Ntop does WAY more than just capture packets. Try disabling name resolution / dns lookups to start.
----- Original Message ----- From: [email protected] <[email protected]> To: Luca Deri <[email protected]> Cc: [email protected] <[email protected]>; [email protected] <[email protected]> Sent: Fri Jan 07 11:35:12 2011 Subject: Re: [Ntop] ntop +pf_ring Hi it spans automaticaly over multiple cores? With tcpdump i can capture packets and store them to hdd without any loss even without pf_ring, so i dont think it is a capture problem. But the ntop stays at 100% but i have 4 cores available with hyperthreding, totaly 8 cores. the loss rate is about 1000% :) Cu respect, Adrian Rapa Millennium IT tel.: 0372-168.638 fax.: 021-569.79.99 e-mail: [email protected] web: www.mitnet.ro On 07.01.2011 18:03, Luca Deri wrote: > Adrian > cores have nothing to do with the your question. ntop is multithread and > threads can be spawn to multiple cores > > Luca > > On Jan 7, 2011, at 4:18 PM, Adrian Rapa wrote: > >> hi, >> so it can use only one core? >> >> Cu respect, >> Adrian Rapa >> Millennium IT >> >> tel.: 0372-168.638 >> fax.: 021-569.79.99 >> e-mail: [email protected] >> web: www.mitnet.ro >> >> >> On 07.01.2011 15:02, Luca Deri wrote: >>> Adrian >>> ntop is CPU bound that means that even if you accelerate packet capture, >>> ntop performance will not increase much. Please use nprobe are preprocessor >>> of packets that are converted to flows and analyzed by ntop >>> >>> Regards Luca >>> >>> On Jan 1, 2011, at 6:48 PM, Adrian Rapa wrote: >>> >>>> hi, >>>> i am trying to do a ntop pfring setup. >>>> I compiled pf_ring, e1000e and libpcap drivers from svn. >>>> I compiled ntop with ./configure --with-rrd-home=/opt/rrdtool-1.4.5/ >>>> --with-pcap-root=/kit/pf_ring/PF_RING/userland/libpcap-1.0.0-ring/ >>>> LIBS="-lpcap -lpfring -lpthread" >>>> I have eth1 which is a port mirror with about 700Mb of trafic RX+tx. >>>> >>>> If i start ntop -i eth1 i have a lot of packet loss. If i use top, i see >>>> that a single cpu is used to capture packets. >>>> As i know pf_ring should increase the packet capture rate, but it is >>>> acting as normal linux pcap. >>>> >>>> is it normal for ntop to use a single cpu, or can i do somenthing to use >>>> all 8 CPU? >>>> >>>> >>>> -- >>>> Cu respect, >>>> Adrian Rapa >>>> Millennium IT >>>> >>>> tel.: 0372-168.638 >>>> fax.: 021-569.79.99 >>>> e-mail: [email protected] >>>> web: www.mitnet.ro >>>> >>>> >>>> _______________________________________________ >>>> Ntop mailing list >>>> [email protected] >>>> http://listgateway.unipi.it/mailman/listinfo/ntop >>> --- >>> >>> "Debugging is twice as hard as writing the code in the first place. >>> Therefore, if you write the code as cleverly as possible, you are, by >>> definition, not smart enough to debug it. - Brian W. Kernighan >>> >>> _______________________________________________ >>> Ntop mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop >>> > --- > We can't solve problems by using the same kind of thinking we used when we > created them - Albert Einstein > > <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
