|
Thanks
for the useful tips, everyone. I hadn't thought about losing the ARP
traffic. I will probably use an old laptop until I can justify supporting
a "real" Linux box.
By the
way, I am more like the guy responsible for the train wreck/disaster so I will
probably avoid this approach.
-----Original Message-----
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Burton M.
Strauss III
Sent: Tuesday, December 30, 2003 3:59 PM
To:
[EMAIL PROTECTED]
Subject: RE: [Ntop] Curious: Running Ntop from an
emulator?
ntop puts a heavy load on memory. Most virtualized systems
provide limited amount of virtual memory, which even worse may well be swap
space on the host OS. That will kill you.
I've
used UML to package and test the RedHat rpm's, but I don't run it for long -
it beat the heck out of Tigger, which is a dual 1Ghz P3 w/ 800+MB of
ram.
For
toy use such as that, it's ok. Not good, but ok.
The
limitation on networking is what packet data you see. Many emulated
'NICs' are IP only, so you won't see the non-IP traffic such as (R)ARP...
UML has a pcap 'NIC' (i.e. a monitor/spy), which was just written up in
last months (UK) Linux format, but I haven't tried it. With Luca's
findings about libpcap's inability to handle high traffic loads (i.e north of
100Mbps), I wonder how well this would work...
I
guess if you're the kind of person who enjoys disaster films and watching
train wrecks, it's right up your alley...
-----Burton
Has anyone attempted to run Ntop
from an emulator / vitualizer such as Bochs, Plex 86, VMWare or Virtual PC?
I imagine that this would be a pain on most emulators due to the way
networking is handled, but I figured that it wouldn’t hurt to
ask.
| 