprobe memory size. I would figure nprobe keeps memory allocated for each unique flow even if the flow has already expired. Is this the normal behaviour of nprobe or do I have a situation which hasn't tested before? Any help would be welcome. Thanks, Danny _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
