I'd blame FreeBSD, since the same cards don't have the same problem under Linux. Although it's clear that the same fields mean different things! Read the Linux source - http://cvs.tcpdump.org/cgi-bin/cvsweb/libpcap/pcap-linux.c?rev=1.98 (search for ps_drop). It's instructive as to the differences between Linux versions and between Linux and other systems. Compare that with the non-Linix source, http://cvs.tcpdump.org/cgi-bin/cvsweb/libpcap/pcap-bpf.c?rev=1.67
Instructive, isn't it... At this point, I think the thread is dead - the code is as good as it can be at tracking this. Here's my 'final' resolution: "The information on the Stats | Traffic page is simply the best available. However, this data is not always easy to interpret. The network card (NIC) reads packets from the wire into a small buffer. That buffer is emptied by the OS into it's own buffers which are then passed to libpcap. libpcap filters the packets (if requested) and passes the packets to ntop. Packets may be dropped at any or all of these stages, even on a system that does not appear to be exceptionally busy. Accurate counts of dropped packets do not exist or are not available without using low-level, system dependent logic. On many systems, interface level (NIC) statistics are available through the ifconfig command. The counts that ARE available in a system-independent way are what is reported in the statistics on the Stats | Traffic page. ntop reports the packet and dropped counts as reported by libpcap (see the pcap man pages and sources - look for ps_drop). As you can see from the comments in the code, the interpretation of those counts differs between operating systems and even between minor versions of the same OS (e.g. Linux 2.4.8 vs. 2.4.9). For example, some systems do not maintain a dropped count and will always report zero. Differences may also occur on the same system for different NIC drivers. If a BPF filter (-B option) is in place, the differences between OSes are more significant. ntop processes or queues all packets received from libpcap but may drop packets if the processing queue fills up. Losing a few packets inside ntop due to a rare burst of traffic is just that - rare, and is not a 'bug'. If you consistently see packets dropped by ntop then you probably need to use a faster processor (increasing the buffer size beyond the default of 2K packets will usually not help). You can monitor the queue size on the 'Configuration' (info.html) page. If you consistently see packets dropped at either the interface or libpcap level, there is not much we can offer in the way of help for you. The best suggestion is to try another NIC or a faster machine. (Some NICs - especially ISA ones - are just too slow at moving packets off card). Memory bus speeds (e.g. PC100 vs PC133, DDR333 vs DDR400, etc.) can also affect the ability of the process to keep up. Some network card drivers are processor intensive, others offload most processing to the NIC, so a faster CPU may or may not help. Drivers for a NIC on one OS may take advantage of features the card provides and be 'faster', while the driver for the same NIC on another OS may not take advantage of these features and be 'slower'. As we say, YMMV... -----Burton ---------- Original Message ---------------------------------- From: David Touitou <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Fri, 07 Nov 2003 23:05:53 +0100 >Burton M. Strauss III wrote: > >> Since those stats appear to come from the NIC driver, I think you're going >> to have to look into the fxp.c driver and figure out what it's counting in >> the data it returns to BIOCGSTATS. >> >> http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/dev/fxp/ > >I'll try a gigabit Intel card next week. > >BTW, I just tried the last ntop from cvs on FreeBSD 4.9-STABLE (both >checkout and compiled today). > >Always packets dropped (more on this next week). >Web page error has appeared (Stats/Traffic) : > Received (libpcap) 728,047 > Less: Dropped (libpcap) 52,430 > Gives: Given to ntop 675,617 > Total Received by ntop 675,464 > Dropped by ntop 0.0% 0 > Total packets processed 675,464 > >David. >_______________________________________________ >Ntop mailing list >[EMAIL PROTECTED] >http://listgateway.unipi.it/mailman/listinfo/ntop > ____________________________________________________________ Free 20MB Web Site Hosting and Personalized E-mail Service! Get It Now At Doteasy.com http://www.doteasy.com/et/ _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
