It's not nuts - see the response I just posted to the msg back three in this
chain.
The 400K # is the sum of the libpcap ps_drop counter, each time it's
queried, although under BSD and Linux it's NOT reset to zero when queried.
I don't know about Solaris - since Luca originally wrote ntop under Solaris,
I expect is IS reset and that's where the code came from. As a 1st
approximation to the solution, you could change the increment in http.c:
/* Update number of dropped packets */
if(myGlobals.device[myGlobals.actualReportDeviceId].pcapPtr
&& (!myGlobals.device[myGlobals.actualReportDeviceId].virtualDevice)) {
struct pcap_stat pcapStats;
if(pcap_stats(myGlobals.device[myGlobals.actualReportDeviceId].pcapPtr,
&pcapStats) >= 0) {
#ifdef WIN32
myGlobals.device[myGlobals.actualReportDeviceId].droppedPkts.value =
pcapStats.ps_drop;
#else
incrementTrafficCounter(&myGlobals.device[myGlobals.actualReportDeviceId].dr
oppedPkts, pcapStats.ps_drop);
#endif
}
}
to a simple set:
/* Update number of dropped packets */
if(myGlobals.device[myGlobals.actualReportDeviceId].pcapPtr
&& (!myGlobals.device[myGlobals.actualReportDeviceId].virtualDevice)) {
struct pcap_stat pcapStats;
if(pcap_stats(myGlobals.device[myGlobals.actualReportDeviceId].pcapPtr,
&pcapStats) >= 0) {
myGlobals.device[myGlobals.actualReportDeviceId].droppedPkts.value =
pcapStats.ps_drop;
}
}
That makes the value at least a timely as the last http:// request.
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David
Touitou
Sent: Tuesday, October 21, 2003 4:42 AM
To: [EMAIL PROTECTED]
Subject: Re: [Ntop] Dropped by the kernel
David Touitou wrote:
> Luca Deri wrote:
>> Hi all,
> Hi Luca & all,
Answsering to myself once more...
> Still the same unconsistancy between web interface and ntop log.
> Web Interface :
> Total 5,703,202
> Dropped by the kernel 376,074 [6.59 %]
> ntop log :
> STATS: 697,415 packets received by filter on fxp1
> STATS: 5,590 packets dropped by kernel
> STATS: 0 packets dropped by ntop
>
> Why such difference ????
I found why and I feel extremely stupid.
I was not checking the correct web interface (I was checking on another
probe).
Here are the correct results, after running ntop (with or without -n -M
-b) for 5 minutes (device polling enabled, CPU usage arround 9%) :
Web interface :
Total 352,611
Dropped by the kernel 388,472 [110.17 %]
ntop log :
STATS: 366,473 packets received by filter on fxp1
STATS: 9,088 packets dropped by kernel
STATS: 449,854 packets dropped by ntop
This is nuts, but I can reproduce it as much as I want : clicking on
"Traffic" on the web interface (reloading traffic stats page) instantly
make ntop printing (on the web interface) an awfull lot of "dropped by
kernel" packets and more than 100%.
It works the same with reloading several time the Hosts stats page.
The web interface shows packets as "dropped by kernel" whereas the ntop
log file shows "packets dropped by ntop".
What are these packets (if they exists), where are they from/to and why
are they dropped by ntop (and showned as dropped by kernel in the web
interface) ?
David.
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
