Rob Trout wrote: >I'll give -g a shot and see how much that affects our data. I like >seeing the flows to external hosts, will those still be tracked since >either the source or destination will be a local ? > > With -g all the non-local hosts will be marked as "other" so you hash will contain this dummy host + all your local hosts.
>Thank you both Luca and Burton. You're better than a lot of the 'paid >for' support contracts we have. > > Thank you. I'm doing my best but I simply cannot support all of you as I would like as I've very little time. Cheers, Luca >-R > > >-----Original Message----- >From: Luca Deri [mailto:[EMAIL PROTECTED]] >Sent: Wednesday, October 02, 2002 10:32 AM >To: [EMAIL PROTECTED] >Subject: Re: [Ntop] Large hash > > >Rob Trout wrote: > > > >>I am running it on a border gateway, it's a mirrored external port.... >> >>I used the flag to not trust MACs, is there anything else I can do to >>limit the hash size? >> >> >> >> >What about -g (and -z if you want to decrease load) ? > >Cheers, Luca > > > >>Robert Trout >>T-Speed >>[EMAIL PROTECTED] >>(office) 214.237.3388 >>www.t-speed.com >> >> >>-----Original Message----- >>From: Luca Deri [mailto:[EMAIL PROTECTED]] >>Sent: Wednesday, October 02, 2002 7:02 AM >>To: [EMAIL PROTECTED] >>Subject: Re: [Ntop] Large hash >> >> >>Rob, >>a large hash is normal for a large nw. If this is not your case there's >>something wrong. >> >>Where are you running ntop? On a border gw? Make sure you use the >>proper >> >>options. >> >>Regards, Luca >> >>Rob Trout wrote: >> >> >> >> >> >>>After running for a few days, I get: >>> >>>Sep 30 22:45:43 stats ntop[1682]: Extending hash size >>>[newSize=65536][deviceId=0] >>> >>>Which seems like a pretty large hash compared to others I have seen on >>>the list. We're running ntop 2.1.51 on Mandrake 8.2. It's a p3-900 w/ >>>256mb ram. This host is only used for ntop. I'm starting with the >>>command line of: >>> >>>/usr/local/bin/ntop -P /server/ntop-current/ntop/database -p >>>/server/ntop-current/ntop/utils/protocol.list -d -u ntop -o -m >>>x.x.x.x/x >>> >>>Is there a way to limit the hash-size, and if so what would be the >>>trade-off of doing so? This is monitoring an internet connection that >>>averages about 4 mb, but can peak at 9-10mb >>> >>> >>>Thanks in advance. >>> >>> >>>_______________________________________________ >>>Ntop mailing list >>>[EMAIL PROTECTED] >>>http://lists.ntop.org/mailman/listinfo/ntop >>> >>> >>> >>> >>> >>> >> >> >> >> > > > > -- Luca Deri <[EMAIL PROTECTED]> http://luca.ntop.org/ Hacker: someone who loves to program and enjoys being clever about it - Richard Stallman _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://lists.ntop.org/mailman/listinfo/ntop
