#2 sounds reasonable, esp as ntop's processing time is more dependent upon the # of packets than their length (other than a few protocol-specific decodes (http, ftp, etc.), we mostly deal with the packet header).
-----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Craig Humphrey Sent: Monday, October 20, 2003 5:10 PM To: '[EMAIL PROTECTED]' Subject: RE: [Ntop] Dropped by the kernel It's probably also worth checking out a couple of things: 1. Turn off ntop and just use tcpdump on the interface. What kind of stats do you get? Then turn of DNS resolution for tcpdump and run it again. Same or better? 2. Check to see if you're generating large numbers of small packets. I've found that even a P3-1.4GHz 512Meg RAM, has trouble keeping up with large numbers of small packets (possibly a combination of [hardware] platform, NIC, NIC drivers and the linux kernel version). Just my 2c. Later'ish Craig > -----Original Message----- > From: David Touitou [mailto:[EMAIL PROTECTED] > Sent: Tuesday, October 21, 2003 10:02 AM > To: [EMAIL PROTECTED] > Subject: Re: [Ntop] Dropped by the kernel > > > Burton M. Strauss III wrote: > > > Get a faster NIC/Processor. > > P3-733 (133 MHz FSB) and Intel 82559 Pro/100 Ethernet (with microcode > loaded, aka less interrupt calls)) are not fast enough for 9Mbps > bandwidth stats ? > > Wow... > > What kind of hardware should be used here ? ... _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
