David, tell me more about - how you use ntop (options) - whether you sniff only from network or also from NetFlow or similaria
Cheers, Luca
David Touitou wrote:
Luca Deri wrote:
Hi all,
Hi Luca & all,
- use *BSD and enable polling
I just did, same server (FreeBSD 4.9-RC, P3-733) as yesterday.
Current bandwidth is arround 5Mbps (no udp game packets right now), I added device_polling option in kernel and HZ=1000.
With kern.polling.enable=0 :
ntop CPU usage arround 9%
arround 6.5% packets drop (from web interface)
With kern.polling.enable=1 :
ntop CPU usage about 9%
arround 6.5% packets drop (from web interface)
I tried both to change kern.polling.enable with ntop running and to change it with ntop stopped.
Under such "low" network load, device polling does not help.
Here are the packets size stats from the web interface : < 64 bytes 45.4% 2,589,400 < 128 bytes 29.0% 1,654,627 < 256 bytes 19.8% 1,127,276
Still the same unconsistancy between web interface and ntop log. Web Interface : Total 5,703,202 Dropped by the kernel 376,074 [6.59 %] ntop log : STATS: 697,415 packets received by filter on fxp1 STATS: 5,590 packets dropped by kernel STATS: 0 packets dropped by ntop
Why such difference ????
Changing buffer values (kern.ipc.maxsockbuf, net.inet.tcp.sendspace and net.inet.tcp.recvspace) does not change the CPU usage or packets drop percentage.
Anyone willing to help me or at least provide me a testfield for testing at Gbit speeds?
I don't have gigabit, but I have "not working" less-than-10Mbps 8-))
David
_______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
-- Luca Deri <[EMAIL PROTECTED]> http://luca.ntop.org/ Hacker: someone who loves to program and enjoys being clever about it - Richard Stallman
_______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
