I am new to NTop and have checked the FAQ but I cannot seem to find the issue I am having.
I am running NTop 3.0 stable with a Gig Ethernet interface plugged into a span port on a Cisco 6509. There is about 150Mbps of traffic being mirrored to the port. What happens is that NTop starts and works great but then after about 5 minutes I get kernel: device eth0 left promiscuous mode in the log and the web server is no longer accessible (I access this through another interface on the server). I turned the trace level to 4 and here is the tail of my log file if it helps. By the way, I tried version 2.2 first (accidentally downloaded that one) and it worked fine for several days before I upgraded. By the way, this is a RedHat 9 server running on a Dell 400SC with a Gig of RAM. Any help you can provide would be much appreciated. Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Checking for IP address <-> Country Code mapping file Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Checking './p2c.opt.table.gz' Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Checking './p2c.opt.table' Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Checking '/etc/ntop/p2c.opt.table.gz' Jul 19 20:50:36 netflow ntop[4385]: IP2CC: ...Found Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Loading file '/etc/ntop/p2c.opt.table.gz' Jul 19 20:50:36 netflow ntop[4385]: IP2CC: .... 10000 records read Jul 19 20:50:36 netflow ntop[4385]: IP2CC: .... 20000 records read Jul 19 20:50:36 netflow ntop[4385]: IP2CC: .... 30000 records read Jul 19 20:50:37 netflow ntop[4385]: IP2CC: .... 40000 records read Jul 19 20:50:37 netflow ntop[4385]: IP2CC: .... 50000 records read Jul 19 20:50:37 netflow ntop[4385]: IP2CC: Closing file Jul 19 20:50:37 netflow ntop[4385]: IP2CC: ...found 52395 lines Jul 19 20:50:37 netflow ntop[4385]: GDVERCHK: Guessing at libgd version Jul 19 20:50:37 netflow ntop[4385]: **WARNING** GDVERCHK: Unable to load gd, message is 'libgd.so: cannot open shared object file: No such file or directory' Jul 19 20:50:37 netflow ntop[4385]: GDVERCHK: ... as 1.8.x Jul 19 20:50:37 netflow ntop[4385]: Initializing external applications Jul 19 20:50:37 netflow ntop[4385]: Initializing semaphores, mutexes and threads Jul 19 20:50:37 netflow ntop[4385]: NOTE: atfork() handler registered for mutexes, rc 0 Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Packet processor thread running... Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread (1116957488) for network packet analyser Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Fingerprint scan thread running... Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread (1125350192) for fingerprinting Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Idle host scan thread running... Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread (1133742896) for idle hosts detection Jul 19 20:50:37 netflow ntop[4385]: Starting Plugins Jul 19 20:50:37 netflow ntop[4385]: Calling plugin start functions (if any) Jul 19 20:50:37 netflow ntop[4385]: Plugins started... continuing with initialization Jul 19 20:50:37 netflow ntop[4385]: MEMORY: Base memory load is 4.03MB (2459320+1757184) Jul 19 20:50:37 netflow ntop[4385]: MEMORY: Base interface structure (no hashes loaded) is 0.27MB each Jul 19 20:50:37 netflow ntop[4385]: MEMORY: or 0.27MB for 1 interfaces Jul 19 20:50:37 netflow ntop[4385]: MEMORY: ipTraffixMatrix structure (no TrafficEntry loaded) is 1.41MB Jul 19 20:50:37 netflow ntop[4385]: Sniffying... Jul 19 20:50:37 netflow ntop[4385]: INIT: Created pid file (/var/run/ntop.pid) Jul 19 20:50:37 netflow ntop[4385]: CHKVER: Checking current ntop version at version.ntop.org/version.xml Jul 19 20:50:37 netflow ntop[4385]: Listening on [eth0] Jul 19 20:50:37 netflow ntop[4385]: Now running as requested user 'root' (0:0) Jul 19 20:50:37 netflow ntop[4385]: Loading Plugins Jul 19 20:50:37 netflow ntop[4385]: Searching for plugins in /usr/lib/ntop/plugins Jul 19 20:50:37 netflow ntop[4385]: Loading plugin '/usr/lib/ntop/plugins/lastSeenPlugin.so' Jul 19 20:50:37 netflow ntop[4385]: LASTSEEN: Welcome to LastSeenWatchPlugin. (C) 1999 by Andrea Marangoni Jul 19 20:50:37 netflow ntop[4385]: Compiling filter 'ip or (vlan and ip)' on interface eth0 Jul 19 20:50:37 netflow ntop[4385]: Loading plugin '/usr/lib/ntop/plugins/icmpPlugin.so' Jul 19 20:50:37 netflow ntop[4385]: ICMP: Welcome to icmpWatchPlugin. (C) 1999-2004 by Luca Deri Jul 19 20:50:37 netflow ntop[4385]: Loading plugin '/usr/lib/ntop/plugins/netflowPlugin.so' Jul 19 20:50:37 netflow ntop[4385]: NETFLOW: Welcome to NetFlow.(C) 2002-04 by Luca Deri Jul 19 20:50:37 netflow ntop[4385]: Loading plugin '/usr/lib/ntop/plugins/nfsPlugin.so' Jul 19 20:50:37 netflow ntop[4385]: NFS: Welcome to nfsWatchPlugin. (C) 1999-2004 by Luca Deri Jul 19 20:50:37 netflow ntop[4385]: Compiling filter 'port 2049' on interface eth0 Jul 19 20:50:37 netflow ntop[4385]: Loading plugin '/usr/lib/ntop/plugins/pdaPlugin.so' Jul 19 20:50:37 netflow ntop[4385]: PDA: Welcome to PDAPlugin. (C) 2001-2004 by L.Deri and W.Brock Jul 19 20:50:37 netflow ntop[4385]: Loading plugin '/usr/lib/ntop/plugins/rrdPlugin.so' Jul 19 20:50:37 netflow ntop[4385]: RRD: Welcome to rrdPlugin. (C) 2002-04 by Luca Deri. Jul 19 20:50:37 netflow ntop[4385]: Loading plugin '/usr/lib/ntop/plugins/sflowPlugin.so' Jul 19 20:50:37 netflow ntop[4385]: SFLOW: Welcome to sFlowPlugin. (C) 2002-04 by Luca Deri Jul 19 20:50:37 netflow ntop[4385]: Compiling filter 'ip' on interface eth0 Jul 19 20:50:37 netflow ntop[4385]: Loading plugin '/usr/lib/ntop/plugins/xmldumpPlugin.so' Jul 19 20:50:37 netflow ntop[4385]: XML: Welcome to xmldump plugin. (C) 2003-2004 by Burton Strauss Jul 19 20:50:37 netflow ntop[4385]: Starting Plugins Jul 19 20:50:37 netflow ntop[4385]: Calling plugin start functions (if any) Jul 19 20:50:37 netflow ntop[4385]: Starting 'xmldump plugin' Jul 19 20:50:37 netflow ntop[4385]: Starting 'sFlowPlugin' Jul 19 20:50:37 netflow ntop[4385]: Starting 'rrdPlugin' Jul 19 20:50:37 netflow ntop[4385]: RRD: Welcome to the RRD plugin Jul 19 20:50:37 netflow ntop[4385]: RRD: Mask for new directories is 0700 Jul 19 20:50:37 netflow ntop[4385]: RRD: Mask for new files is 0066 Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: rrd thread (1150528304) started Jul 19 20:50:37 netflow ntop[4385]: RRD: Started thread (1150528304) for data collection. Jul 19 20:50:37 netflow ntop[4385]: Starting 'PDAPlugin' Jul 19 20:50:37 netflow ntop[4385]: Starting 'nfsWatchPlugin' Jul 19 20:50:37 netflow ntop[4385]: Starting 'NetFlow' Jul 19 20:50:37 netflow ntop[4385]: Starting 'icmpWatchPlugin' Jul 19 20:50:37 netflow ntop[4385]: Starting 'LastSeenWatchPlugin' Jul 19 20:50:37 netflow ntop[4385]: Plugins started... continuing with initialization Jul 19 20:50:37 netflow ntop[4385]: SSL is present but https is disabled: use -W <https port> for enabling it Jul 19 20:50:37 netflow ntop[4385]: Device 0. eth0 (active) Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Merging interfaces, reporting device forced to 0 Jul 19 20:50:37 netflow ntop[4385]: Note: Reporting device initally set to 0 [eth0] (merged) Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Initializing web server Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Initializing tcp/ip socket connections for web server Jul 19 20:50:37 netflow ntop[4385]: Initializing socket, port 3000, address (any) Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Work-around activated Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Creating 0, '/tmp/ntop-000004385-0' Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Created file 0 - '/tmp/ntop-000004385-0'(1) Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Creating 1, '/tmp/ntop-000004385-1' Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Created file 1 - '/tmp/ntop-000004385-1'(10) Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Creating 2, '/tmp/ntop-000004385-2' Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Created file 2 - '/tmp/ntop-000004385-2'(11) Jul 19 20:50:37 netflow kernel: application bug: ntop(4385) has SIGCHLD set to SIG_IGN but calls wait(). Jul 19 20:50:37 netflow kernel: (see the NOTES section of 'man 2 wait'). Workaround activated. Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Created a new socket (12) Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Initialized socket, port 3000, address (any) Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Waiting for HTTP connections on port 3000 Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Starting web server Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: web connections thread (4385) started... Jul 19 20:50:37 netflow ntop[4385]: Note: SIGPIPE handler set (ignore) Jul 19 20:50:37 netflow ntop[4385]: WEB: ntop's web server is now processing requests Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread (1158921008) for web server Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Server started... continuing with initialization Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: pcap dispatch thread running... Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread (1167313712) for network packet sniffing on eth0 Jul 19 20:50:37 netflow ntop[4385]: CHKVER: Sending request: GET /version.xml HTTP/1.0^M Host: version.ntop.org^M User-Agent: ntop/3.0+SourceForge+RPM host/i686-pc-linux-gnu distro/redhat release/9 kernrlse/2.4.20-30.9smp GCC/3.2.2 config(host=; build=; target=; programprefix=; execprefix=; bindir=; sbindir=; datadir=; includedir=; libdir=; libexecdir=; localstatedir=; sharedstatedir=; mandir=; infodir=; optimize; bindir=; datadir=; sslv3; i18n) run(user; dbfilepath; interface; nomac; usesyslog=; tracelevel; tracklocalhosts; httpserver; numericipaddresses; sessions; localsubnets; daemon) gdbm/1.8.0 gd/1.8.x openssl/0.9.7a zlib/1.1.4 access/http interfaces(eth)^M Accept: */*^M ^M Jul 19 20:50:37 netflow ntop[4385]: CHKVER: http response: 200 Jul 19 20:50:37 netflow ntop[4385]: CHKVER: Version file is from 'version.ntop.org' Jul 19 20:50:37 netflow ntop[4385]: CHKVER: as of date is '2004-03-22T04:30:00' Jul 19 20:50:37 netflow ntop[4385]: CHKVER: obsolete is '2.2c ' (202000300) Jul 19 20:50:37 netflow ntop[4385]: CHKVER: unsupported is '2.2c ' (202000300) Jul 19 20:50:37 netflow ntop[4385]: CHKVER: stable is '3.0 ' (300000000) Jul 19 20:50:37 netflow ntop[4385]: CHKVER: development is '3.0.050 ' (300050000) Jul 19 20:50:37 netflow ntop[4385]: CHKVER: version is '3.0 SourceForge RPM' (300000000) Jul 19 20:50:37 netflow ntop[4385]: CHKVER: This version of ntop is the CURRENT stable version Jul 19 20:50:47 netflow ntop[4385]: SECURITY: Loading items table Jul 19 20:51:37 netflow ntop[4385]: IDLE_PURGE: FINISHED selection, 0 [out of 1505] hosts selected Jul 19 20:51:37 netflow ntop[4385]: IDLE_PURGE: Device 0: no hosts deleted Jul 19 20:53:17 netflow ntop[4385]: OSFP: scanFingerprintLoop() checked 514, resolved 514 Jul 19 20:53:37 netflow ntop[4385]: IDLE_PURGE: FINISHED selection, 0 [out of 3199] hosts selected Jul 19 20:53:37 netflow ntop[4385]: IDLE_PURGE: Device 0: no hosts deleted Jul 19 20:55:38 netflow ntop[4385]: IDLE_PURGE: FINISHED selection, 0 [out of 4677] hosts selected Jul 19 20:55:38 netflow ntop[4385]: IDLE_PURGE: Device 0: no hosts deleted Jul 19 20:55:52 netflow ntop[4385]: OSFP: scanFingerprintLoop() checked 178, resolved 178 Jul 19 20:57:38 netflow ntop[4385]: IDLE_PURGE: FINISHED selection, 0 [out of 5263] hosts selected Jul 19 20:57:38 netflow ntop[4385]: IDLE_PURGE: Device 0: no hosts deleted Jul 19 20:58:23 netflow ntop[4385]: OSFP: scanFingerprintLoop() checked 70, resolved 70 Jul 19 20:59:38 netflow ntop[4385]: IDLE_PURGE: FINISHED selection, 0 [out of 5600] hosts selected Jul 19 20:59:38 netflow ntop[4385]: IDLE_PURGE: Device 0: no hosts deleted Jul 19 21:00:54 netflow ntop[4385]: OSFP: scanFingerprintLoop() checked 39, resolved 39 Jul 19 21:01:39 netflow ntop[4385]: IDLE_PURGE: FINISHED selection, 79 [out of 6402] hosts selected Jul 19 21:01:39 netflow ntop[4385]: IDLE_PURGE: Device 0 [eth0]: 79 hosts deleted, elapsed time is 0.194950 seconds (0.002468 per host) Jul 19 21:03:14 netflow kernel: device eth0 left promiscuous mode _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
