That's weird. The patch should have given this: Received (libpcap) which is pcapStat.ps_recv Less:Dropped (libpcap) which is pcapStat.ps_drop Gives: Given to ntop which is calculated as pcapStat.ps_recv-pcapStat.ps_drop
But, oh... Total Received by ntop is myGlobals.device[].ethernetPkts.value s/b receivedPkts, which SHOULD equal the ps_ calc. Then receivedPkts - droppedPkts (dropped by ntop due to buffer overflow) should equal ethernetPkts. ethernetPkts SHOULD = Unicast (616,107) + Broadcast (190) + Multicast (111) So I need to tweak the reporting lines a smidge. But those numbers are MUCH more reasonable (dropped of 325 out of 616K or 0.05%). It would be interesting to see the stats from textinfo.html regarding "Packet Queue"... The dropped by libpcap - 37,068 of 653,801 or 5.7% still seems high. But that may be packets left in libpcap's queue that ntop didn't take in time - without digging into the implementation of libpcap on the different platforms, there's no way to tell what ps_drop really means. Or it could be due to a filter expression (-B "xxx" - I don't remember if you are using one). There are a few messages on the web of problems with the fxp driver - see, for example http://lists.freebsd.org/pipermail/freebsd-bugs/2003-April/000325.html and http://news.gw.com/freebsd.stable/41069. Ring any bells? -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Touitou Sent: Friday, October 24, 2003 2:36 PM To: [EMAIL PROTECTED] Subject: Re: [Ntop] Dropped by the kernel Burton M. Strauss III wrote: > Try this patch - I'm working on it to rationalize the drop counts. Thanks. > It won't fix the drops (that's either NIC, libpcap or ntop simply not > accepting them fast enough from libpcap), but it should make the stats more > rational in both the PR_ and info.html/textinfo.html. Just compiled and launched it. Web page is not the same (as supposed) and, while hitting "traffic" again and again, the stats seams to be ok : Received (libpcap) 653,801 Less: Dropped (libpcap) 37,068 Gives: Given to ntop 616,733 Total Received by ntop 616,408 Gives: Total packets 616,408 Unicast 100.0% 616,107 Broadcast 0.0% 190 Multicast 0.0% 111 CPU usage is about 33%. 21.7% user, 0.0% nice, 11.2% system, 1.6% interrupt, 65.5% idle Network traffic is arround 7500Mbps/1600Mbps. Second answer about the test I started a few hours ago. Here are the results in /var/log/messages after stopping ntop (with kill -2 PID) : STATS: 47,711,705 packets received by filter on fxp1 STATS: 295,578 packets dropped by kernel STATS: 0 packets dropped by ntop That's 0.62% of packet dropped by kernel as read in the log (not website). David. _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
