> Looks like there's no problem with tcpdump writing to a file. No packet > lost in kernel at all, no buffer problems, etc. > > I guess (I'm not a programmer at all) problem is between the libpcap > (kernel) and ntop handling the data from libpcap : it does not handle > the data fast enough so slows down the results and make the kernel drops > packets. > Just like having tcpdump output to screen make the kernel drops packets. > > ntop uses "only" 25 to 30% of CPU. > interrupts is less than 5% > > I guess faster CPU is still the answer ? > At least, kernel/NIC is not the problem.
What OS are you using (you may have said in an earlier mail, sorry)? Both linux and freebsd have ways of turning up the network buffer size. See this post in the flow-tools list: http://www.pairlist.net/pipermail/flow-tools/2003-February/001089.html You may be able to increase performance by increasing this buffer. Mike _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
