Get a faster NIC/Processor. You're going to have to do some research to figure out what that counter means on your OS. All ntop is doing is echoing the value from libpcap:
myGlobals.device[myGlobals.actualReportDeviceId].droppedPkts.value = pcapStats.ps_drop; How libpcap sets that value depends on the OS. On some it's the ifconfig value, on others it's other things... So it might be ntop not accepting packets fast enough, or it might be a true drop in the kernel before ntop ever sees them - typically, the kernel drops packets when it can't keep up with the interrupt rate (either the NIC buffer being overflowed or the kernel buffer). -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Touitou Sent: Monday, October 20, 2003 11:06 AM To: [EMAIL PROTECTED] Subject: [Ntop] Dropped by the kernel Hello all, I've just setup a test probe on my network. The network is about 20 hosted servers, connected to the internet with a 3com switch. I'm using port mirroring on the switch to get the full traffic on the "probe". The global traffic is a bit less 10Mbps servers to internet and 2Mbps internet to servers. The probe is a P3-733 with 256 MB of RAM (for the moment). The OS is FreeBSD 4.9-RC. There are four network cards in the probe, one with an IP (used for ssh and ntop web), one in promiscuous mode which gets the traffic, the two other are not connected. The cards are fxp (intel), with microcode loaded. The disk subsystem is hardware RAID mirror with two 60GB UDMA66 drives. ntop is cvs version from today. I'm using the rrd plugin to get statistics on the hosts (only my subnets). I'm having more and more packets dropped by kernel... I saw the metrics going up and up and they are more than 70% packets dropped right now (50 minutes of ntop sampling). Here is current top output : last pid: 50265; load averages: 0.41, 0.30, 0.21 up 0+05:10:53 17:59:42 22 processes: 3 running, 19 sleeping CPU states: 0.0% user, 0.0% nice, 0.0% system, 0.0% interrupt, 0.0% idle Mem: 91M Active, 92M Inact, 43M Wired, 11M Cache, 35M Buf, 10M Free Swap: 2048M Total, 2048M Free PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 49994 nobody 34 0 93436K 84532K RUN 9:53 27.10% 27.10% ntop Do you people have any idea why these metrics are going so high ? A rapid browse in the archive showed that "bigger cpu" or "better nic" was the answer... It does not seem to be my problem here. What does this metric exactly show ? Packets lost by ntop for its stats ? Packets refused by kernel ? Anyting else ? Thanks, David. _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
