I'd blame FreeBSD, since the same cards don't have the same problem under Linux.  
Although it's clear that the same fields mean different things!  Read the Linux source 
- http://cvs.tcpdump.org/cgi-bin/cvsweb/libpcap/pcap-linux.c?rev=1.98 (search for 
ps_drop).  It's instructive as to the differences between Linux versions and between 
Linux and other systems.  Compare that with the non-Linix source, 
http://cvs.tcpdump.org/cgi-bin/cvsweb/libpcap/pcap-bpf.c?rev=1.67

Instructive, isn't it...

At this point, I think the thread is dead - the code is as good as it can be at 
tracking this.  Here's my 'final' resolution:

"The information on the Stats | Traffic page is simply the best available.  However, 
this data is not always easy to interpret.

The network card (NIC) reads packets from the wire into a small buffer.  That buffer 
is emptied by the OS into it's own buffers which are then passed to libpcap.  libpcap 
filters the packets (if requested) and passes the packets to ntop.

Packets may be dropped at any or all of these stages, even on a system that does not 
appear to be exceptionally busy.

Accurate counts of dropped packets do not exist or are not available without using 
low-level, system dependent logic.  On many systems, interface level (NIC) statistics 
are available through the ifconfig command.

The counts that ARE available in a system-independent way are what is reported in the 
statistics on the Stats | Traffic page.

ntop reports the packet and dropped counts as reported by libpcap (see the pcap man 
pages and sources - look for ps_drop).  As you can see from the comments in the code, 
the interpretation of those counts differs between operating systems and even between 
minor versions of the same OS (e.g. Linux 2.4.8 vs. 2.4.9).  For example, some systems 
do not maintain a dropped count and will always report zero.  Differences may also 
occur on the same system for different NIC drivers.  If a BPF filter (-B option) is in 
place, the differences between OSes are more significant.

ntop processes or queues all packets received from libpcap but may drop packets if the 
processing queue fills up.  Losing a few packets inside ntop due to a rare burst of 
traffic is just that - rare, and is not a 'bug'.  If you consistently see packets 
dropped by ntop then you probably need to use a faster processor (increasing the 
buffer size beyond the default of 2K packets will usually not help).  You can monitor 
the queue size on the 'Configuration' (info.html) page.

If you consistently see packets dropped at either the interface or libpcap level, 
there is not much we can offer in the way of help for you.  The best suggestion is to 
try another NIC or a faster machine.  (Some NICs - especially ISA ones - are just too 
slow at moving packets off card).  Memory bus speeds (e.g. PC100 vs PC133, DDR333 vs 
DDR400, etc.) can also affect the ability of the process to keep up.  Some network 
card drivers are processor intensive, others offload most processing to the NIC, so a 
faster CPU may or may not help.  Drivers for a NIC on one OS may take advantage of 
features the card provides and be 'faster', while the driver for the same NIC on 
another OS may not take advantage of these features and be 'slower'.

As we say, YMMV...


-----Burton



---------- Original Message ----------------------------------
From: David Touitou <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date:  Fri, 07 Nov 2003 23:05:53 +0100

>Burton M. Strauss III wrote:
>
>> Since those stats appear to come from the NIC driver, I think you're going
>> to have to look into the fxp.c driver and figure out what it's counting in
>> the data it returns to BIOCGSTATS.
>> 
>> http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/dev/fxp/
>
>I'll try a gigabit Intel card next week.
>
>BTW, I just tried the last ntop from cvs on FreeBSD 4.9-STABLE (both 
>checkout and compiled today).
>
>Always packets dropped (more on this next week).
>Web page error has appeared (Stats/Traffic) :
>       Received (libpcap)      728,047
>       Less: Dropped (libpcap) 52,430
>       Gives: Given to ntop    675,617
>       Total Received by ntop  675,464
>       Dropped by ntop 0.0%    0
>       Total packets processed 675,464
>
>David.
>_______________________________________________
>Ntop mailing list
>[EMAIL PROTECTED]
>http://listgateway.unipi.it/mailman/listinfo/ntop
>


____________________________________________________________
Free 20MB Web Site Hosting and Personalized E-mail Service!
Get It Now At Doteasy.com http://www.doteasy.com/et/
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop

Reply via email to