That message you pointed me at is oh so nice... Anyway, I looked at the patch and it's ok - I'm going to add a warning line about the potential discrepancy between ps_recv-ps_drop and receivedPkts and commit the bugger. It's CLEARLY better than what used to be in there.
>From the text I sent you off list from libpcap's source, the ps_drop doesn't include packets dropped due to the filters anyway, it's because there aren't buffers in libpcap. Why, that's the key question and one I have no clue about. It could be the older NIC is less efficient, or it could be something else. Let us know what you find out re the 82550... -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Touitou Sent: Friday, October 24, 2003 3:30 PM To: [EMAIL PROTECTED] Subject: Re: [Ntop] Dropped by the kernel Burton M. Strauss III wrote: > That's weird. The patch should have given this: /snip > So I need to tweak the reporting lines a smidge. OK, I got it. > But those numbers are MUCH more reasonable (dropped of 325 out of 616K or > 0.05%). Yeap. Looks much more like the log stats (not web stats). > It would be interesting to see the stats from textinfo.html regarding > "Packet Queue"... Received.....11761827 Processed immediately.....11761827 Queued.....0 Current queue.....0 Maximum queue.....0 > The dropped by libpcap - 37,068 of 653,801 or 5.7% still seems high. But > that may be packets left in libpcap's queue that ntop didn't take in time - > without digging into the implementation of libpcap on the different > platforms, there's no way to tell what ps_drop really means. Or it could be > due to a filter expression (-B "xxx" - I don't remember if you are using > one). No filter expression on this session. > There are a few messages on the web of problems with the fxp driver - see, > for example > http://lists.freebsd.org/pipermail/freebsd-bugs/2003-April/000325.html and > http://news.gw.com/freebsd.stable/41069. Ring any bells? Yeap... I have several fxp cards in the ntop server, but different releases. fxp0 (ssh/web usage) is "Intel 82558 Pro/100 Ethernet". fxp1 (current probe) is "Intel 82559 Pro/100 Ethernet". fxp2 (not used yet) is "Intel 82550 Pro/100 Ethernet". fxp3 (not used yet) is "Intel 82559 Pro/100 Ethernet". I'll have to make a try with the 82550 one (on monday). Look at this : http://groups.google.fr/groups?q=intel+82559+82550+newer&hl=fr&lr=&ie=UTF-8&; oe=UTF-8&selm=b3ejhn%241b24%241%40FreeBSD.csie.NCTU.edu.tw&rnum=1 David. _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
