Probably
not.
The GDC_out_pie chart errors are unique to 2.2
and represent problems with the underlying gdchart
library.
The
changes Luca made in 2.2.1 are a total rewrite of the graph.c routine - moving
the minimal bits that ntop requires from gdchart into graph.c and then dumping
gdchart.
The
problems with gdchart are why he chose this (drastic) step.
If you
read the 2.2 code in graph.c that calls GDC_out_pie:
/* parent */
#ifdef
GDC_WATCHDOG_DEBUG
traceEvent(CONST_TRACE_INFO, "GDC_WATCHDOG_DEBUG: in parent, waiting for %d...\n", fork_result);
#endif
traceEvent(CONST_TRACE_INFO, "GDC_WATCHDOG_DEBUG: in parent, waiting for %d...\n", fork_result);
#endif
wait_result = waitpid(fork_result, &status, 0);
if (wait_result == (pid_t) -1) {
traceEvent(CONST_TRACE_WARNING, "GDC_out_pie(002) - wait failed/interrupted (%d - %s)",
errno,
(errno == ECHILD ? "ECHILD" :
errno == EINVAL ? "EINVAL" :
errno == EINTR ? "EINTR" : "unrecognized code"));
} else if (wait_result != fork_result) {
traceEvent(CONST_TRACE_WARNING, "GDC_out_pie(003) - unexpected child termination");
} else if (status) {
traceEvent(CONST_TRACE_WARNING, "GDC_out_pie(004) - child abnormal termination");
} else {
#ifdef GDC_WATCHDOG_DEBUG
traceEvent(CONST_TRACE_INFO, "GDC_WATCHDOG_DEBUG: in parent, ran OK\n");
#endif
return;
}
traceEvent(CONST_TRACE_WARNING, "GDC_out_pie(002) - wait failed/interrupted (%d - %s)",
errno,
(errno == ECHILD ? "ECHILD" :
errno == EINVAL ? "EINVAL" :
errno == EINTR ? "EINTR" : "unrecognized code"));
} else if (wait_result != fork_result) {
traceEvent(CONST_TRACE_WARNING, "GDC_out_pie(003) - unexpected child termination");
} else if (status) {
traceEvent(CONST_TRACE_WARNING, "GDC_out_pie(004) - child abnormal termination");
} else {
#ifdef GDC_WATCHDOG_DEBUG
traceEvent(CONST_TRACE_INFO, "GDC_WATCHDOG_DEBUG: in parent, ran OK\n");
#endif
return;
}
and
read up on man fork, you'll see that it's possible for a fork()ed child to start
and die before the parent gets control, causing the waitpid to return less than
optimal results. I suppose you could try putting a sched_yield() into the
child, but that only narrows the window, it doesn't eliminate
it.
-----Burton
-----Original Message-----A 17:55 16/06/2003 -0500, vous avez �crit :
From: Dominique Lalot [mailto:[EMAIL PROTECTED]
Sent: Tuesday, June 17, 2003 12:18 AM
To: Burton M. Strauss III
Subject: RE: [Ntop] ftp passive
Since ntop doesn't see the packets using netflow, there's no way to id
passive traffic. Read the back traffic concerning the 2.2 ./configure
option --enable-netflowassumeftpdata.
Hello Burton,
Are you speaking about cisco netflow ?. I have nothing of that in my configuration here.
It seemed that there is no fix about GDC_out_pie in the 2.2.0 branch in CVS.
Is it possible to add it, so I can get something stable?.
Thanks
Dominique
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Dominique Lalot
Sent: Monday, June 16, 2003 7:36 AM
To: [EMAIL PROTECTED]
Subject: [Ntop] ftp passive
Hello,
May be it's a FAQ. I only get a few messages about it using a google search.
I have a pure FTP server on my network, and FTP is less than 20% of TCP
protocol. I guess that all the rest is FTP passive.
Is there something to do to activate the search of FTP passive connections?.
Thanks
Dominique
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
