What do you think your pps is? Can you confirm it with stats from your switch?
Run top only on the ntop PID and enable thread view. There's another arg to top I can't recall right now, but it will help show you which thread is using the CPU. I'll see if I can find / remember this. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Nicholas Turner Sent: Thursday, June 17, 2010 1:13 PM To: [email protected] Subject: Re: [Ntop] Track Local Hosts Abnormal CPU Usage I assume that would be the -n flag? Seems to have no effect on my operation with -x 4000 hosts, still same CPU usage hovering around 60-70%. Tried -n and --track-local-hosts, after 30 minutes of runtime, ntop has processed 1,798,000 packets, and libpcap has dropped just shy of 10,000,000 packets, and thinks it has only seen 197MB of traffic over this time (definitely been more, since 555% of packets have been dropped). So I would have to assume that the name resolution of IP's is not causing the problem, but thanks for the suggestion! On that note, I have also tried the -b flag to disable protocol decoding, but that did not seem to help my CPU usage. Nick _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
