Hi all, let me explain this in detail. A hash is a contiguous array of list pointers. Incoming flows are hashed (using the 5 tuples) and the obtained hash_id value is used to identify the array index. As hashes are a way to "compress" information, it might happen that two different flows have the same hash_id, thus the list pointer is used to maintain a list of "collisions". With -w you set the array size, whereas the list size can be as long as necessary. This said, in order to set an upper limit, nprobe via
[--max-num-flows|-M] <max num flows>| Limit the number of active flows defines the max number of flows it can handle This said, you must choose -w according to the number of flows you expect to have in your network. The value must be a good compromise between number of flows and memory usage. We suggest to set it to twice the expected number of concurrent flows, but as I have explained it, in case of large flow number, you won't drop flows (except you will specify a low value for -M) but just have a slower probe as it has to maintain long collision lists. If you start nprobe with "-b 1" you can see some stats like 13/Mar/2011 11:30:13 [nprobe.c:1475] Flow Buckets: [active=11401][allocated=11401][toBeExported=0][frags=0] 13/Mar/2011 11:30:13 [nprobe.c:1511] Processed packets: 24834 (max bucket search: 3) In this case nProbe says that 1. your flow cache has 11401 entries (= flows) 2. the longest collision list is 3 that's still acceptable. If you exceed 8, you better use a bigger value for -w next time you start nProbe. I hope I have clarified the details. Regards Luca On Mar 10, 2011, at 11:31 AM, Maurizio Molina wrote: > > > On 10.03.2011 11:16, Yuri Francalacci wrote: >> Daniel >> the meaning of "hash size is static" means that once you decide its size, >> this size is fixed. >> The meaning of "tunable" means that is the default hash size does not fit >> your requirements (due traffic conditions), > > and how can you realize that you run into that condition? I mean, will nprobe > log somewhere flow accounting losses due to a too small hash size? > Thanks, > Maurizio > > you can choose to set the size >> you prefer/need, but this allocation is done up on nprobe statup. >> Regards, Yuri >> >> >> On Thu, 10 Mar 2011 11:12:15 +0100, Daniel Aschwanden<[email protected]> wrote: >>> Ciao Luca and community, >>> >>> I have a question about the allocation of the hash in nProbe. >>> >>> On page 28 of your documentation (section 2.4 Tuning nProbe >>> Performance), you state that the hash size is static, but on the >>> footnote you mention that the hash "can grow as needed according to >>> traffic". Does this mean that one have to set the -w flag according to >>> the traffic (which makes sense) or does nProbe grow his hash according >>> to traffic? >>> >>> Sorry about this fuzzy question, but in my eyes the footnote contradicts >>> the statement of static allocation. >>> >>> Thanks a lot for your clarification. >>> >>> Cheers >>> >>> Dani >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> > > -- > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc --- Due to lack of interest, tomorrow is cancelled - Kaiser Chiefs _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
